[STG-1739] fix: browse-cli releases publish under alpha instead of latest

[shrey150]

Summary

• Root cause: The changesets/action step corrupts git state by checking out changeset-release/main and creating a new commit. After it returns, HEAD points to the wrong branch/commit. The browse-cli check step uses HEAD/HEAD^ which are now wrong, so it always says "browse-cli version did not change" and skips the publish. Then the stagehand canary step (changeset publish --tag alpha) finds the unpublished version and publishes it under alpha instead of latest.
• Fix: Replace all HEAD/HEAD^ references with ${{ github.sha }}/${{ github.sha }}^ (the actual merge commit SHA, immune to branch switches). Add git checkout ${{ github.sha }} to restore the working tree. Add explicit --tag latest to the publish command.
• New: Add a browse-cli canary step that publishes X.Y.Z-alpha-{sha} versions under the alpha tag on feature branch merges (matching stagehand's existing canary pattern).

What was happening

1. PR merged to main with browse-cli version bump (e.g. 0.3.0 -> 0.4.0)
2. changesets/action runs, switches to changeset-release/main, creates commit
3. HEAD now points to the changeset PR commit, not the merge commit
4. browse-cli check compares wrong commits, finds no version change, sets should_publish=false
5. Stagehand canary step runs changeset publish --tag alpha, which picks up the unpublished browse-cli and publishes it under alpha
6. Result: npm info @browserbasehq/browse-cli shows latest: 0.3.0, alpha: 0.4.0

What this PR does

1. Uses ${{ github.sha }} (the actual merge commit) instead of HEAD for all git comparisons
2. Adds git checkout ${{ github.sha }} to restore the working tree after changesets/action
3. Adds --tag latest to the npm publish command for clean releases
4. Adds a new "Publish browse-cli canary" step for feature branch merges (publishes X.Y.Z-alpha-{sha} under alpha tag)

Validation

• Traced CI logs from recent releases to confirm HEAD was pointing to changeset-release/main after the changesets step
• Confirmed npm view @browserbasehq/browse-cli shows latest: 0.3.0 while alpha: 0.4.1 (the bug in action)
• ${{ github.sha }} is set by GitHub Actions to the merge commit SHA and is immutable throughout the run

Linear

https://linear.app/browserbase/issue/STG-1739/fix-browse-cli-release-publishes-under-alpha-instead-of-latest

🤖 Generated with Claude Code

---

Summary by cubic

Fixes the release workflow so @browserbasehq/browse-cli clean releases publish to latest, and canaries publish to alpha. Addresses Linear STG-1739 by using the immutable merge SHA to avoid changesets/action HEAD switches.

• Bug Fixes

  • Use ${{ github.sha }}/${{ github.sha }}^ for diffs and version reads to avoid wrong HEAD.
  • Restore the working tree before checks/publish and reset packages/cli/package.json after canary publish.
  • Publish clean releases with npm publish ... --tag latest.

• New Features

  • Add canary step that publishes X.Y.Z-alpha-{shortSha} to alpha when CLI files changed but no clean release occurred.
  • Skip canary if the version already exists or no CLI changes are detected.

^{Written for commit c075ece. Summary will update on new commits. Review in cubic}

[changeset-bot]

⚠️ No Changeset found

Latest commit: c075ece

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cubic-dev-ai]

1 issue found across 1 file

Confidence score: 3/5

• There is a concrete risk that later steps in the same job see a dirty workspace because the canary step modifies package.json and never restores it in .github/workflows/release.yml.
• This is a medium-severity CI/release flow issue (7/10) with high confidence, so the change has some user-impacting risk even if it doesn’t affect runtime behavior.
• Pay close attention to .github/workflows/release.yml - ensure the canary step cleans up or restores package.json before subsequent steps.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/release.yml">

<violation number="1" location=".github/workflows/release.yml:132">
P1: The canary step updates `package.json` but never restores it, leaving the workspace dirty for later steps in the same job.</violation>
</file>

Architecture diagram

sequenceDiagram
    participant Runner as GitHub Actions Runner
    participant Git as Git (Local Repo)
    participant CSA as Changesets Action
    participant NPM as NPM Registry

    Note over Runner,NPM: Trigger: Merge to main branch

    Runner->>CSA: Run changesets/action
    CSA->>Git: CHANGED: Checkout changeset-release/main
    CSA-->>Runner: (Alters HEAD state)

    Runner->>Git: NEW: git checkout ${{ github.sha }}
    Note right of Git: Ensures HEAD points to the merge commit,<br/>ignoring Changeset's branch switch

    Runner->>Git: CHANGED: git diff ${{ github.sha }}^ ${{ github.sha }} (package.json)
    Git-->>Runner: Return diff result

    alt Version Bump Detected (Clean Release)
        Runner->>Runner: Extract OLD/NEW versions via git show ${{ github.sha }}
        Runner->>Runner: pnpm pack
        Runner->>NPM: CHANGED: npm publish --tag latest
        Runner->>Git: git tag & push tag
    else No Version Bump (Canary Path)
        Runner->>Git: NEW: git diff --quiet ${{ github.sha }}^ ${{ github.sha }} (packages/cli/)
        alt Files Changed
            Runner->>Runner: NEW: Generate X.Y.Z-alpha-{shortSha}
            Runner->>NPM: NEW: Check if version exists
            opt Version does not exist
                Runner->>Runner: NEW: Update package.json version
                Runner->>Runner: pnpm pack
                Runner->>NPM: NEW: npm publish --tag alpha
            end
        else No Changes
            Runner->>Runner: Skip canary
        end
    end

Loading

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}