fix(ci): delete the superseded publish workflow that could put a prerelease on latest by yakimoto · Pull Request #52 · wave-av/sdk

yakimoto · 2026-07-28T01:44:18Z

User description

Closes #51.

Deletes .github/workflows/publish.yml. One file, 27 lines, nothing added.

Two publishers, one gate

	`release.yml` — guarded	`publish.yml` — deleted here
Trigger	`tags: ['sdk-v*']`	`tags: ['v*']`
Auth	OIDC trusted publishing, no token	`NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}`
Provenance	`--provenance`, enforced	`--no-provenance`, explicitly stripped
Version check	tag must match `package.json` or it refuses	none
dist-tag	routed — `-next.` → `next`	none → `latest`

release.yml already knew: its own header says "publish.yml (tags: v*) publishes with NO gate; this workflow is the guarded one." The guarded one landed in #44. The ungated one was never removed.

The registry shows both halves of this

latest   2.0.14         gitHead f77067d…  — NOT a commit in this repo
next     2.1.0-next.0   gitHead 6140879…  — IS a commit in this repo

Two things follow. First, release.yml works exactly as designed — it published the prerelease to next and correctly left latest alone. Second, and worse than a plain version regression: what currently sits on latest was built from a different codebase. package.json here is 2.1.0-next.0, and npm publish with no --tag writes to latest regardless of semver — so an ungated v* tag would not merely move latest forward, it would replace a package built elsewhere with one built here.

That path is reachable: a legacy v2.0.1 tag already exists in this repo, so v* is a shape someone could plausibly reach for again.

$ git tag --list | tail -2
sdk-v2.1.0-next.0     ← the real release, via release.yml
v2.0.1                ← legacy, the shape publish.yml listens for

Two smaller defects die with the file

--no-provenance cancels the package's own stated intent. package.json declares publishConfig: { "provenance": true }, and this is a public repo where sigstore provenance actually works. A release down this path would be unattested even though the package asked to be attested.
Unpinned actions in a job holding publish rights. actions/checkout@v4 and actions/setup-node@v4 are mutable tags. release.yml pins its actions; this one didn't.

One correction to the issue, and it changes what this PR is

#51 says NPM_TOKEN "is currently set on the repo, so it is armed." It isn't set — anywhere. Re-measured:

$ gh api repos/wave-av/{sdk,mcp-server,adk,sdks}/actions/secrets   # → zero secrets, all four
$ gh api /orgs/wave-av/actions/secrets --paginate | grep -E 'NPM|NODE_AUTH'   # → no match

secrets.NPM_TOKEN resolves empty, so this workflow would fail at auth rather than publish. This is the removal of a latent path, not a live incident — and the "revoke the token" half of the suggested fix is already a no-op, so this PR carries no blast radius. A latent path that re-arms silently the moment someone adds an NPM_TOKEN for an unrelated reason is worth deleting while it's quiet.

If you want the `v*` ergonomics back

Add v* to release.yml's tag list rather than keeping a second workflow. One publisher, one gate.

CI

Cannot run. Actions are refusing every job org-wide on an account-level billing lock (plan=free, locked=yes). An absent check here is not a passing one. This is a pure deletion; release.yml, _checks.yml, foundation-gate.yml, issue-ops-triage.yml, lint.yml and public-repo-guard.yml all remain.

Part of the publishing audit in wave-av/sdks#42.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Note

Low Risk
Pure workflow deletion with no runtime or package changes; only removes an unused duplicate publish path.

Overview
Removes .github/workflows/publish.yml, leaving release.yml as the only npm publish path.

That deleted workflow reacted to v* tags (including legacy shapes like v2.0.1), used NPM_TOKEN, published with --no-provenance and no dist-tag routing—so a run could land on latest without the version/tag checks release.yml enforces. The path was latent without a repo secret today, but deleting it avoids it re-arming if someone adds a token later.

