Skip to content

docs(devlog): record the 2.57.0 release and its registry propagation state - #4832

Merged
lidge-jun merged 2 commits into
devfrom
codex/2570-release-record
Sep 16, 2026
Merged

lidge-jun merged 2 commits into
devfrom
codex/2570-release-record

Conversation

@lidge-jun

@lidge-jun lidge-jun commented Sep 16, 2026

Copy link
Copy Markdown
Owner

What this is

The closing document of the 2.57.0 release train: every step with its SHA, run id and conclusion,
the two judgment calls the cut required, and the registry state as it stands.

Documentation only — no product code, no tests, no workflows.

Why the last section matters

npm publish succeeded with a signed provenance statement, and the workflow's own
Post-publish registry smoke step then failed to confirm the version in six bounded reads and
recorded verification=pending. Its summary says to inspect the registry before announcing
availability and not to republish. This document records that state explicitly so the next person
reading it does not mistake a propagation delay for a failed release and cut 2.57.1.

Validation

No local suite, typecheck, build or install was run. Every claim names a run id, a job id, a SHA,
or a URL.

Summary by CodeRabbit

  • Documentation
    • Added release documentation for version 2.57.0, including promotion steps and verification evidence.
    • Recorded decisions from CI and security-alert reviews.
    • Documented package registry propagation timing and final availability verification.

…state

Evidence for every step of the train, the two judgment calls (red dev, CodeQL
new-alert count), and the pending registry read that must not become a republish.
@lidge-jun
lidge-jun requested a review from Ingwannu as a code owner September 16, 2026 18:42
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 16, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review Completed 2026-09-16T18:46:00.674883Z f9b0a16 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@github-actions

Copy link
Copy Markdown
Contributor

Deterministic PR hygiene checks passed.

@coderabbitai

coderabbitai Bot commented Sep 16, 2026

Copy link
Copy Markdown
Contributor

Review Change StackReview Change Stack

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: b9946129-9a05-4011-b6bc-d742cdd3207a

📥 Commits

Reviewing files that changed from the base of the PR and between 3f639df and 1845573.

📒 Files selected for processing (1)
  • devlog/_plan/260917_2570_release_train/040_release.md

📝 Walkthrough

Walkthrough

The pull request adds a release-train record for version 2.57.0. It documents promotion evidence, CI and CodeQL decisions, and the observed npm registry propagation delay.

Changes

Release train documentation

Layer / File(s) Summary
Release sequence and follow-up record
devlog/_plan/260917_2570_release_train/040_release.md
Adds the six-step 2.57.0 promotion sequence, evidence for the release commits and workflows, decisions about dev CI and CodeQL alerts, and the eight-minute npm registry propagation observation.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/2570-release-record

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot added the documentation Improvements or additions to documentation label Sep 16, 2026
@lidge-jun

Copy link
Copy Markdown
Owner Author

Maintainer integration into dev under the 2026-09-06 owner authorization in MAINTAINERS.md, not a self-approval. Documentation-only; all non-CodeRabbit checks succeeded at the exact head.

@lidge-jun
lidge-jun merged commit 406606a into dev Sep 16, 2026
18 of 19 checks passed
@lidge-jun
lidge-jun deleted the codex/2570-release-record branch September 16, 2026 18:44

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f9b0a16774

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".


| Step | What happened | Evidence |
| --- | --- | --- |
| Freeze the candidate | `1831193294` on `dev`, `package.json` 2.57.0 | Cross-platform CI push run `35131181996`: success across the full matrix, all six Windows shards included. First green `dev` run since `35091966777`. |

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Reconcile wp2 with the final release candidate

This records 1831193294 as the frozen candidate, but 010_dev_green.md:38-39 still identifies 2b19983bfd as the release candidate and explicitly claims that this file contains its successful exact-SHA rerun. Because 1831193294 is two commits later and includes the timeout adjustment from #4830, the release audit now makes contradictory candidate and CI-evidence claims; update wp2 to document the supersession and its final SHA/run.

Useful? React with 👍 / 👎.

@lidge-jun

Copy link
Copy Markdown
Owner Author

리뷰 · 우선순위 76 / 80

설명

이 PR은 2.57.0 릴리스 트레인의 닫는 문서다. devlog/_plan/260917_2570_release_train/ 아래에 이미 있던 로드맵·dev green·PR/이슈 트리아지 문서(000~030) 다음에 040_release.md 한 장을 새로 붙인다. 제품 코드·테스트·워크플로 변경은 없고, documentation 라벨만 있다.

