feat: automate app-modules release and app-monorepo sync by huhuanming · Pull Request #123 · OneKeyHQ/app-modules

huhuanming · 2026-09-20T14:11:11Z

Problem

app-modules needs automatic preview packages for ordinary merged changes, while stable releases must use the version explicitly reviewed in source. npm acceptance alone is not enough to prove that a version is available to consumers.

Release policy

A merged same-repository PR that does not change a publishable workspace version gets a CI-only next-patch -alpha.<workflow run number> version across all publishable workspaces and exact internal dependencies, then publishes under npm next. The preview version is not committed to main and does not update app-monorepo.
A merged same-repository PR that changes a publishable workspace version publishes the exact synchronized stable version from the PR under npm latest. The workflow does not bump versions or update CHANGELOG. Source PR approval is also release approval for a version-changing PR.
A merged fork PR is skipped with a workflow-summary notice and can be released manually.

Publishing and downstream sync

Publish only missing packages; if the exact version already exists under another tag, move the selected dist-tag instead of attempting an invalid republish.
Poll the npm registry every 45 seconds for at most 10 checks. Continue only after every package version and selected dist-tag are visible.
For latest only, update all app-modules pins on app-monorepo x, including mobile npm aliases, components dependencies, and root dependency/resolution pins; refresh the lockfile, check the module-ID registry, and open an app-monorepo PR. Do not auto-merge it.

Validation

30 Node tests pass; git diff --check passes.
The workflow passes actionlint, excluding only the local actionlint schema warning for the currently supported GitHub Actions queue: max setting.
Preview smoke test from stable 3.0.152: all 41 packages became 3.0.153-alpha.999, the four exact internal dependency pins followed the preview version, Yarn refreshed the lockfile, and dist-tag validation passed.
Read-only registry check: all 41 stable 3.0.152 packages exist and would be retagged from next to latest without republishing.
Earlier app-monorepo dry run: 41 mobile pins, 4 components pins, and 2 root pins update with no unrelated lines changed.

Required setup and boundaries

Install a dedicated GitHub App on app-monorepo with Contents write and Pull requests write. Configure APP_RELEASE_APP_ID and APP_RELEASE_PRIVATE_KEY in app-modules; keep NPM_TOKEN available for npm publishing. These credentials and live end-to-end publishing were not verified in this PR.
module-id:update requires a fresh Union Build module-ID map. The dependency PR checks the existing registry, but new native runtime modules still need map generation and a registry update before that PR merges.

sidmorizon · 2026-09-20T14:16:19Z

@codex review

sidmorizon · 2026-09-20T14:16:28Z

@codex security review

chatgpt-codex-connector · 2026-09-20T14:16:34Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-20T14:23:18.233772Z	`cdd5bbb`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

sidmorizon · 2026-09-20T14:16:50Z

Cursor Cloud Agent review session ↗

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cdd5bbbdba

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

sidmorizon · 2026-09-20T14:41:51Z

View Devin Review ↗️

sidmorizon · 2026-09-20T15:29:48Z

Claude review session: https://claude.ai/code/session_01GN4VAXu1Jw39qQ51fL1Yrr

sidmorizon · 2026-09-21T02:08:22Z

Local Codex CLI review

Open the review session in Slack

The review runs in a read-only local worktree and continues in this session when the PR receives a substantive commit.

cursor · 2026-09-21T05:09:23Z

+  return missing;
+}
+
+export function selectRetags(workspaces, packuments, distTag) {


🟠 P1 selectRetags 会把 next 拨回更旧版本

Problem

本轮把「版本已存在但 dist-tag 不匹配就失败」改成了无条件 npm dist-tag add。selectUnpublished 的回退保护只在两端都是 \d+.\d+.\d+ 时生效；prerelease 时 compareStableVersions 返回 null，检查被跳过。selectRetags（scripts/publish-missing.mjs:47-54）只要「该 version 已在 registry 且当前 tag 不是它」就会 retag，没有顺序比较。

本地复现：next 指向 3.0.153-alpha.11 时，工作区 3.0.153-alpha.10 会被选进 retags；workflow_dispatch + next 且工作区仍是已发布的 3.0.152 时，同样会把 next 拨到 3.0.152。package-publish.yml 的 preview 只在 pull_request && dist_tag==next 跑 prepare-preview，手动 next 走同一条 publish-missing。

