Skip to content

fix(publish-npm): build binary from current SHA + add compat check - #9212

Merged
alexhancock merged 1 commit into
mainfrom
alexhancock/publish-npm-build-from-source
May 14, 2026
Merged

fix(publish-npm): build binary from current SHA + add compat check#9212
alexhancock merged 1 commit into
mainfrom
alexhancock/publish-npm-build-from-source

Conversation

@alexhancock

Copy link
Copy Markdown
Collaborator

Summary

publish-npm.yml built the TUI/SDK from the current SHA but downloaded the Rust binary from an arbitrary release tag. When those drifted, the published bundle launched into a Zod "Setup error" (e.g. 0.19.1 shipped a client expecting ProviderInventoryEntryDto.category against a v1.33.1 binary that predates the field).

This PR makes publish-npm build the binary from the same checkout via build-cli.yml, and adds a compat smoke test that boots the fresh binary and Zod-validates every read-only ACP response before publish.

Testing

  • YAML and JS syntax checked locally.
  • Compat script runnable locally: GOOSE_BINARY=… pnpm --filter @aaif/goose-sdk run check:compat.
  • Will validate end-to-end by running publish-npm with dry-run: true after merge.

Related Issues

N/A

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 11393011ae

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

@alexhancock
alexhancock force-pushed the alexhancock/publish-npm-build-from-source branch from 1139301 to 04e05a7 Compare May 14, 2026 16:01
Signed-off-by: Alex Hancock <alexhancock@block.xyz>
@alexhancock
alexhancock force-pushed the alexhancock/publish-npm-build-from-source branch from 04e05a7 to 1b53698 Compare May 14, 2026 16:04
@aaif-goose aaif-goose deleted a comment from chatgpt-codex-connector Bot May 14, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1b53698cfb

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

build:
name: Build npm packages
runs-on: ubuntu-latest
needs: [build-cli]

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Decouple npm publish from unused CUDA matrix leg

This change makes build depend on the reusable build-cli workflow, and that reusable workflow includes a Windows CUDA matrix entry (variant: cuda) with no continue-on-error; however, this publish flow only consumes the non-CUDA artifact (goose-x86_64-pc-windows-msvc) when populating ui/goose-binary. The result is that a CUDA-only failure (toolchain/install flake) will fail build-cli and block npm publishing even though none of the published npm packages use the CUDA artifact.

Useful? React with 👍 / 👎.

@alexhancock
alexhancock added this pull request to the merge queue May 14, 2026
Merged via the queue into main with commit c938a46 May 14, 2026
25 checks passed
@alexhancock
alexhancock deleted the alexhancock/publish-npm-build-from-source branch May 14, 2026 16:55
lifeizhou-ap added a commit that referenced this pull request May 15, 2026
* main: (102 commits)
  Dynamically refresh skill instructions each turn (#9217)
  Build non-vulkan linux variants using ubuntu 22.04 (#9211)
  fix(ui): show tool name in approval prompt (#9216)
  feat: add Atomic Chat as declarative OpenAI-compatible provider (#9210)
  chore: bump package.json versions from 0.19.1 to 0.20.0 (#9218)
  feat: support GOOSE_OAUTH_CALLBACK_PORT for stable OAuth redirect_uri (#9209)
  [RFC] feat(oauth): proactive token refresh to avoid re-auth on every session (#8386)
  fix: resolve Azure CLI on Windows by using az.cmd (#9215)
  fix: handle non-interactive terminal in goose configure on Windows (#9214)
  Better parsing of pasted html as markdown so agents understand (#9190)
  fix: persist accumulated cost in session DB to survive reload (#9191)
  fix(publish-npm): build binary from current SHA + add compat check (#9212)
  feat(desktop): add goose://new-session deep link to open fresh chat (#9196)
  Add PR previews using cloudflare pages (#9208)
  fix: prevent tool-use marker leakage in toolshim output (#8310)
  Prompt injection mitigation: update pattern-based detection (#9198)
  remove goose2 related skills (#9189)
  Switch GH pages deploy to actions/artifact workflow (#9025)
  fix(summon): re-apply canonical limits when delegate overrides model (#9183)
  Split code signing from build (#8587)
  ...
shafqatevo pushed a commit to shafqatevo/goose that referenced this pull request Aug 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants