release(turborepo): 2.10.8-canary.2 - #13492
Merged
Merged
Conversation
github-actions
Bot
requested review from
tknickman
and removed request for
a team
July 26, 2026 15:29
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
anthonyshew
disabled auto-merge
July 27, 2026 15:51
anthonyshew
added a commit
that referenced
this pull request
Jul 29, 2026
## Summary - Create release PRs with the `turbobot` credential so required `pull_request` workflows run. - Validate exact generated release changes from immutable base and head SHAs in a trusted `workflow_run` workflow. - Revoke stale automation approvals when checks are requested, then bind approval and squash merge to the validated head SHA after required checks pass. - Use conventional release PR titles and update the release runbook. ## Security - CLI releases may change only nine known package manifests, generated Turborepo skill references, and `version.txt`. - Library releases may change only nine known `@turbo/repository` manifests. - Manifest validation permits only expected version and native optional-dependency fields; scripts, arbitrary dependencies, Cargo files, lockfiles, and unrelated content fail closed. - The privileged workflow executes only the validator from its trusted workflow SHA, never code from the release branch. ## Testing - `node --test scripts/validate-release-pr.test.mjs` (11 passing tests). - Replayed validation against canary PR #13492, stable PR #13489, and library PR #13276. - `actionlint` for the new auto-merge workflow. - `oxfmt` and YAML parser validation for changed workflows, scripts, and documentation. - Full pre-push hook: formatting, TOML checks, and `cargo fmt --check`. ## Rollout The existing `TURBOBOT` secret must authenticate as the `turbobot` account. The release workflow verifies this identity before creating a PR.
anthonyshew
pushed a commit
that referenced
this pull request
Jul 31, 2026
## Release v2.10.8 > [!CAUTION] > Versioned docs aliasing FAILED. [View logs](https://github.com/vercel/turborepo/actions/runs/30636958913) ### Changes - fix: Scroll TUI task list with mouse wheel (#13479) (`c6ded77`) - fix: Make releases resumable (#13486) (`92da3c3`) - refactor: Expose knowledge-backed package scope views (#13456) (`2c675f4`) - release(turborepo): 2.10.7 (#13489) (`ee50965`) - refactor: Use package knowledge for configuration scopes (#13457) (`75c63f4`) - refactor: Use package knowledge for run scope enumeration (#13458) (`f5c0eee`) - release(turborepo): 2.10.8-canary.1 (#13490) (`5503cf7`) - refactor: Use package knowledge in repository views (#13459) (`ff21d9a`) - refactor: Use package knowledge in package integrations (#13460) (`6efcbec`) - ci: Parallelize environment setup steps (#13491) (`db0dc90`) - release(turborepo): 2.10.8-canary.2 (#13492) (`db71e14`) - refactor: Use package knowledge for task hashing paths (#13461) (`ad43f80`) - refactor: Use package knowledge for run-cache paths (#13462) (`95406bb`) - refactor: Bind toolchain callbacks to package knowledge (#13463) (`ac6c28f`) - refactor: Use package knowledge for microfrontend commands (#13464) (`d9b9c4b`) - refactor: Use package knowledge for run summaries (#13465) (`e67b079`) - refactor: Use package knowledge for watcher paths (#13466) (`947b3ad`) - ci: Enable remote cache for types codegen (#13495) (`9b95197`) - docs: Fix llms.txt links to page markdown routes (#13497) (`6ada90e`) - refactor: Use package knowledge for prune paths (#13467) (`5a20113`) - refactor: Use package knowledge in the LSP (#13468) (`b78ebff`) - refactor: Use consistent repository construction (#13469) (`3d54f6e`) - refactor: Delete legacy package and scope authority (#13470) (`8318f99`) - perf: Cache telemetry salt instead of re-reading config on every hash (#13498) (`4df7c1d`) - feat: Support Android (Termux) (#12735) (`1165d7c`) - ci: Restore Cargo targets on all test platforms (#13505) (`dab0c04`) - fix: Resolve gitdir for linked worktrees in repo index (#13503) (`a13e724`) - test: Characterize relationship projections (#13499) (`91c77b0`) - refactor: Produce native relationship observations (#13500) (`aad0c81`) - feat: Resolve GitHub Actions remote base refs behind future flag (#10732) (`dc17727`) - refactor: Add core relationship projections (#13502) (`17558a8`) - refactor: Define external resolution contracts (#13507) (`89a808d`) - refactor: Move repository tasks into Turbo configuration (#13504) (`72837d2`) - refactor: Build JavaScript external resolution generations (#13508) (`70421be`) - refactor: Contribute Cargo external resolutions (#13509) (`396daa3`) - refactor: Migrate external declaration consumers (#13511) (`59fd5d5`) - ci: Auto-merge release PRs (#13510) (`6226a05`) - chore: Release Turborepo 2.10.8-canary.3 (#13512) (`56ccdde`) - fix: Use tokenless release review gate (#13513) (`e5af40d`) - refactor: Use resolution fingerprints