Repository navigation
fix(gh-aw): install latest stable Squad CLI by default - #2167
Conversation
Delegate activation release selection to the SHA-pinned squad-init action and retire obsolete CLI pin automation. Regenerate package consumers and integrity digests; cover source and strict-compiled contracts. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
🏗️ Architectural Review
Automated architectural review — informational only. |
🟠 Impact Analysis — PR #2167Risk tier: 🟠 HIGH 📊 Summary
🎯 Risk Factors
📦 Modules Affectedci-workflows (3 files)
copilot-config (1 file)
docs (1 file)
root (6 files)
scripts (1 file)
tests (6 files)
This report is generated automatically for every PR. See #733 for details. |
🛫 PR Readiness Check
PR Scope: 🔧 Infrastructure
|
| Status | Check | Details |
|---|---|---|
| ❌ | Single commit | 6 commits — consider squashing before review |
| ✅ | Not in draft | Ready for review |
| ✅ | Branch up to date | Up to date with dev |
| ❌ | Copilot review | No Copilot review yet — it may still be processing |
| ✅ | Changeset present | No source files changed — changeset not required |
| ✅ | Scope clean | No .squad/ or docs/proposals/ files |
| ✅ | No merge conflicts | No merge conflicts |
| ✅ | Copilot threads resolved | 4 active Copilot thread(s) resolved (1 outdated skipped) |
| ❌ | CI passing | 4 check(s) failing: test, docs-quality, samples-build, gh-aw strict compile |
Files Changed (18 files, +417 −880)
| File | +/− |
|---|---|
.copilot/skills/release-process/SKILL.md |
+2 −2 |
.github/workflows/squad-cli-pin-drift.yml |
+0 −163 |
.github/workflows/squad-npm-publish.yml |
+0 −112 |
.github/workflows/squad-release.yml |
+51 −1 |
docs/src/content/docs/guide/gh-aw.md |
+14 −9 |
scripts/bump-activation-pin.mjs |
+0 −175 |
test/fixtures/squad-init-approved.json |
+16 −0 |
test/gh-aw-quality.test.ts |
+25 −22 |
test/helpers/refresh-squad-init-fixture.mjs |
+31 −0 |
test/squad-cli-latest.test.ts |
+219 −0 |
test/squad-cli-pin.test.ts |
+0 −269 |
test/standalone-release-workflow.test.ts |
+33 −14 |
workflows/package/squad-deps-worker.md |
+2 −19 |
workflows/package/squad-implement-worker.md |
+2 −19 |
workflows/package/squad-retro.md |
+2 −19 |
workflows/package/squad.md |
+2 −19 |
workflows/shared/squad.md |
+5 −24 |
workflows/squad-workflows.manifest.json |
+13 −13 |
Total: +417 −880
This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.
There was a problem hiding this comment.
🟡 Changes recommended
The pinned action lacks the claimed mandatory checksum behavior, release ordering exposes incomplete latest releases, and a stale assertion breaks the full test suite.
5 open findings
What changed in this PR
Updates gh-aw activation to install the latest stable Squad CLI release by default.
Changes:
- Removes the workflow-level CLI pin and related automation.
- Regenerates workflow packages and integrity hashes.
- Updates tests, documentation, and release guidance.
| File | Description |
|---|---|
workflows/squad-workflows.manifest.json |
Updates generated integrity hashes. |
workflows/shared/squad.md |
Delegates CLI selection to the pinned action. |
workflows/package/squad.md |
Regenerates the main workflow package. |
workflows/package/squad-retro.md |
Regenerates the retrospective workflow. |
workflows/package/squad-implement-worker.md |
Regenerates the implementation worker. |
workflows/package/squad-deps-worker.md |
Regenerates the dependency worker. |
test/standalone-release-workflow.test.ts |
Removes publication pin-job assertions. |
test/squad-cli-pin.test.ts |
Deletes obsolete pin tests. |
test/squad-cli-latest.test.ts |
Adds latest-release contract tests. |
test/gh-aw-quality.test.ts |
Updates compiled workflow assertions. |
scripts/bump-activation-pin.mjs |
Deletes obsolete pin updater. |
docs/src/content/docs/guide/gh-aw.md |
Documents latest-release activation. |
.github/workflows/squad-npm-publish.yml |
Removes activation-pin publication job. |
.github/workflows/squad-cli-pin-drift.yml |
Removes scheduled pin drift detection. |
.copilot/skills/release-process/SKILL.md |
Updates release-process guidance. |
🧠 Review effort: Balanced
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Closes #2167 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
Test-only correction pushed at 2385cf7.
