feat(release): extend the release-due watcher + tarball pack-check to engine/miner/ui-kit

[JSONbored]

Closes #8591.

Summary

Only MCP had a "release due" tracking-issue safety net (mcp-release-watch.yml) and a published-tarball dry-run validator (test:mcp-pack) — engine, miner, and ui-kit had neither. If release-please ever silently stopped proposing a release PR for one of them, nothing would flag it, and their published npm tarballs were never checked for stray/forbidden/secret-like content.

• scripts/release-semver-utils.ts: pure semver/conventional-commit primitives extracted from mcp-release-core.ts so both MCP's bespoke watcher and the new generic one share one implementation instead of duplicating it. MCP's own public API is unchanged (same exports, same behavior — verified against its full existing test suite, 105 tests across 8 files, zero regressions).
• scripts/package-release-core.ts: the generic due-detection/issue-building core for engine/miner/ui-kit. Deliberately simpler than MCP's — none of the three have commits needing cross-cutting-path attribution the way MCP wraps app-side Worker logic, and all three already have release-please maintaining their CHANGELOG.md natively, so no bespoke changelog renderer is needed.
• scripts/check-package-release-due.ts: generic upsert/close CLI, parameterized by --package engine|miner|ui-kit, mirroring check-mcp-release-due.ts (including the MCP release due: 4.0.0 #6145 auto-close-once-caught-up fix).
• .github/workflows/package-release-watch.yml: one new job checking all three packages sequentially (not a matrix) — the shared Actions runner pool is org-wide, and Epic: consolidate the '-coverage' bolt-on test-file family #8574's investigation found extra concurrent scheduled-run runners a direct contributor to queue saturation, so this adds zero additional concurrent runner load.
• scripts/check-engine-package.ts / check-ui-kit-package.ts: npm-pack dry-run validators (test:engine-pack / test:ui-kit-pack, wired into test:ci and ci.yml). Pattern-based allowlists, not enumerated file lists like MCP/miner's small hand-curated ones — engine ships 358 files and ui-kit 152, mirroring their src/ trees 1:1, and will keep growing as the engine extraction continues.

Bonus fix: the new ui-kit pack-check immediately caught two real gaps — CHANGELOG.md existed on disk but was missing from package.json's files field (silently excluded from the published npm tarball), and ui-kit had no README.md at all. Both fixed.

Test plan

• npx vitest run test/unit/generate-mcp-changelog-script.test.ts test/unit/mcp-release.test.ts test/unit/mcp-release-candidate.test.ts test/unit/package-release.test.ts test/unit/check-engine-package.test.ts test/unit/check-ui-kit-package.test.ts test/unit/check-mcp-package.test.ts test/unit/check-miner-package.test.ts — 105/105 pass
• npm run typecheck / npm run actionlint — clean
• npm run test:engine-pack / npm run test:ui-kit-pack — pass against the real built packages (358 / 152 files)
• Ran check-package-release-due.ts --package {engine,miner,ui-kit} --json directly against real repo state to confirm end-to-end correctness

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	loopover-ui	730d805	Jul 24 2026, 11:41 PM

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.54%. Comparing base (626bc33) to head (3606ed7).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8592   +/-   ##
=======================================
  Coverage   92.54%   92.54%           
=======================================
  Files         796      796           
  Lines       79850    79850           
  Branches    24135    24135           
=======================================
  Hits        73899    73899           
  Misses       4802     4802           
  Partials     1149     1149           

Flag	Coverage Δ
backend	93.72% <ø> (ø)
control-plane	99.85% <ø> (ø)
rees	88.56% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

[codecov]

Bundle Report

Bundle size has no change ✅

[loopover-orb]

Warning

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-25 00:26:58 UTC}

14 files · 1 AI reviewer · no blockers · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review: This PR changes guardrail-protected path(s): .github/workflows/ci.yml (matched .github/workflows/**), .github/workflows/package-release-watch.yml (matched .github/workflows/**).

Review summary
This PR extracts MCP's semver/conventional-commit primitives into a shared release-semver-utils.ts, adds a generic package-release-core.ts + check-package-release-due.ts watcher for engine/miner/ui-kit, wires a new scheduled workflow, and adds npm-pack dry-run validators for engine/ui-kit mirroring the existing MCP/miner ones. The extraction from mcp-release-core.ts is a clean move-and-re-export (parseConventionalSubject, compareSemver, bumpVersion still re-exported for back-compat) with MCP's own 105-test suite cited as a regression guard. The isPackageReleaseRelevantCommit logic is deliberately simpler than MCP's cross-cutting-path variant and is well-tested against merge-commit exclusion, release/changelog-scope exclusion, and cross-package isolation.

Nits — 7 non-blocking

• scripts/check-package-release-due.ts:204 uses `any` for the GitHub API response payload; a minimal typed shape (or `unknown` + narrowing) would be safer than blanket `any`.
• scripts/check-engine-package.ts:56 and check-ui-kit-package.ts:57 hardcode `1024 * 1024 * 16` for maxBuffer; a named constant (as check-package-release-due.ts does with GITHUB_REQUEST_TIMEOUT_MS) would make the intent clearer.
• package-release-watch.yml's inline `node <<'NODE'` summary step duplicates structure across three packages; a small helper script would avoid the copy-pasted lines list, though this is minor for a 3-item loop.
• The PR description says 'Closes Extend the MCP-only 'release due' watcher to engine/miner/ui-kit #8591' but the brief flags issue coverage as only partial — worth confirming the issue's full scope (e.g. whether miner's pack-check was also required) is satisfied by this diff.
• Consider extracting the three near-identical check-engine-package.ts/check-ui-kit-package.ts/check-miner-package.ts pack-check scripts' common validate/run/load-from-npm scaffolding into a shared helper, similar to what was done for release-semver-utils.ts, to avoid drift as allowlists evolve.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ⚠️ Gate result — Not blocking (Advisory; not blocking this PR.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#8591
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 13 registered-repo PR(s), 13 merged, 277 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 13 PR(s), 277 issue(s).
Improvement	✅ Minor	risk: clean · value: minor

Linked issue satisfaction

Addressed
The PR adds test:engine-pack/test:ui-kit-pack scripts, extracts a shared per-package config (paths, tag prefix, checklist, script names) into package-release-core.ts while factoring semver/conventional-commit primitives into release-semver-utils.ts, adds a single sequential (non-matrix) package-release-watch.yml covering engine/miner/ui-kit, and includes regression tests mirroring the upsert/close

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 13 PR(s), 277 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Start here: Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review