[ianmacartney]

Changes

• Keep the old Workpool comparison alias at 0.4.7 in both the manifest and lockfile.
• Build and stage the workflow run's exact commit, so npm provenance matches GitHub's signed source. Manual recovery can release fixes after a version bump; the optional SHA input now guards the selected ref instead of selecting an older source.
• Add regression coverage for release selection, channels, tags, and the baseline pin.
• Apply four formatting-only fixes required by main's pinned Prettier and ignore generated local Convex state.

Validation

• npm ci and npm run build pass.
• npm run check passes: 245 tests, typechecks, ESLint, and formatting.
• 12 release-selection regression tests pass.
• Required GitHub CI passed at 5aaf6f5, including anonymous E2E and generated-code verification.
• Workflow lint passed (actionlint and zizmor).

Ready to release 0.4.16 from main after merging. npm reported that version absent and no staged packages before recovery.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@convex-dev/workpool@262

commit: 5aaf6f5

[cubic-dev-ai]

1 issue found across 10 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/tests/release-plan.test.mjs">

<violation number="1" location=".github/tests/release-plan.test.mjs:137">
P3: This negative assertion can't catch a `GITHUB_SHA=` override split across lines, because `.*` stops at newlines. Scope the pattern to the stage command so it also covers backslash continuations.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P3: This negative assertion can't catch a GITHUB_SHA= override split across lines, because .* stops at newlines. Scope the pattern to the stage command so it also covers backslash continuations.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/tests/release-plan.test.mjs, line 137:

<comment>This negative assertion can't catch a `GITHUB_SHA=` override split across lines, because `.*` stops at newlines. Scope the pattern to the stage command so it also covers backslash continuations.</comment>

<file context>
@@ -0,0 +1,158 @@
+});
+test("stage checks the signed source and does not override GITHUB_SHA", () => {
+  assert.match(workflow, /test "\$SOURCE_SHA" = "\$GITHUB_SHA"/);
+  assert.doesNotMatch(workflow, /GITHUB_SHA=.*npm stage publish/);
+});
+test("the baseline alias stays at 0.4.7 in manifest and lockfile", () => {
</file context>

Suggested change

	assert.doesNotMatch(workflow, /GITHUB_SHA=.*npm stage publish/);
	assert.doesNotMatch(workflow, /GITHUB_SHA=\S*\s*\\?\s*npm stage publish/);