fix: include broker binary in all SDK publish paths

[khaliqgant]

Summary

• Add sdk to build-broker job's if condition so broker builds actually run for standalone SDK publishes
• Add broker binary download steps to publish-packages matrix job (conditional on matrix.package == 'sdk') so package: all also ships fresh binaries
• publish-sdk-only already had the download steps from fix: SDK publish includes freshly built broker binary #461, but was dead because build-broker was skipped for package == 'sdk'

Fixes the issue where every SDK publish shipped a stale broker binary checked into packages/sdk/bin/.

Test plan

• Publish with package: all — verify "Publish sdk" job shows "Download broker binaries" step
• Publish with package: sdk — verify publish-sdk-only runs (not skipped) and downloads binaries

🤖 Generated with Claude Code

---

[khaliqgant]

Duplicate of #462 which is already merged.

[devin-ai-integration]

Devin Review found 1 potential issue.

View 4 additional findings in Devin Review.

[devin-ai-integration]

🔴 build-broker failure blocks publishing of all unrelated packages when package == 'all'

Adding build-broker to the needs array of publish-packages means that if the Rust broker build fails, all 10 packages in the matrix (policy, memory, utils, trajectory, hooks, user-directory, config, sdk, telemetry, acp-bridge) will be skipped — even though only sdk actually needs the broker binaries.

Root Cause and Impact

Previously at .github/workflows/publish.yml:433, publish-packages had needs: build. Now it has needs: [build, build-broker]. In GitHub Actions, if any job in the needs list fails or is cancelled, the dependent job is skipped (unless if: always() is used).

This means a transient Rust compilation failure (e.g., a flaky cross-compilation for aarch64-unknown-linux-gnu) will prevent publishing of 9 pure-JavaScript packages that have zero dependency on the broker binary.

Before this PR: build-broker failure → publish-packages still runs → all JS packages published successfully.

After this PR: build-broker failure → publish-packages skipped → zero packages published, including policy, memory, utils, etc.

A better approach would be to use if: always() with explicit result checks, or to handle the SDK broker download as a soft dependency that only blocks the SDK matrix entry. For example:

publish-packages:
  needs: [build, build-broker]
  if: |
    always() &&
    github.event.inputs.package == 'all' &&
    needs.build.result == 'success'

Then the broker download step already has if: matrix.package == 'sdk' and would naturally fail only for the SDK entry if build-broker failed, while the other 9 packages would publish successfully.

Prompt for agents

In .github/workflows/publish.yml, the publish-packages job at line 431-435 needs to be changed so that a build-broker failure does not block publishing of non-SDK packages. Change the job definition to use always() in the if condition and explicitly check build.result:

publish-packages:
  name: Publish ${{ matrix.package }}
  needs: [build, build-broker]
  runs-on: ubuntu-latest
  if: |
    always() &&
    github.event.inputs.package == 'all' &&
    needs.build.result == 'success'

Then, update the 'Download broker binaries (SDK only)' step around line 469-475 to also check that build-broker succeeded, so the SDK matrix entry fails gracefully if broker builds failed:

      - name: Download broker binaries (SDK only)
        if: matrix.package == 'sdk' && needs.build-broker.result == 'success'

And add a step that fails the SDK entry if broker binaries are missing:

      - name: Verify broker binaries present (SDK only)
        if: matrix.package == 'sdk'
        run: |
          if [ ! -f packages/sdk/bin/agent-relay-broker-linux-x64 ]; then
            echo 'ERROR: Broker binaries not found. build-broker may have failed.'
            exit 1
          fi

---

Was this helpful? React with 👍 or 👎 to provide feedback.