지금 dev HEAD는 이 PR이 머지된 406606a87이고, 패키지 버전은 #4827이 열어 둔 2.58.0이다. 2.57.0 자체는 이미 #4829로 main에 올라갔고(#4831로 preview에도 맞춰짐), npm publish까지 끝난 뒤의 기록이다. 그래서 이 PR의 역할은 “다음에 무엇을 고칠까”가 아니라 “방금 끝난 컷이 무엇이었고, 어디를 보면 증거가 있는지”를 남기는 일이다.

문서 본문은 세 덩어리다. 첫째, 후보 freeze(183119329) → dev 버전 오픈(#4827 / 3f639dfda) → main 승격(#4829 / 44de45dfd) → 릴리스 SHA CI → release.yml 디스패치(run 35135131119, provenance logIndex, GitHub release v2.57.0) → preview 승격(#4831)까지 스텝마다 SHA·run id·결론을 표로 묶었다. 둘째, 컷 중에 흔들리기 쉬운 두 판단을 글로 남겼다. 연속 빨간 dev는 회귀가 아니라 #4821 Bun 1.4.0 핀과 #4830 Windows spawn 예산이 풀 문제였다는 점, CodeQL “신규 고심각도” 알림은 거의 기존 main 알림이고 진짜 신규 #183은 비밀번호 해시가 아니라 API 키 선택용 로그 라벨 SHA-256이라는 점. 셋째, 그리고 이 PR의 핵심 가치인 레지스트리 전파다. publish는 18:34:37Z에 성공했는데 워크플로의 Post-publish registry smoke는 여섯 번 읽고도 못 확인하고 verification=pending을 남겼다. 약 여덟 분 뒤(18:42대) packument가 200이 되고 dist-tags.latest가 2.57.0이 됐다. 문서가 분명히 말하는 교훈은 “pending이면 재발행(2.57.1 컷)하지 말고, 레지스트리를 다시 읽고 기다리라”는 것이다. PR 본문이 연 직후 두 번째 커밋(1845573af)으로 그 확인까지 채워 넣었다.

현재 dev 방향과 맞춰 보면, 제품 델타는 없다. 다만 릴리스 트레인 문서를 #4828(계획)에서 #4832(실측·전파 상태)까지 닫아 두면, 나중에 “publish는 됐는데 npm에 안 보인다”는 상황에서 사람이 성급히 패치를 자르지 않게 하는 운영 가드레일이 된다. 이미 dev에 머지됐고(406606a87, 2026-09-16T18:44:40Z), 체크·위생도 통과한 상태다.

라인 수준의 제품 버그는 없다. 남는 건 문서 정확도·유지 비용·다음 컷에 남길 메모 정도다.

040_release.md 표의 freeze SHA 1831193294 - 열 자리 축약이라 읽기엔 충분하지만, 같은 표의 다른 칸은 9~12자리 혼용이다. 한 자리 규칙을 맞추면 나중에 git show 복붙이 덜 헷갈린다.

040_release.md preview 승격 #4831 - 본 PR 범위 밖이지만 문서가 의존하는 사실이다. preview 쪽 SHA b70f3d7fcb는 이 문서의 주장과 맞는지, 다음 트레인이 열리기 전에 한 번만 더 교차 확인하면 좋다.

경로 devlog/_plan/260917_2570_release_train/040_release.md - 문서만이라 types/config 분할 캠페인과 무관하다. 닫지 말고 그대로 두는 게 맞다(이미 머지됨).

메인테이너의 판단이 필요한 지점

  • Post-publish registry smoke의 대기 창을 늘릴지, 아니면 “pending은 정상·재발행 금지” 문구만으로 충분한지. 이번 문서 결론은 후자(변경 불필요)다.
  • 2.58.0 라인에서 같은 패턴의 040_release.md를 표준 wp로 고정할지, 아니면 사건 있을 때만 쓸지.
  • CodeQL codex-auth 계정 추가 시 리다이렉트 URL/코드 붙여넣기 입력창 누락 #183(account-label SHA-256)을 영구 suppress/문서화할지, 다음 승격 PR마다 다시 손으로 설명할지.

너의 추천
이미 dev에 랜딩됨(406606a87). 추가 수정·재오픈 불필요. 다음 사람은 npm verification=pending을 보고 2.57.1을 자르지 말고, 이 문서의 레지스트리 절을 먼저 읽으면 된다. leftover 원본 PR도 없다.

이 댓글은 grok-bot이 작성했습니다

agentHits pushed a commit to agentHits/opencodex that referenced this pull request Sep 17, 2026
…state (lidge-jun#4832)

* docs(devlog): record the 2.57.0 release and its registry propagation state

Evidence for every step of the train, the two judgment calls (red dev, CodeQL
new-alert count), and the pending registry read that must not become a republish.

* docs(devlog): the registry confirmed 2.57.0 eight minutes after publish

---------

Co-authored-by: lidge-jun <lidge-jun@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant