finding(release): no GitHub release or git tag has been created since 17.5.0 — Changesets CLI v3 stopped printing the `New tag:` lines `changesets/action@v1` parses, so 17.6.0 and 17.7.0 reached npm with no tag and no release

[hotlong]

What is missing

The GitHub Releases page for this repository stops at the 17.5.0 set, created on 2026-08-14. Both later versions are on npm:

version	npm	git tag @object-ui/core@…	GitHub releases
17.5.0	2026-08-14	✅	✅ one per package
17.6.0	2026-08-24	❌	❌
17.7.0	2026-10-04 03:55Z	❌	❌

The 17.7.0 publish run (37175007951) reports success in every step, including "Verify the release reached npm". All 39 published packages serve 17.7.0.

Why

• changeset-release.yml publishes through changesets/action@v1 (publish: pnpm changeset:publish). v1 learns what was published by parsing the publish script's stdout for New tag: <pkg>@<version> lines. Only for the packages it finds does it push the tag (git.pushTag) and create the GitHub release.
• objectui#5296 moved the repository to @changesets/cli v3 between the two releases. At the 17.5.0 tag, package.json declares ^2.31.1. At the 17.6.0 release commit 59f61cfb it declares ^3.0.0, and the lockfile resolves 3.0.1.
• CLI v3's changeset publish prints through @clack/prompts and reports published packages through an output report (CHANGESETS_OUTPUT). Its dist contains no New tag string: 0 occurrences in @changesets/cli@3.0.1/dist.
• v1 therefore sees zero published packages, pushes no tag and creates no release. Nothing fails: the npm verification step checks npm only. The workflow's own header notes this risk for v2 (feat: persist ViewConfigPanel draft to backend via DataSource.updateViewConfig #678: tags and releases "fail QUIETLY"). The CLI v3 bump triggered it under v1.

How objectstack does it (port this)

../objectstack uses the same CLI v3 and still gets releases (17.6.0 has them):

• scripts/release-publish.sh runs changeset publish (which creates the tags locally), then ONE atomic git push origin --tags. objectstack#2191 explains why this is atomic: per-tag pushes raced GitHub's ref backend.
• .github/workflows/release.yml step "Create GitHub Releases (bodies truncated to the API limit)" runs node scripts/release-github-releases.mjs with RELEASE_VERSION. The script creates one release per public package from its CHANGELOG entry. It is idempotent, and it truncates bodies to the API limit with a self-test battery.

Fix

1. In the publish lane, after changesets/action@v1 publishes, push the tags changeset publish created on the runner and create one GitHub release per published package for the version the lane published (needs.lane.outputs.manifest_version). Port release-github-releases.mjs and its self-tests, adapted to this workspace's package enumeration, rather than re-deriving it. The step must run only on the publish lane (push with the version not on npm before), never on schedule / workflow_dispatch.
2. Keep changesets/action@v1. The pin's reasoning in the workflow header is unchanged. Do not set createGithubReleases: false unless the new step fully replaces it.
3. Backfill, after the fix lands: put each tag on the commit its version was published from, which is not always the version commit, and create releases for both versions with the ported script.
   • 17.6.0: published by run 32739909630 from b65fe911de. Its "Publish to npm" step ran 14:41:58–14:45:08Z on 2026-08-24. The version commit 59f61cfb (chore: release packages #4655) merged on 08-20, but objectui#5442's npm-keyed retry published 17.6.0 four days later from that later head.
   • 17.7.0: published by run 37175007951 from b493919c, the chore: release packages #5400 merge.

---

Generated by Claude Code

[objectstack-fleet]

Triage: first grade — bug · priority:p1 · domain:devx · area:devpath · pm:queue. Restore tags and GitHub releases in the publish lane by porting objectstack's step. ⛔ The backfill is the maintainer's release act

Triage seat (objectstack-wide, seat post objectstack-ai/objectstack#6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-04T04:56Z. ⛔ Not a claim, ⛔ not a dispatch.

Why p1. Release work is p1. Two published versions (17.6.0 and 17.7.0) have no tag and no GitHub release, and every future release repeats it silently. The publish run reports success.

Routing: objectui's release pipeline (.github/workflows/changeset-release.yml, plus a ported script under scripts/), so domain:devx by objectui's lane table.

Direction: the card's fix, confirmed.

• The publish lane pushes the tags changeset publish created, in one atomic git push origin --tags (objectstack#2191's reason). It then creates one GitHub release per published package for the lane's version.
• Port objectstack's scripts/release-github-releases.mjs and its self-tests: idempotent, with bodies truncated to the API limit. ⛔ Not re-derived.
• It runs only on the publish lane, never on schedule / workflow_dispatch.
• Keep changesets/action@v1. ⛔ No createGithubReleases: false unless the new step fully replaces it.
• A guard that the step actually ran: the lane fails if the publish succeeded and the version's tag is absent on the remote afterwards. That replaces the silent class the workflow header already warns about (feat: persist ViewConfigPanel draft to backend via DataSource.updateViewConfig #678).
• Backfill (17.6.0 at b65fe911de, 17.7.0 at b493919c, on the publish commits the card measured) is a public release act, so it is the maintainer's. The claim prepares the exact commands with the ported script and hands them over. ⛔ It does not push tags itself.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 11596,
"status": "done",
"branch": "claude/objectstack-release-steps-ynhz3j",
"pr": "#11597",
"session": "session_014VGCS11YUtYAiinRcdqQwL",
"premise_still_valid": true,
"summary": "The premise holds. changesets/action v1.9.0 runPublish (read from source) pushes a tag and creates a Release only for packages whose New tag: stdout line it parses. CLI v3.0.1 prints none, though its publish still creates the annotated tags locally (createGitTags). The remote has no @17.6.0 or @17.7.0 tag, and the 17.7.0 Releases answer 404. Draft PR #11597 (head ae09c39) makes these changes. (1) It adds scripts/release-github-releases.mjs, ported from objectstack@7d0781482: idempotent, converges on a racing writer's 422, audits duplicates without ever deleting, and truncates bodies to the 125,000-char limit. It enumerates packages through workspacePackageDirs and skips private ones. It adds --print-tags and --dry-run. An empty release set is an error. The self-test has 93 assertions in 15 floored batteries. (2) changeset-release.yml gets two steps after the npm check, 'Push the release tags' and 'Create GitHub Releases'. Both run if !cancelled() && github.event_name == 'push' && steps.changesets-publish.outcome == 'success' && steps.verify-npm.outcome == 'success', both take RELEASE_VERSION from needs.lane.outputs.manifest_version, and both inherit workflow-level contents: write. The push is one push of exactly the tags --print-tags names, and the step fails naming any missing tag. The @v1 pin is kept, and the comments that claimed v1 makes the tags and Releases are updated. (3) The CI guide has a new subsection. (4) scripts/tests/release-github-releases.test.ts has 10 tests: the self-test, the dry-run with no token, the wiring pins and 7 applied-mutation tests. Extra finding, no new card: @object-ui/app-shell@17.5.0 has a tag but no Release because its entry is 158,203 chars (38 of 39 17.5.0 Releases exist). The ported truncation fixes the cause, so only a backfill is left. Deviations from the dispatch's suggested route: (a) the push step has no git config user., because the tags are created inside the action step after v1's default setupGitUser and a push creates no object; (b) it pushes the exact tag set instead of --tags; (c) an empty set fails. Conflicts noted, with the dispatch followed: the branch and worktree are the dispatch-named reused ones, not a fresh claude/issue-11596- worktree. The PR body carries the dispatch's robot footer lines and then ends with the contract's session-URL footer, read back byte-identical. Housekeeping: the merge of main resurrected the consumed .changeset/11586 file, and the branch deletes it again (not in the PR diff). The card and PR assignee fields are empty and no label was written; objectui's labeler owns path labels and the dispatch named none. I did not remove /home/user/objectui-release-changelog-scan because it predates this run and the PM pointed me at it. CI on ae09c39: in_progress (20 of 39 completed, 0 failed at report time).",
"tests": "All at HEAD ae09c39. node scripts/release-github-releases.mjs --self-test -> exit 0, 93 assertions, real types 17.7.0 section 1534879 chars -> 123644. pnpm exec vitest run scripts/tests/release-github-releases.test.ts -> Test Files 1 passed, Tests 10 passed. bash /home/user/objectstack/scripts/pm/os-verify-lock.sh -c 'pnpm exec vitest run scripts/tests --maxWorkers=2' -> Test Files 179 passed, 2 skipped (181); Tests 5452 passed, 2 skipped (5454); VERDICT command-exit 0; held the lock 261s. Workflow-reading pins first run separately (ref-pin, ci-cd-pipeline-doc, sync-quick-reference-release, workflow-cache-save-bound, check-pre-install-import-graph, changeset-polarity-census, check-changeset-fixed) -> 7 files, 240 tests passed. node scripts/check-changeset-presence.mjs -> exit 0, no changeset owed (4 files changed, 0 released source). node scripts/check-governed-queue-guard.mjs --test with the 4 changed paths -> NOT GOVERNED. pnpm check:entry-guard / check:new-line-citations (0 new) / check:control-bytes / check:pre-install-import-graph / check:bash32-floor / check:action-ref-convention / check:shell-escape-residue / check:test-path-roots / check:unreferenced-sources -> all exit 0. pnpm type-check:scripts -> exit 0, and --listFilesOnly includes the new test. eslint --no-inline-config on the 2 new files -> 0 problems. The test file gets 118 rules; the .mjs gets 0, because the repo config gives scripts/*.mjs no rules, so that half is NOT MEASURED. Ablation, after commit, with objectstack's scripts/ablation-replace.mjs and a trap: mutated if (targets.length === 0) to if (false && ...), and the landing was confirmed (anchor 1 -> 0, blob 083b5ea38 -> 573f80598). Self-test went red: 1 of 93 failed ('with no RELEASE_VERSION the tag list refuses instead of printing nothing (exit 0)'). Restored blob == HEAD 083b5ea38, and git diff HEAD was empty. Dry-run for 17.7.0 (GITHUB_SHA=b493919c7, no token): 39 tags, 39 releases planned (23 truncated), 0 failed to plan; tags: @object-ui/app-shell@17.7.0, @object-ui/auth@17.7.0, @object-ui/cli@17.7.0, @object-ui/collaboration@17.7.0, @object-ui/components@17.7.0, @object-ui/core@17.7.0, @object-ui/create-plugin@17.7.0, @object-ui/data-objectstack@17.7.0, @object-ui/fields@17.7.0, @object-ui/i18n@17.7.0, @object-ui/layout@17.7.0, @object-ui/mobile@17.7.0, @object-ui/permissions@17.7.0, @object-ui/plugin-ai@17.7.0, @object-ui/plugin-calendar@17.7.0, @object-ui/plugin-charts@17.7.0, @object-ui/plugin-chatbot@17.7.0, @object-ui/plugin-dashboard@17.7.0, @object-ui/plugin-designer@17.7.0, @object-ui/plugin-detail@17.7.0, @object-ui/plugin-editor@17.7.0, @object-ui/plugin-form@17.7.0, @object-ui/plugin-gantt@17.7.0, @object-ui/plugin-grid@17.7.0, @object-ui/plugin-kanban@17.7.0, @object-ui/plugin-list@17.7.0, @object-ui/plugin-map@17.7.0, @object-ui/plugin-markdown@17.7.0, @object-ui/plugin-report@17.7.0, @object-ui/plugin-timeline@17.7.0, @object-ui/plugin-tree@17.7.0, @object-ui/plugin-view@17.7.0, @object-ui/providers@17.7.0, @object-ui/react@17.7.0, @object-ui/react-runtime@17.7.0, @object-ui/runner@17.7.0, @object-ui/sdui-parser@17.7.0, @object-ui/types@17.7.0, @object-ui/console@17.7.0. For comparison: 17.6.0 -> 39 planned, 1 truncated; 17.5.0 -> 39 planned, 1 truncated (app-shell 158203 -> 123973). NOT MEASURED: the steps on a real runner (the first real run is the next release), and actionlint (not installed; the workflow is checked by YAML parse and the pins only).",
"mcp_calls": "0",
"api_writes": "2 via the fleet-write relay (each one POST /repos/objectstack-ai/objectstack/dispatches): pr_create -> POST /repos/objectstack-ai/objectui/pulls (draft, #11597); comment -> POST /repos//issues/11596/comments (this report). Plus git push x3 to claude/objectstack-release-steps-ynhz3j (not REST). All other gh api calls were reads.",
"open_questions": [
{
"question": "Backfill scope after merge: should it also cover @object-ui/app-shell@17.5.0, whose Release never existed because its body was over the API limit?",
"options": [
"A: yes, in the same pass: RELEASE_VERSION=17.5.0 updates the 38 existing Releases and creates app-shell's",
"B: only 17.6.0 and 17.7.0, as the issue lists"
],
"recommendation": "A, because it is the same defect class (a missing Release), the script is idempotent, and the tag already exists, so no tag work is needed."
}
],
"out_of_scope_findings": [
"class: a · reach: GET /repos/objectstack-ai/objectui/releases/tags/%40object-ui%2Fapp-shell%4017.5.0 -> 404 while the tag exists and 38 of 39 17.5.0 Releases exist · evidence: its 17.5.0 CHANGELOG entry is 158,203 chars, over the 125,000 Releases API limit; this PR's truncation removes the cause, so only the backfill remains. Recommend handling it in #11596's own backfill, not a new card · dedupe words: app-shell 17.5.0 release missing, release body too long, 125000",
"carrier: none · noted, not filed: the release job's timeout-minutes 40 derivation predates the two new steps (about 39 sequential API calls plus the duplicate audit). Not re-measured; at a 40-minute ceiling the margin looks ample, but no run has measured it"
]
}