Local validation: health contract assertions and independent digest/pin checks passed; The user explicitly authorized this test-only push for hosted CI with that blocker documented. This is not a merge/release waiver or a claim that new-head CI has passed. Please use the fresh checks and review on this head before merging/integrating it into the 1.0.1 candidate. |
Pin the npm-free activation action to the maintainer-approved immutable release revision. Exercise the exact pinned action and installer offline, fail closed on checksum download and tampering, and regenerate canonical workflow contracts without weakening existing compiler-pin checks. Closes #2167 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Installer-pin correction pushed for fresh hosted CIRevision: Actual activation path corrected: shared activation and its four generated package copies now use the maintainer-approved immutable official action revision The hermetic regression executes the pinned action's actual install step and installer, not the current checkout's installer. Valid checksum installation succeeds. Checksum-download failure, missing entry, duplicate entries, malformed digest, and checksum mismatch fail before extraction and preserve the existing CLI installation. Fixture bytes are bound to the actual activation pin with checked SHA-256/Git blob identities; refresh is an explicit maintenance command, not a network-per-test dependency. Existing compiler-pin tamper checks remain intact. Validation:
Local full-build blocker (not waived as a success): The user explicitly selected “Push the correction for hosted CI, documenting the local blocker (Recommended)” for this source-pin/regression revision. This authorizes this push only, not merge or publication. Require fresh hosted CI on |
Run the approved install step in its declared Bash shell rather than Ubuntu generic sh, enforce POSIX Bash selection, and report premature subprocess status and stderr before reading the download trace. Preserve the approved installer fixture and every checksum-negative assertion. Closes #2167 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Surgical Bash-harness correction: fresh CI requiredPushed Verified cause: the approved fixture install step declares The fix follows existing Bash-selection prior art: use the fixture's declared Bash on POSIX and Git-for-Windows Bash on Windows, with Bounded validation without installing/restoring dependencies:
The approved official action pin The previously disclosed local full-build dependency/CFS blocker ( |
Integrate only the approved technical changes from 90c5396, 2385cf7, 0e881f7 and 50e4b3a into the existing main-based 1.0.1 candidate for github#2166, without merging dev history. Resolve canonical conflicts surgically and regenerate package workflows, manifest and compiler-tamper fixtures from the combined main tree. Preserve the github#2165 health fix, root/SDK/CLI 1.0.1 lockstep and SDK floor. SDK runtime, NuGet and historical changesets remain untouched. Build and targeted contracts passed; current-head hosted CI and human review remain required before merge/publication. Closes github#2167 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(cli): accept persistent names in health routes (#2165) Co-authored-by: brady gaster <bradygaster@github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> (cherry picked from commit d2364df) * chore(release): prepare surgical npm v1.0.1 patch Closes #2165. Consume only its approved CLI health patch changeset; preserve historical main fragments and unchanged SDK/NuGet source. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(release): include approved latest-stable activation correction Integrate only the approved technical changes from 90c5396, 2385cf7, 0e881f7 and 50e4b3a into the existing main-based 1.0.1 candidate for #2166, without merging dev history. Resolve canonical conflicts surgically and regenerate package workflows, manifest and compiler-tamper fixtures from the combined main tree. Preserve the #2165 health fix, root/SDK/CLI 1.0.1 lockstep and SDK floor. SDK runtime, NuGet and historical changesets remain untouched. Build and targeted contracts passed; current-head hosted CI and human review remain required before merge/publication. Closes #2167 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: brady gaster <bradygaster@github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot <Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d0223600-b85d-432c-ba7b-24ada4558cb1
…-workflow-default
🔒 Security Review
🔒 Security review: 1 info.
