SDK package identity, stable release, and artifact contracts - #883
Conversation
Deliver a broad package-platform tranche across the SDK, CLI, release automation, and published artifact boundary. Namespace the bundled VCS exemplar with legacy compatibility, preserve managed install aliases for package introspection, reject unstable same-day ordinal releases, document stable peer ranges, and enforce deterministic source-map-free package budgets with repeated-build chunk cleanup. Close pm-6z0wzf, pm-csuce0, and pm-998juj with linked tests, generated changelog entries, 100% repository coverage, packed npx smoke, and package-first dogfood evidence.
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
@greptileai review this broad SDK/package-platform tranche. Please focus on package namespace compatibility, managed alias provenance, SemVer stable-range behavior, and deterministic artifact cleanup/gating.\n\n@coderabbitai full review |
|
Warning Review limit reached
Next review available in: 33 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository UI (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (35)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 59 minutes. |
|
@greptileai please re-review exact head 98448a7 after the PM evidence follow-up.\n\n@coderabbitai full review |
Reviewer's GuideStrengthens package/extension identity and release rigor by plumbing install aliases into extension describe, namespacing the bundled VCS SDK exemplar while preserving internal compatibility, tightening calendar-based release rules to forbid new ordinals, and introducing a fail-closed npm artifact budget gate wired into CI and release workflows, alongside pruning unused deps and sourcemaps. Flow diagram for extension install aliases into describe resolutionflowchart LR
A[.managed-extensions.json<br/>entries: directory,name,source.input,source.name,source.package]
B[readManagedExtensionSourcePackages<br/>→ Map<string,ManagedExtensionSourceIdentity>]
C[scanExtensionDirectory<br/>uses managedSourcePackages]
D[EffectiveExtension<br/>source_package<br/>source_aliases]
E[buildExtensionDescribeResult<br/>matches target<br/>against name, source_package,<br/>source_aliases]
A --> B
B --> C
C --> D
D --> E
Flow diagram for calendar-based release-version policyflowchart TD
A[release-version.mjs
runCheck] --> B[parse package.json version
via parseVersion]
B --> C[compute expectedDate
from --date or today]
C --> D[parsedVersion.ordinal !== null?]
D -- yes --> E[fail:
historical ordinal;
new releases must use
stable YYYY.M.D]
D -- no --> F[nextVersionForDate]
F --> G[tags exist for expectedDate?]
G -- no --> H[ok: expected version
is expectedDate]
G -- yes --> I[fail:
release already exists
for date;
no new ordinals]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
I will focus on the PM evidence follow-up and the specified package, alias, SemVer, cleanup, and artifact-gate contracts. ✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 59 minutes. |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Keep install-source alias resolution within the strict complexity gate while preserving malformed-state handling and SDK identity behavior. Record the hosted CI finding and focused verification on pm-6z0wzf.
|
Exact-head follow-up c0f92b7 resolves the hosted complexity finding without weakening the gate; repo-wide ESLint and all linked extension/VCS tests pass. @greptileai please review the full updated PR. |
|
✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 48 minutes. |
Regenerate the canonical changelog with pm-changelog 2026.8.3 after recording the exact-head CI resolution on pm-6z0wzf.
|
Exact-head bcc9b16 now includes the deterministic pm-changelog 2026.8.3 regeneration after final PM close evidence; local changelog check is idempotent. @greptileai please review the full updated PR. |
|
I will review the changelog regeneration and the package namespace, managed alias, SemVer stable-range, artifact cleanup, and artifact-gate contracts. ✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 42 minutes. |
Accumulate missing runtime paths declaratively so the artifact gate passes both ESLint and CodeFactor-parity analysis without suppressions or threshold changes. Record exact hosted and local evidence on pm-998juj.