for task hashes (#13514) (`702f95a`) - fix: Support fork PRs in review gate (#13516) (`a3840e7`) - refactor: Migrate lockfile affectedness (#13519) (`bdbcd06`) - refactor: Migrate external resolution summaries (#13520) (`81b24dc`) - refactor: Migrate external package queries to resolution knowledge (#13523) (`c9853f8`) - fix: Serialize macOS Homebrew setup (#13549) (`33c1689`) - refactor: Migrate prune lockfile keys to resolution identities (#13524) (`fa0721b`) - refactor: Migrate global hash inputs to resolution knowledge (#13525) (`a81a683`) - refactor: Delete legacy external-resolution PackageInfo state (#13526) (`fbe88d3`) - chore: Release Turborepo 2.10.8-canary.4 (#13557) (`887d9b1`) - refactor: Remove external declaration compatibility paths (#13527) (`3c8448d`) - refactor: Produce immutable native task and command knowledge (#13528) (`18d0bc3`) - refactor: Migrate native task registration and suggestions (#13529) (`7b5ee63`) - refactor: Migrate turbo-json native task synthesis (#13530) (`2d004f0`) - refactor: Migrate persistent and recursive task validation (#13531) (`dd7519b`) - refactor: Migrate native task definition precedence (#13532) (`8792ce9`) - refactor: Migrate engine native command planning (#13533) (`67e4e9e`) - refactor: Migrate executor native command resolution (#13534) (`1b8accc`) - refactor: Migrate native task query, devtools, and LSP views (#13535) (`2753b76`) - refactor: Migrate command summaries and delete legacy task paths (#13536) (`adbad50`) - refactor: Produce immutable task-contract knowledge (#13537) (`97bff31`) - refactor: Migrate engine task-contract composition (#13538) (`fab50c5`) - refactor: Migrate hashing engines to task contracts (#13539) (`76206f8`) - refactor: Exclude JavaScript from toolchain task-I/O dispatch (#13540) (`115e850`) - refactor: Migrate change classification to immutable knowledge (#13543) (`5a55e8d`) - refactor: Separate prune rendering with golden coverage (#13546) (`62a047a`) - refactor: Delete JS format interpretation from prune orchestration (#13554) (`f1b37f6`) - refactor: Audit remaining JS knowledge consumer reads (#13556) (`7f12c3f`) - refactor: Migrate MFE dependency detection off PackageInfo (#13558) (`4cb9d94`) - refactor: Remove prune PackageInfo dependencies (#13562) (`1bb9233`) - refactor: Remove residual runtime PackageInfo gates (#13564) (`c8eaedc`) - refactor: Migrate boundary diagnostics off PackageInfo (#13571) (`f977db3`) - docs: Audit Cargo package knowledge (#13572) (`53dd13e`) - refactor: Complete Cargo relationship and resolution knowledge (#13576) (`b29e30c`) - refactor: Port Cargo task and contract knowledge (#13581) (`74446c5`) - refactor: Port Cargo watch and prune knowledge (#13582) (`acd3be1`) - refactor: Remove runtime toolchain dispatch (#13584) (`2c10201`) - ci: Restore Cargo target for lockfile tests (#13588) (`e848ad1`) - refactor: Replace toolchains with repository contributors (#13585) (`5d06e95`) - refactor: Remove Cargo contributor plumbing (#13586) (`6ea1daf`) - refactor: Remove ToolchainId runtime dispatch (#13587) (`24fbd3e`) - refactor: Route task behavior through contract domains (#13589) (`da88240`) - refactor: Route package consumers by manifest (#13591) (`bb12c72`) - refactor: Route MFE eligibility by manifest (#13592) (`08c7a74`) - refactor: Project manifest-derived repository facts (#13593) (`64e2a7e`) - refactor: Route residual task behavior by capability (#13595) (`fe9b72d`) - refactor: Route resolution through explicit domains (#13596) (`be21801`) - refactor: Route N-API package listing by manifest (#13597) (`8f44636`) - docs: Vercel Remote Cache authentication with OIDC policies (#13140) (`c84ed36`) - refactor: Own resolution fingerprints in repository (#13598) (`16708a9`) - refactor: Fail closed on invalid relationships (#13599) (`1a237de`) - perf: Reuse Cargo metadata discovery snapshot (#13600) (`2fa79c5`) - refactor: Resolve MFE package ownership from graph (#13601) (`0253836`) - refactor: Remove retained package payloads (#13603) (`58d9660`) - feat: Add native Cargo format task (#13606) (`ab15587`) - refactor: Compose repository graphs for optional toolchains (#13608) (`915e82b`) - ci: Invalidate Cap'n Proto caches (#13616) (`5cf35ad`) - feat: Discover uv workspaces (#13609) (`8715646`) - feat: Run native uv tasks (#13610) (`4195e41`) - feat: Hash uv lockfile closures (#13611) (`e14de24`) - fix: Make Windows Cap'n Proto cache relocatable (#13621) (`00538d0`) - feat: Watch uv workspace changes (#13612) (`b2e25d4`) - feat: Prune uv workspaces (#13613) (`f8f288e`) - fix: Fall back to polling on macOS (#13622) (`b3dc99b`) - test: Add uv workspace integration coverage (#13602) (`dd87718`) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release v2.10.8-canary.2
Caution
Versioned docs aliasing FAILED. View logs
Changes
75c63f4)f5c0eee)5503cf7)ff21d9a)6efcbec)db0dc90)