Automated security review — informational only. |
…rough v1.0.1 (#2220) Drain all 76 pending .changeset/*.md fragments on dev into CHANGELOG.md: - Sync the [1.0.1] release entry from main (#2165, #2167) - Expand [1.0.0] and [0.13.1] with pre-release changesets that shipped in those releases - Populate [Unreleased] with post-1.0.1 changesets landed on dev - Remove consumed .changeset/*.md fragment files so scripts/check-changeset-drift.mjs --mode=fail exits 0 Closes #2180 Refs #1273 Co-authored-by: Copilot <Copilot@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5cf0811c-a02a-41a7-ab00-904b6900db7b
What
Activation now lets the SHA-pinned
squad-initaction install the latest complete stable GitHub Release through its built-in default. The workflow-level CLI override/resolver and obsolete CLI pin drift/bump automation are removed, directly coupled documentation/tests are updated, and stable release promotion is delayed until all standalone archives plusSHA256SUMS.txtexist. Working as agentic-workflows-dev (Agentic Workflows Engineer).Why
A real research activation installed v0.13.1 even though newer CLI releases existed: https://github.com/octodemo/zava-social-frontend-002/actions/runs/37085867778. Hardcoded release selection delayed fixes reaching users. The initial latest-default implementation also exposed an availability window where GitHub marked a stable release latest before its standalone assets were attached; this PR now closes that window. This is a user-directed bounded change; no unrelated issue is closed.
How
The shared activation workflow omits the action's
versioninput and pinsbradygaster/squad/.github/actions/squad-init@5c662ba015ec4f99befa51b0e8ca4f2148b0497f. A committed independently retrieved fixture binds that immutable action and its fail-closed checksum installer by SHA-256 and Git blob identity, then executes checksum success and failure cases.Stable GitHub Releases are created with
--latest=false. Apromote-latestjob waits for the reusable standalone publication workflow to finish, verifies all six platform archives andSHA256SUMS.txton the release, and only then runsgh release edit --latest; a regression test asserts incomplete releases cannot be promoted. Preview releases remain prereleases, and npm/package-manager publication behavior is otherwise unchanged.npx changeset add/.changeset/*.md, directCHANGELOG.mdentry for maintainers, orskip-changeloglabel for no user-facing changes)N/A: no SDK/CLI source, product template, dependency manifest, or lockfile changes are introduced by this PR.
PR Readiness Checklist
Branch & Commit
dev(notmain)dev(git fetch upstream && git rebase upstream/dev)git diff --cached --stat)The branch was merged with current
origin/devwithout force-pushing.Build & Test
npm run buildpassesnpm testpasses (all tests green)npm run lintpasses (type check clean)npm run lint:eslintpassesValidation evidence:
node workflows/shared/squad-install-verifier.mjs --check-source— PASSED after the remediation and again after merging currentdev; verifies generated package manifest/digests and strict gh-aw compilation contract.--latest=false; promotion depends on bothreleaseandstandalone; all six archives plusSHA256SUMS.txtare required beforegh release edit --latest.git diff --check— PASSED.Exit handler never called!through the required corporate proxy. The proxy also exposes Vitest 4.1.9 while this branch requires 5.0.2.SKIP_BUILD_BUMP=1 npm run build— BLOCKED because the failed restore leavestscunavailable. Required GitHub CI is expected to provide authoritative full build/test/lint results for the pushed commit.Changeset
npx changeset add(ifpackages/squad-sdk/src/orpackages/squad-cli/src/changed)CHANGELOG.mdentry (maintainers only — write-protected for external contributors)skip-changeloglabel applied (if no user-facing changes)N/A: infrastructure/workflow changes are exempt and no package source changed.
Docs
Updated the gh-aw guide and directly coupled release-process guidance; no new SDK/CLI feature or module requires a README section.
Exports
N/A: no SDK modules or exports changed.
Breaking Changes
The shared workflow no longer reads
vars.SQUAD_CLI_VERSION; activation follows the latest complete stable GitHub Release. Direct consumers of the installer/action can still select a version.Waivers
None requested. Merge remains gated on required GitHub checks and repository protections.