chore(release): public launch hardening for @unbrained/pm-cli#1
Conversation
Switch the package to scoped publishing with calendar-based SemVer-compatible versioning and add release guardrails for secret scanning, npx smoke checks, and tag/version enforcement. This hardens CI/CD and contributor release docs so today’s public npm release is reproducible and safe.
ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Free Run ID: 📒 Files selected for processing (24)
Summary by CodeRabbitRelease Notes
WalkthroughThis pull request prepares version 2026.3.9 for public release by rebranding the package from pm-cli to Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as Developer
participant Git as Git / Tag
participant GH as GitHub Actions
participant NPM as npm Registry
participant GHR as GitHub Releases
Dev->>Dev: pnpm version:check
activate Dev
Note over Dev: Validate tag & version policy
deactivate Dev
Dev->>Dev: pnpm security:scan
activate Dev
Note over Dev: Scan for credential leaks
deactivate Dev
Dev->>Dev: pnpm smoke:npx
activate Dev
Note over Dev: Test npx tarball locally
deactivate Dev
Dev->>Git: Commit & tag (v2026.3.9)
Git->>GH: Trigger release workflow
GH->>GH: Verify version tag & policy
GH->>GH: Run security scan
GH->>GH: Test npx smoke
GH->>NPM: npm publish `@unbrained/pm-cli`
NPM-->>GH: Success
GH->>GHR: Create GitHub release w/ notes
GHR-->>GH: Release published
GH-->>Dev: Workflow complete
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Tip Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs). Note 🎁 Summarized by CodeRabbit FreeYour organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly hardens the release process for the Highlights
Changelog
Ignored Files
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request implements significant release hardening and prepares the project for a public production launch. Key changes include switching the npm package name from pm-cli to @unbrained/pm-cli and updating the versioning scheme to a calendar-based SemVer (YYYY.M.D or YYYY.M.D-N). New scripts were added to enforce this version policy (release-version.mjs), scan for credential leaks (check-secrets.mjs), and perform npx smoke tests (smoke-npx-from-pack.mjs). The CI/CD workflows, particularly the release pipeline, have been updated to integrate these new checks, enforce the version policy, use a dedicated GitHub release environment, and automate GitHub Release creation. Documentation, including CHANGELOG.md, README.md, CONTRIBUTING.md, AGENTS.md, and PRD.md, has been updated to reflect the new package name, versioning policy, and release procedures. Installer scripts (install.sh, install.ps1) now default to the scoped package. Additionally, a new chore (pm-1h88) was created to track the final public release execution, and a previous chore (pm-1hm2) detailing the release hardening tasks was marked as closed, indicating the completion of these preparatory steps.
1 participant
Summary
@unbrained/pm-cliwith calendar SemVer-compatible versioning (YYYY.M.D[-N])version:check,security:scan, packagednpxsmoke) plus release workflow tag/sequence enforcement and GitHub release automationTest plan
node scripts/release-version.mjs check --tag v2026.3.9 --verify-nextpnpm security:scanpnpm buildpnpm typecheckpnpm testnode scripts/run-tests.mjs coveragepnpm smoke:npx