Impact

next 是本轮新的 preview 通道。重跑更早的 preview workflow，或按 README 用 manual next 做 recovery，都会把 @pkg@next 从更新的 alpha 拨回旧 alpha 或稳定版。消费 next 的人会突然拿到更旧的包。latest 的稳定回退仍被挡住，所以不是 P0，但是明确的状态/并发缺陷。

Recommendation

retag 前用能比较 prerelease 的顺序：仅当现有 tag 缺失或严格旧于工作区 version 才 dist-tag add；现有 tag 更新则跳过或失败。workflow_dispatch + next 不要把已指向 alpha 的 next 拨到 main 上的稳定版。测试应覆盖「next 指向更新 alpha 时不得回拨」。

Cursor session ↗

sidmorizon · 2026-09-21T05:11:32Z

+  if (!/^\d+\.\d+\.\d+$/.test(left) || !/^\d+\.\d+\.\d+$/.test(right)) {
+    return null;


🟡 P2: Preview reruns move next backwards

Severity: non-severe

Rerunning an older preview lets selectUnpublished accept a newer prerelease carrying next. compareStableVersions skips prereleases, so retagging makes consumers resolve the older preview.

sidmorizon · 2026-09-21T05:11:41Z

-          NPM_DIST_TAG: ${{ inputs.npm_dist_tag }}
-          ONLY_WORKSPACE: ${{ inputs.only_workspace }}
+          NPM_DIST_TAG: ${{ steps.channel.outputs.dist_tag }}
        run: yarn workspace "$ONLY_WORKSPACE" release --tag "$NPM_DIST_TAG"


🟡 P2: Single-workspace retag recovery fails

Severity: non-severe

When a workspace version already exists, release republishes it instead of retagging it. npm rejects the recovery, leaving the requested dist-tag unchanged.

cursor Bot reviewed Sep 20, 2026

View reviewed changes

Comment thread scripts/sync-app-monorepo.mjs Outdated

chatgpt-codex-connector Bot reviewed Sep 20, 2026

View reviewed changes

Comment thread .github/workflows/prepare-release.yml Outdated

Comment thread .github/workflows/prepare-release.yml Outdated

Comment thread .github/workflows/package-publish.yml Outdated

sidmorizon reviewed Sep 20, 2026

View reviewed changes

Comment thread .github/workflows/prepare-release.yml Outdated

sidmorizon reviewed Sep 20, 2026

View reviewed changes

Comment thread .github/workflows/prepare-release.yml Outdated

Comment thread .github/workflows/package-publish.yml Outdated

Comment thread .github/workflows/package-publish.yml Outdated

originalix reviewed Sep 20, 2026

View reviewed changes

Comment thread .github/workflows/prepare-release.yml Outdated

huhuanming added 6 commits September 21, 2026 11:36

feat: automate app-modules release and app-monorepo sync

06caf61

test: remove prepare-release tests

0991722

fix: harden release automation and sync all module pins

9207fca

fix: refresh CI lockfiles and find existing release PRs

bb35542

fix: poll npm visibility every 45 seconds up to ten times

844713d

docs: clarify supported release workflow queue

42439d7

huhuanming force-pushed the codex/app-modules-auto-release branch from 849537f to 42439d7 Compare September 21, 2026 03:36

feat: publish preview or latest based on version changes

8d528bf

cursor Bot reviewed Sep 21, 2026

View reviewed changes

sidmorizon reviewed Sep 21, 2026

View reviewed changes

		if (!/^\d+\.\d+\.\d+$/.test(left) \|\| !/^\d+\.\d+\.\d+$/.test(right)) {
		return null;

Conversation

huhuanming commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Release policy

Publishing and downstream sync

Validation

Required setup and boundaries

Uh oh!

sidmorizon commented Sep 20, 2026

Uh oh!

sidmorizon commented Sep 20, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

sidmorizon commented Sep 20, 2026

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sidmorizon commented Sep 20, 2026

Uh oh!

Uh oh!

sidmorizon commented Sep 20, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sidmorizon commented Sep 21, 2026

Local Codex CLI review

Uh oh!

cursor Bot Sep 21, 2026

Choose a reason for hiding this comment

🟠 P1 selectRetags 会把 next 拨回更旧版本

Problem

Impact

Recommendation

Uh oh!

sidmorizon Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

sidmorizon Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

huhuanming commented Sep 20, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Sep 20, 2026 •

edited

Loading