^{Reviewed by Cursor Bugbot for commit baa5cb4. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by cubic

Removes the superseded publish.yml workflow so only the guarded release.yml can publish. This prevents an ungated v* tag from putting a prerelease on latest and keeps provenance and dist-tag routing intact.

Bug Fixes
- Deleted .github/workflows/publish.yml (ungated v* trigger, NPM_TOKEN, --no-provenance, unpinned actions).
- Blocks prereleases landing on latest and avoids publishing from a different codebase.
- Path was latent (no NPM_TOKEN set), but removal prevents silent re-arming if a token gets added.

^{Written for commit baa5cb4. Summary will update on new commits.}

PR Type

Bug fix

Description

Remove outdated publish workflow to prevent prerelease conflicts
Fix registry discrepancy between 'latest' and 'next' tags
Update CI to rely solely on guarded release workflow
Eliminate security risk from untrusted npm publishing

Diagram Walkthrough

flowchart LR
  A["publish.yml (deleted)"] -->|Removal| B["release.yml (guarded)"]
  B -->|Tag: sdk-v*| C["npm publish"]
  C -->|Dist-tag: next| D["registry: next channel"]
  A -->|Tag: v*| E["npm publish"]
  E -->|Dist-tag: latest| F["registry: outdated package"]

File Walkthrough

	Relevant files

…elease on latest This repo has two npm publish workflows on different tag patterns. `release.yml` is the guarded one — OIDC trusted publishing with no long-lived token, `--provenance` enforced, a version gate that refuses when the tag does not match `package.json`, and dist-tag routing that sends `*-next.*` to the `next` channel. `publish.yml` is the legacy path and has none of that. `release.yml` already said so in its own header; the ungated one was simply never removed. The gap is live rather than theoretical. `package.json` on main is 2.1.0-next.0, and `npm publish` with no `--tag` writes to `latest` regardless of whether the version is a semver prerelease, so a `v*` tag pushed here would put a prerelease on `latest`. A legacy `v2.0.1` tag already exists in this repo, so `v*` is a shape someone could plausibly reach for again. The registry shows the guarded path working exactly as intended, and also shows why the overwrite would be worse than a version regression: latest 2.0.14 gitHead f77067d — NOT a commit in this repo next 2.1.0-next.0 gitHead 6140879 — IS a commit in this repo So `release.yml` correctly published the prerelease to `next` and correctly left `latest` alone, while what currently sits on `latest` was built from a different codebase entirely. An ungated `v*` tag here would not merely move `latest` forward — it would replace a package built elsewhere with one built here. Two smaller defects die with the file: `--no-provenance` cancels this package own declared `publishConfig.provenance: true` on a public repo where provenance actually works, and `actions/checkout@v4` / `actions/setup-node@v4` are unpinned mutable tags in a job holding publish rights, while `release.yml` pins its actions. Worth stating precisely: `NPM_TOKEN` does not currently exist — absent from this repo, from wave-av/{mcp-server,adk,sdks}, and from the org-level secret list — so `secrets.NPM_TOKEN` resolves empty and this workflow would fail at auth rather than publish. This is the removal of a latent path, not a live incident. A latent path that re-arms silently the moment someone adds an NPM_TOKEN for an unrelated reason is worth deleting while it is quiet. If a `v*` trigger is wanted for ergonomics, add `v*` to release.yml tag list rather than keeping a second workflow: one publisher, one gate. Closes #51. Part of the publishing audit in wave-av/sdks#42.

changeset-bot · 2026-07-28T01:44:21Z

⚠️ No Changeset found

Latest commit: eac15dc

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

cursor · 2026-07-28T01:44:26Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_bb498e0f-ae14-4e63-8d9b-f17bdb831716)

coderabbitai · 2026-07-28T01:44:28Z

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

💤 Files selected but had no reviewable changes (1)

.github/workflows/publish.yml

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fd80f730-b7d2-4e32-8004-01f9cad39a18

📥 Commits

Reviewing files that changed from the base of the PR and between e3864a7 and eac15dc.

