Skip to content

v2026.6.5 — Release-pipeline hardening

Choose a tag to compare

View all tags
@jmagly jmagly released this 21 Jun 21:56
· 789 commits to main since this release
v2026.6.5
8b6aae5
This commit was signed with the committer’s verified signature.
jmagly Joseph Magly
GPG key ID: 0117DAAA677A5BF2
Verified
Learn about vigilant mode.

AIWG 2026.6.5 — "Release-pipeline hardening"

Released: 2026-06-21
Channel: stable (npm install -g aiwg)

A maintenance cut that closes two release-pipeline gaps surfaced while cutting
2026.6.4. No API or CLI surface changes.

Highlights

What changed Why you care
cut-tag.sh gates package-lock.json A stale lockfile is caught before the tag is pushed, instead of failing CI and stranding the npm publish afterward.
GitHub mirror creates Release pages again Stable tags get their GitHub Release auto-created; the mirror had been silently skipping it since v2026.6.2.

Fixes

cut-tag.sh now verifies package-lock.json lockstep

Cutting 2026.6.4 bumped package.json, .claude-plugin/marketplace.json, and
apps/cockpit/package.json — but not package-lock.json. CI's check:versions
/ npm ci reject a lockfile whose version drifts from package.json, so the
build gate failed after the tag was already pushed and the npm publish never
ran. The wrapper's lockstep checks didn't cover the lockfile.

tools/release/cut-tag.sh now runs a package-lock.json lockstep check (new
pre-tag step 5/12) so a stale lockfile fails fast, locally, before tagging:

FAIL: package-lock.json version is '2026.6.4', expected '2026.6.5'.
       Run: npm install --package-lock-only
       (then commit package-lock.json) so CI's check:versions / npm ci pass.

GitHub mirror creates Release pages again

github-mirror.yml checked secrets.GH_TOKEN, but the configured Gitea Actions
secret is named GH_ACCESS_TOKEN. The mismatch meant the "Check token
availability" step always saw an empty value and skipped the GitHub tag push +
Release creation — while still reporting the job as successful (the graceful
fork-mode path). As a result, v2026.6.2, v2026.6.3, and v2026.6.4 never got an
auto-created GitHub Release.

The workflow now reads GH_ACCESS_TOKEN (the GH_TOKEN env var that gh and
the push URL consume is unchanged), so stable tags get their GitHub Release
created automatically. This release is the validation that the path works
end-to-end.

Upgrade

npm install -g aiwg     # 2026.6.5
aiwg version            # → 2026.6.5 [stable]

No action required. Maintenance release.

Links

Assets 2
Loading