|
Exact-head 56755a3 resolves the remaining CodeFactor-parity complexity finding without suppressions or threshold changes. Local strict static-quality reports zero violations; artifact/workflow tests pass 19/19 and npm pack remains 1,308 files with zero maps. @greptileai please review the full updated PR. |
|
I will verify the complexity change, package namespace compatibility, managed alias provenance, stable SemVer behavior, deterministic artifact cleanup, and artifact gating. ✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 33 minutes. |
|
Gemini Code Assist sunset notice acknowledged (source). No review was available from this provider; exact-head security, static, coverage, platform, and hosted-analysis checks are green. |
|
CodeRabbit responses individually acknowledged: initial limit notice, initial request, 98448a779, c0f92b72d, bcc9b1679, and 56755a3a4. Every attempt ended at the provider fair-usage limit and produced no actionable finding. The exact head is independently green across all mandatory checks. |
|
Sourcery outputs acknowledged: the reviewer guide accurately captured the alias, stable-release, and artifact flows and was useful; the formal review was rate-limited before findings. Exact-head Sourcery check status and all mandatory repository gates are green. |
|
CodSpeed report acknowledged (source): all 11 tracked benchmarks are unchanged, and the exact-head benchmark job passed. |
|
Codecov report acknowledged (source): every modified coverable line is covered, all four shards passed, and aggregate coverage remains 100/100/100/100. |
|
Final review inventory at exact head 56755a3: zero review threads and zero unresolved findings; every bot comment/review is reacted to and acknowledged. CodeRabbit and Sourcery exhausted provider limits without findings, Gemini is sunset, and Greptile returned no response despite repeated exact-head requests and waiting beyond 25 minutes. All mandatory and external checks are green. |
1 participant
Summary
This broad package-platform tranche strengthens the universal PM SDK/CLI extension baseline across three linked concerns:
vcs-exemplarwhile preserving internal-tiervcscompatibility, and carries managed install aliases into loaded-extension context sopm package describe <install-alias>remains deterministic;typebox, excludes source maps from npm, prunes obsolete hashed chunks after locked rebuilds, and enforces fail-closed artifact size/file/path budgets in CI and release workflows.PM lineage
Verification
.mapfilesnpxsmoke across 15 packagesRelease policy
v2026.8.3is already the immutable automatic release for 2026-08-03. This change intentionally prevents a second same-day automatic release; publication verification will therefore prove the existing tag remains singular rather than moving or duplicating it.Summary by Sourcery
Enforce stable calendar-based release policy, tighten npm artifact composition and size budgets, and clarify SDK VCS exemplar naming and command namespaces while improving extension alias resolution.
New Features:
vcs-exemplarcommand namespace with legacyvcsaliases for the bundled VCS SDK exemplar.Bug Fixes:
Enhancements:
@unbrained/pm-cliin SDK docs and scaffolded extension READMEs.Build:
npm pack --dry-runcalls.CI:
Documentation:
vcs-exemplarnamespace, stable peer policy, and artifact budget gate.Tests:
Chores:
typeboxpeer dependency from the root package configuration and update internal PM tracking artifacts.Summary by cubic
Namespaces the bundled VCS SDK exemplar and enforces stable release and packaging contracts for small, map‑free npm artifacts. Also syncs the changelog and keeps the artifact validator under strict complexity gates.
New Features
@unbrained/pm-vcs-sdk-exemplar; commands now undervcs-exemplar; legacyvcskept for local compatibility (closes A bundled exemplar package occupies a public package name and command namespace, with no way for either to detect the collision #832).pm extension describe/SDK can target by alias or source package; parsing is simplified with strict guards for malformed state.YYYY.M.D-N) are rejected; docs and scaffolds guide peers to use normal ranges like>=<pm_min_version>(addresses npm latest points to prerelease that fails stable peer ranges #681).scripts/release/package-artifact-gate.mjs+ budget JSON enforce max size/file count, forbid.map, and require key files; wired into CI/release; validator stays under strict complexity via declarative required‑paths;package.jsonexcludes source maps; stale hashed chunks are pruned on rebuild; removed unusedtypebox.Migration
vcs-exemplarin new scripts/docs; localvcsstill works.peerDependencies["@unbrained/pm-cli"]as a stable range (e.g.,>=<pm_min_version>); do not pin historical ordinals.Written for commit 56755a3. Summary will update on new commits.