📒 Files selected for processing (1)

.github/workflows/publish.yml

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/remove-superseded-publish

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch fix/remove-superseded-publish

_{Comment @coderabbitai help to get the list of available commands.}

…-publish

greptile-apps · 2026-09-06T20:06:31Z

No reviewable files after applying ignore patterns.

codeant-ai · 2026-09-06T20:06:31Z

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	`baa5cb4`	Sep 06, 2026 · 20:06	20:06

codeant-ai · 2026-09-06T20:06:32Z

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

cursor · 2026-09-06T20:06:32Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_38d47740-5385-4628-94dc-7bdaec23b5be)

macroscopeapp · 2026-09-06T20:07:34Z

Approvability

Verdict: Would Approve

Macroscope's review found this PR approvable — The specified base and head contain no changed files; the superseded workflow is already absent from the base commit. This PR therefore introduces no runtime, CI, release, or deployment behavior change.

Not approved because:

Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

wave-bugbot · 2026-09-06T21:13:36Z

🟢 WAVE BugBot — clear

No confident findings on the changed lines.

_{Local review · $0 inference · wave-dispatch}

Merge remote-tracking branch 'origin/main' into fix/remove-superseded…

baa5cb4

…-publish

yakimoto added this pull request to the merge queue Sep 8, 2026

Merged via the queue into main with commit 4f6c915 Sep 8, 2026
23 checks passed

yakimoto deleted the fix/remove-superseded-publish branch September 8, 2026 00:04

Navigation Menu

Uh oh!

fix(ci): delete the superseded publish workflow that could put a prerelease on latest - #52

fix(ci): delete the superseded publish workflow that could put a prerelease on latest#52
yakimoto merged 2 commits into
mainfrom
fix/remove-superseded-publish

yakimoto commented Jul 28, 2026 •

edited by github-actions Bot

Loading

Uh oh!

changeset-bot Bot commented Jul 28, 2026

Uh oh!

cursor Bot commented Jul 28, 2026

Uh oh!

coderabbitai Bot commented Jul 28, 2026

Review skipped

Uh oh!

greptile-apps Bot commented Sep 6, 2026

Uh oh!

codeant-ai Bot commented Sep 6, 2026 •

edited

Loading

Uh oh!

codeant-ai Bot commented Sep 6, 2026

Uh oh!

cursor Bot commented Sep 6, 2026

Uh oh!

macroscopeapp Bot commented Sep 6, 2026

Uh oh!

wave-bugbot Bot commented Sep 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

yakimoto commented Jul 28, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

Two publishers, one gate

The registry shows both halves of this

Two smaller defects die with the file

One correction to the issue, and it changes what this PR is

If you want the v* ergonomics back

CI

Summary by cubic

PR Type

Description

Diagram Walkthrough

File Walkthrough

Uh oh!

changeset-bot Bot commented Jul 28, 2026

⚠️ No Changeset found

Uh oh!

cursor Bot commented Jul 28, 2026

Bugbot couldn't run - usage limit reached

Uh oh!

coderabbitai Bot commented Jul 28, 2026

Review skipped

Uh oh!

greptile-apps Bot commented Sep 6, 2026

Uh oh!

codeant-ai Bot commented Sep 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 CodeAnt AI — Review Status

Uh oh!

codeant-ai Bot commented Sep 6, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

cursor Bot commented Sep 6, 2026

Bugbot couldn't run - usage limit reached

Uh oh!

macroscopeapp Bot commented Sep 6, 2026

Approvability

Uh oh!

wave-bugbot Bot commented Sep 6, 2026

🟢 WAVE BugBot — clear

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

yakimoto commented Jul 28, 2026 •

edited by github-actions Bot

Loading

If you want the `v*` ergonomics back

codeant-ai Bot commented Sep 6, 2026 •

edited

Loading