Sync all six SDK-version lockfiles on bump; record the upload-versions canary - #698
Conversation
…ght agree bump-version.sh synced four of the six lockfiles that record the SDK's own version through a path dependency. The conformance Ruby and Python runner lockfiles were missed, and both are gitignored — so on any machine that had run conformance at the old version, the first post-bump make check re-resolved them mid-check and assert-lockfiles-unchanged correctly failed (#671). Sync both in the bump, mirroring the conformance TypeScript step, and extend make release's preflight to assert them too — guarded on existence, since a fresh clone legitimately lacks them. The preflight and make check now agree on what "in sync" means. Closes #671
Ran 2026-08-11 against production (account 2914079, Coworker QA Sandbox vault) via a throwaway Go program built on this repo's go/ module. Every deferred assertion from the #683 plan passed: stable id/URL across CreateVersion, typed ListVersions decode with exactly one Current entry, byte-compared downloads of both the original and the replacement, and description carry-forward.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
There was a problem hiding this comment.
Pull request overview
Synchronizes all six SDK-version lockfiles during version bumps, strengthens release preflight checks, and records the completed upload-version production canary.
Changes:
- Syncs Ruby and Python conformance lockfiles during version bumps.
- Validates existing conformance lockfiles before release.
- Documents the successful upload-version canary.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
scripts/bump-version.sh |
Synchronizes all six version-bearing lockfiles. |
Makefile |
Adds release preflight checks for conformance lockfiles. |
spec/api-gaps/upload-new-version.md |
Records successful production canary results. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
Merging on green CI + Copilot's clean review (3/3 files, no comments). Codex could not review this PR — its connector reports the account's code-review usage limit is reached — so the usual Codex verdict is absent for quota reasons, not because it found nothing. The change was also verified locally: both new sync steps run clean at 0.13.0, the new preflight checks pass at the current version, and the Ruby lockfile grep exits 1 against a wrong version. |
make bump VERSION=0.14.0 — the first run of the #698-fixed script, syncing all six SDK-version lockfiles — plus the hand edits the bump does not make: MIGRATING's Unreleased section becomes v0.14.0, and the seven README upgrade banners now describe this release's break profile (the ListUploadVersions retype, caught by the four typed SDKs' compilers and silent in Ruby/Python, and the 507 limit_exceeded reroute, silent everywhere a default arm exists).
* Bump version to 0.14.0 make bump VERSION=0.14.0 — the first run of the #698-fixed script, syncing all six SDK-version lockfiles — plus the hand edits the bump does not make: MIGRATING's Unreleased section becomes v0.14.0, and the seven README upgrade banners now describe this release's break profile (the ListUploadVersions retype, caught by the four typed SDKs' compilers and silent in Ruby/Python, and the 507 limit_exceeded reroute, silent everywhere a default arm exists). * Name the symbols consumers actually type, and keep the libc selectors Review fixes from #700: the four retype banners now name the generated methods as they exist (listVersions / list_versions, not the operation id), Python's enum members as they are spelled (ErrorCode.API, ErrorCode .LIMIT_EXCEEDED), and Kotlin's and Swift's prior error variants by their real names (BasecampException.Api, case api). The TypeScript lockfile is restored to the pre-bump entries with only the two version fields advanced. The bump's re-lock stripped the libc selectors from all eight @oxlint Linux bindings — with os/cpu otherwise identical, npm ci could install both the glibc and musl variants. Regenerating with the release workflow's npm (11.16, via npx) reproduces the strip byte-for-byte, and the registry still serves the libc metadata, so this is an npm re-lock behavior rather than a toolchain-version skew; the surgical restore is the deterministic fix.
Pre-release housekeeping ahead of v0.14.0.
Fix #671 — bump syncs 4 lockfiles, 6 record the SDK version
Six lockfiles record the SDK's own version through a path dependency;
bump-version.shsynced four. The two missed ones — the conformance Ruby andPython runner lockfiles — are gitignored, so on any machine that had run
conformance at the old version the first post-bump
make checkre-resolvedthem mid-check and
assert-lockfiles-unchangedcorrectly failed.bump-version.shnow syncs both, mirroring the conformance TypeScript step:bundle install --quietinconformance/runner/ruby(the same writeconformance-runner-tests-rubyperforms) anduv lock --quietinconformance/runner/python(the lockfile-only subset of the target'suv sync)make release's preflight asserts both — guarded on file existence, since afresh clone legitimately lacks them; a machine that has run conformance is
exactly the machine where a stale one breaks
make checkVerified: both syncs run clean at 0.13.0; the Ruby grep and
uv lock --checkpass at the current version and the grep exits 1 against a wrong version;
make -n releaserenders the new guards as intended.Not included: #670 (make the conformance installs non-writing) — separate
concern, this PR only closes the bump/preflight gap.
Closes #671
Record the #683 live canary as done
The upload-versions absorption deferred one verification: a live-account
end-to-end canary. It ran today against production (account 2914079, Coworker
QA Sandbox vault) via a throwaway Go program with a
replacedirective on thisrepo's
go/module, and every assertion passed:CreateVersionkept the upload's id and URL; filename/byte_size/content_typereflect the replacement
ListVersionsdecoded as typed[]UploadVersion; exactly oneCurrententry; newest action
blob_changeddownload_urlserved theoriginal bytes,
Downloadserved the replacement'snildescription carried the create-time description forwardspec/api-gaps/upload-new-version.mdnow records this as an as-of fact,leaving only basecamp-cli#404's write command open there.
Summary by cubic
Syncs all six SDK-version lockfiles on version bump and aligns preflight checks so stale conformance runner locks no longer break
make check. Also records the upload-versions live canary as completed. Closes #671.scripts/bump-version.shto also sync conformance runner lockfiles: Ruby viabundle install --quiet, Python viauv lock --quiet.make releasepreflight to assert those lockfiles are in sync, guarded on file existence for fresh clones.Written for commit 4e7eac9. Summary will update on new commits.