---

Generated by Claude Code

[hotlong]

Backfill: still owed, and it has to be run by a maintainer

#11597 is merged, so from 17.8.0 on the publish lane pushes the tags and creates the Releases by itself. The next release will be the first real run of those two steps.

The backfill for the versions already on npm is not done. This session's GitHub proxy refuses to create releases ("Creating, editing, or deleting releases is not permitted for this session type"), and that refusal was not worked around. Dry runs from main at 973fc20f:

version	published from	planned	truncated
17.5.0	90222775 (existing tags; only @object-ui/app-shell@17.5.0 has no Release)	39	1
17.6.0	b65fe911, run 32739909630	39	1
17.7.0	b493919c, the #5400 merge (run 37175007951)	39	23

To run it from a checkout of current main with a token that can write releases, run these in this order so that 17.7.0 ends up as Latest:

export GITHUB_TOKEN="$(gh auth token)" GITHUB_REPOSITORY=objectstack-ai/objectui
RELEASE_VERSION=17.5.0 GITHUB_SHA=90222775245015dbca27c63cc5a8e92ca59da192 node scripts/release-github-releases.mjs
RELEASE_VERSION=17.6.0 GITHUB_SHA=b65fe911de22c7e3a573b669c4cd5efbe34758f2 node scripts/release-github-releases.mjs
RELEASE_VERSION=17.7.0 GITHUB_SHA=b493919c71dc915afeb26c96338263f368e95c79 node scripts/release-github-releases.mjs

• 17.5.0 creates the one missing Release and PATCHes the 38 existing ones with the same changelog entry. Their current bodies came from that entry. sdui-parser's is empty both before and after.
• 17.6.0 and 17.7.0 have no tags yet. Each Release POST creates its tag as a lightweight tag at GITHUB_SHA, the commit that version was published from.
• The script is idempotent, so a re-run converges.

---

Generated by Claude Code

[hotlong]

Backfill done, verified from the API

The maintainer ran the three commands. Read back from GET /releases and ls-remote:

version	Releases	unique tags	tag commit
17.5.0	39 (@object-ui/app-shell@17.5.0 now exists, body 123,957 chars, truncated from 158,203)	39	90222775
17.6.0	39	39	b65fe911, the commit run 32739909630 published from
17.7.0	39	39	b493919c, the #5400 merge

• No tag has two Releases.
• GET /releases/latest returns @object-ui/console@17.7.0.
• Four Releases have an empty body: 17.5.0 sdui-parser, react-runtime and create-plugin, and 17.6.0 react-runtime. Their CHANGELOG sections for that version are themselves empty. The fixed group bumped them with nothing to say.

From 17.8.0 on, the publish lane does this by itself. Closing.

---

Generated by Claude Code