Repository navigation
feat: automate CLI release distribution - #1904
Merged
Merged
Conversation
Contributor
🔒 Security Review🔒 Security review: 17 warning(s), 8 info.
Automated security review — informational only. |
Contributor
🔴 Impact Analysis — PR #1904Risk tier: 🔴 CRITICAL 📊 Summary
🎯 Risk Factors
📦 Modules Affectedci-workflows (7 files)
copilot-config (1 file)
docs (17 files)
root (3 files)
scripts (2 files)
squad-cli (3 files)
squad-sdk (2 files)
squad-state (2 files)
tests (5 files)
This report is generated automatically for every PR. See #733 for details. |
Contributor
|
Contributor
🛫 PR Readiness Check
PR Scope: 🔧 Infrastructure
|
| Status | Check | Details |
|---|---|---|
| ❌ | Single commit | 10 commits — consider squashing before review |
| ✅ | Not in draft | Ready for review |
| ✅ | Branch up to date | Up to date with dev |
| ❌ | Copilot review | No Copilot review yet — it may still be processing |
| ✅ | Changeset present | Changeset file found |
| ✅ | Scope clean | |
| ✅ | No merge conflicts | No merge conflicts |
| ✅ | Copilot threads resolved | 0 active Copilot thread(s) resolved (3 outdated skipped) |
| ✅ | CI passing | All checks passing |
Files Changed (42 files, +3540 −2445)
| File | +/− |
|---|---|
.changeset/automate-release-distribution.md |
+6 −0 |
.copilot/skills/release-process/SKILL.md |
+71 −503 |
.github/workflows/squad-ci.yml |
+35 −2 |
.github/workflows/squad-insider-publish.yml |
+67 −2 |
.github/workflows/squad-npm-publish.yml |
+191 −36 |
.github/workflows/squad-preview.yml |
+0 −59 |
.github/workflows/squad-promote.yml |
+102 −75 |
.github/workflows/squad-release.yml |
+132 −24 |
.github/workflows/squad-standalone-release.yml |
+591 −34 |
.squad/skills/release-process/SKILL.md |
+159 −152 |
.squad/skills/versioning-policy/SKILL.md |
+123 −119 |
README.md |
+35 −9 |
README.zh.md |
+29 −4 |
docs/_internal/release-checklist.md |
+80 −122 |
docs/src/content/docs/cookbook/recipes.md |
+4 −1 |
docs/src/content/docs/features/standalone-install.md |
+22 −23 |
docs/src/content/docs/features/vscode.md |
+4 −1 |
docs/src/content/docs/get-started/five-minute-start.md |
+7 −7 |
docs/src/content/docs/get-started/install-comprehensive.md |
+5 −204 |
docs/src/content/docs/get-started/installation.md |
+194 −81 |
docs/src/content/docs/get-started/migration.md |
+14 −14 |
docs/src/content/docs/guide.md |
+15 −8 |
docs/src/content/docs/guide/contributing.md |
+24 −18 |
docs/src/content/docs/guide/personal-squad.md |
+3 −1 |
docs/src/content/docs/insider-program.md |
+33 −8 |
docs/src/content/docs/reference/cli.md |
+9 −5 |
docs/src/content/docs/scenarios/production-troubleshooting.md |
+4 −3 |
docs/src/content/docs/scenarios/release-process.md |
+114 −282 |
docs/src/content/docs/scenarios/troubleshooting.md |
+23 −34 |
docs/src/content/docs/tour-first-session.md |
+3 −3 |
packages/squad-cli/README.md |
+52 −7 |
packages/squad-cli/templates/skills/release-process/SKILL.md |
+159 −152 |
packages/squad-cli/templates/skills/versioning-policy/SKILL.md |
+123 −119 |
packages/squad-sdk/templates/skills/release-process/SKILL.md |
+159 −152 |
packages/squad-sdk/templates/skills/versioning-policy/SKILL.md |
+123 −119 |
scripts/generate-packaging.mjs |
+69 −18 |
scripts/install.sh |
+31 −16 |
test/cli/watch-capabilities.test.ts |
+22 −1 |
test/packaging-manifests.test.ts |
+40 −0 |
test/publish-policy.test.ts |
+18 −11 |
test/standalone-build.test.ts |
+9 −0 |
test/standalone-release-workflow.test.ts |
+636 −16 |
Total: +3540 −2445
This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.
Contributor
🏗️ Architectural Review
Automated architectural review — informational only. |
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Collaborator
Author
|
CI note: the release/package-manager checks and all targeted tests pass. The full Both tests create a same-day retrospective and expect |
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
It significantly restructures release/publish GitHub Actions workflows and distribution channels, so a human maintainer should validate the end-to-end release behavior despite only minor doc issues found.
Review tier: Lite
Findings: 3
New issues introduced by this change (3)
| Severity | Finding |
|---|---|
 |
docs/src/content/docs/features/standalone-install.md — The packaging section hard-codes the generated Homebrew filename as… |
|
docs/src/content/docs/features/standalone-install.md — This section says Homebrew/WinGet publication runs only for stable releases, but the standalone… |
|
docs/src/content/docs/scenarios/troubleshooting.md — The Installation guide link target omits the .md extension (../get-started/installation).… |
What changed in this PR
This PR implements an automated, multi-channel distribution pipeline for the Squad CLI: insider and preview releases from dev, plus stable releases promoted to main, with artifacts published via npm and as standalone GitHub Release assets, and with Homebrew/WinGet packaging support. It also updates user-facing docs to stop recommending npx as the primary way to run Squad and to document the new installation/update options.
Changes:
- Hardened standalone installer checksum verification and expanded standalone/release packaging tests.
- Added release-channel-aware packaging manifest generation (Homebrew casks + WinGet identifiers) for stable/preview/insider versions.
- Reworked GitHub Actions release workflows to support preview/insider/stable automation and updated documentation/runbooks accordingly.
| File | Description |
|---|---|
| test/standalone-build.test.ts | Adds assertions for stricter checksum/download/ordering behavior in install.sh. |
| test/publish-policy.test.ts | Improves the publish-policy lint matching logic and expands good/bad/ignored cases. |
| test/packaging-manifests.test.ts | Adds tests for channel-specific Homebrew/WinGet outputs and new channel metadata helpers. |
| test/cli/watch-capabilities.test.ts | Stabilizes RetroCapability time-based behavior with fake timers and adds a Friday-afternoon regression test. |
| scripts/install.sh | Makes checksum verification mandatory and fails fast on malformed/missing checksums. |
| scripts/generate-packaging.mjs | Introduces stable/preview/insider channel mapping and generates channel-specific Homebrew/WinGet manifests + filenames. |
| README.zh.md | Documents new install/update options (npm/Homebrew/WinGet/script/archive) and removes npx guidance. |
| README.md | Documents new install/update options and switches watch examples from npx to squad. |
| packages/squad-sdk/templates/skills/versioning-policy/SKILL.md | Updates versioning policy to cover stable/preview/insider/local builds and prerelease dependency floors. |
| packages/squad-sdk/templates/skills/release-process/SKILL.md | Rewrites release runbook for automated insider/preview/stable channels and dev→main promotion. |
| packages/squad-cli/templates/skills/versioning-policy/SKILL.md | Same versioning-policy updates for CLI templates. |
| packages/squad-cli/templates/skills/release-process/SKILL.md | Same release-process updates for CLI templates. |
| packages/squad-cli/README.md | Updates prerequisites and adds non-npm installation paths (Homebrew/WinGet/install script). |
| docs/src/content/docs/tour-first-session.md | Removes direct npm install instructions in favor of the installation guide. |
| docs/src/content/docs/scenarios/troubleshooting.md | Updates troubleshooting to reference the installation guide and removes legacy npx github: guidance. |
| docs/src/content/docs/scenarios/release-process.md | Replaces three-branch model docs with automated channel workflows and recovery guidance. |
| docs/src/content/docs/scenarios/production-troubleshooting.md | Updates container entrypoint guidance to use squad instead of npx @bradygaster/squad-cli. |
| docs/src/content/docs/reference/cli.md | Expands installation section to include Homebrew/WinGet and points to the installation guide. |
| docs/src/content/docs/insider-program.md | Updates insider program to include GitHub prereleases + Homebrew/WinGet distribution. |
| docs/src/content/docs/guide/personal-squad.md | Updates portability guidance to reflect non-npm install methods. |
| docs/src/content/docs/guide/contributing.md | Updates Node.js requirements and explains changesets vs release-version lockstep. |
| docs/src/content/docs/guide.md | Updates requirements/install/upgrade guidance to reflect standalone and package-manager options. |
| docs/src/content/docs/get-started/migration.md | Updates migration prereqs and CI snippet to Node 22 and removes npx-based guidance. |
| docs/src/content/docs/get-started/installation.md | Major rewrite to document all install/update methods and shared .squad/ state behavior. |
| docs/src/content/docs/get-started/install-comprehensive.md | Collapses duplicated install docs into a single pointer to the canonical installation guide. |
| docs/src/content/docs/get-started/five-minute-start.md | Updates quickstart to assume squad command is installed (no npx). |
| docs/src/content/docs/features/vscode.md | Clarifies Node.js is only required for npm installs and links to the installation guide. |
| docs/src/content/docs/features/standalone-install.md | Updates install script URL to main, documents packaging generation, and CI usage for bundles. |
| docs/src/content/docs/cookbook/recipes.md | Updates release-process recipe to match the new dev→main promotion model. |
| docs/_internal/release-checklist.md | Updates internal checklist for automated insider/preview/stable workflows and recovery steps. |
| .squad/skills/versioning-policy/SKILL.md | Updates canonical versioning policy to include preview/insider channels and dependency-floor rules. |
| .squad/skills/release-process/SKILL.md | Updates canonical release runbook to match automated channels and new recovery commands. |
| .github/workflows/squad-release.yml | Adds channel-aware validation, creates prerelease vs latest appropriately, and invokes npm + standalone publication workflows. |
| .github/workflows/squad-promote.yml | Replaces dev→preview→main promotion with a sanitized dev→main promotion that explicitly dispatches the stable release. |
| .github/workflows/squad-preview.yml | Removes the preview-branch validation workflow (preview is now a channel, not a branch). |
| .github/workflows/squad-npm-publish.yml | Adds workflow_call inputs, validates versions/channels, makes publication idempotent, and enforces workspace prerelease dependency rules. |
| .github/workflows/squad-insider-publish.yml | Captures source SHA, creates an immutable insider prerelease, and invokes standalone packaging publication. |
| .github/workflows/squad-ci.yml | Updates CI branch targeting (dev/main) and strengthens version/dependency-floor checks and publish-policy detection. |
| .copilot/skills/release-process/SKILL.md | Slims Copilot-facing release guidance to point at the canonical runbook and new channel model. |
| .changeset/automate-release-distribution.md | Adds a patch changeset for CLI+SDK to reflect release automation and guidance changes. |
Suppressed comments (1)
docs/src/content/docs/scenarios/troubleshooting.md:29
- The inline Installation guide link target omits the
.mdextension (../get-started/installation). For consistency with other docs links (and to avoid a likely broken relative link), this should point toinstallation.md.
**Fix:** Install Squad through npm, Homebrew, WinGet, the verified install
script, or a release archive, then run `squad init`. See the
[Installation guide](../get-started/installation).
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
bradygaster
approved these changes
Aug 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
dev, plus stable releases promoted directly tomain.npxas a recommended Squad CLI usage option from current user-facing docs.Release behavior
devinsider: manualX.Y.Z-insider.Nsnapshot to GitHub prerelease, npminsider, standalone archives, Homebrewsquad-insider, and WinGetbradygaster.Squad.Insider.devpreview: manualX.Y.Z-preview.Nrelease to GitHub prerelease, npmpreview, standalone archives, Homebrewsquad-preview, and WinGetbradygaster.Squad.Preview.mainstable: promotedX.Y.Zrelease to GitHub latest, npmlatest, standalone archives, Homebrewsquad, and WinGetbradygaster.Squad.Validation
npm exec -- vitest run test/packaging-manifests.test.ts test/standalone-build.test.ts test/standalone-release-workflow.test.ts test/publish-policy.test.tsnpm run lint:docsgo run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/squad-insider-publish.yml .github/workflows/squad-standalone-release.ymlSKIP_BUILD_BUMP=1 npm run buildwinget validateaccepted the insider manifest set.Closes #1593