Skip to content

chore(release): vendor aqua registry from main #10286

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jdx merged 1 commit into from
Jun 9, 2026
Merged

chore(release): vendor aqua registry from main #10286

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions xtasks/release-plz
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -283,12 +283,12 @@ AQUA_REGISTRY_METADATA="$AQUA_REGISTRY_DIR/metadata.json"
AQUA_REGISTRY_FILE="$AQUA_REGISTRY_DIR/registry.yml"
AQUA_REGISTRY_REPO="aquaproj/aqua-registry"

# Capture current aqua-registry tag before updating
# Capture current aqua-registry ref before updating
OLD_AQUA_REGISTRY_TAG=""
if [[ -f $AQUA_REGISTRY_METADATA ]]; then
OLD_AQUA_REGISTRY_TAG="$(jq -r '.tag // empty' "$AQUA_REGISTRY_METADATA")"
fi
NEW_AQUA_REGISTRY_TAG="$(gh release view --repo "$AQUA_REGISTRY_REPO" --json tagName --jq .tagName)"
NEW_AQUA_REGISTRY_TAG="$(gh api "repos/$AQUA_REGISTRY_REPO/commits/main" --jq .sha)"

@greptile-apps greptile-apps Bot Jun 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Pinning to main instead of a tagged release

Fetching the latest commit SHA from aquaproj/aqua-registry's main branch means the vendored registry can include WIP or unreleased changes that have not gone through aqua-registry's own release testing. Between upstream releases, main may contain broken YAML, schema changes, or incomplete package entries. Previously the code used the latest tagged release (gh release view), which is a stable, explicitly tested snapshot. This trade-off deliberately accepts instability to keep packages fresher, but it could cause a mise release to ship a vendored registry that aqua-registry themselves haven't yet cut as stable.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Fix in Claude Code

@cursor cursor Bot Jun 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Commit SHA breaks tag assertion

Medium Severity

The release script now records the upstream main commit SHA in metadata.json’s tag field, but baked-registry tests still require that value to start with v like an aqua-registry release tag. Once vendoring runs, test_baked_registry_metadata fails even though the registry content is valid.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 42eaa6c. Configure here.


rm -rf "$AQUA_REGISTRY_DIR"
mkdir -p "$AQUA_REGISTRY_DIR"
Expand Down
Loading