Release v0.8.10 → prod (RETRY: npm publish was blocked by fixture-detection test) - #188
Merged
Conversation
….yml can't suppress them The v0.8.10 publish (run 28332931747) failed at github-action.test.ts "CLI detects secrets in fixture file" (exit 0, expected 1), which gated publish-node — leaving npm at 0.8.9 while PyPI shipped 0.8.10, breaking dual-implementation version parity on the registries. Root cause: PR #184 added a repo-root .rafter.yml that declassifies **/fixtures/** and .github/fixtures/** as triaged false positives for the dogfooding security gate. Six checks scan .github/fixtures expecting detection, but policy discovery walks cwd -> git root, finds .rafter.yml, and suppresses the finding: - node/tests/github-action.test.ts "CLI detects secrets in fixture file" - publish.yaml smoke-test-node / smoke-test-python detection steps - test-action.yml detect-secrets / pip-install / published-v1 jobs (dormant — the path filter didn't fire on #184's root-file change) Fix: keep .rafter.yml exactly as the #184 backend-verified security review set it. Instead, make the detection checks hermetic — copy the fixture to a temp dir outside the repo (smoke/unit tests) or a neutral /tmp path the policy globs don't match (action jobs) so no .rafter.yml is discovered. These checks verify the detection ENGINE and must be decoupled from the repo's own self-scan policy. Verified locally: isolation restores exit 1 for node file/dir scans and the python file scan; github-action.test.ts 81/81. Version stays 0.8.10: twine --skip-existing no-ops the existing PyPI upload, npm publishes 0.8.10 fresh, and create-release cuts the v0.8.10 tag. Bead: sable-nfjq Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ture-detection fix(ci): make fixture-detection checks hermetic (unblock v0.8.10 npm publish)
Raftersecurity
approved these changes
Jun 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why this is a retry
PR #186 promoted v0.8.10 to prod and triggered publish run 28332931747.
publish-pythonsucceeded (PyPI → 0.8.10) buttest-nodefailed, gatingpublish-node→ npm is stuck at 0.8.9. prod was then rolled back to the 0.8.9 state (current prod HEAD =992fa49).This PR re-promotes
main(now containing the fix) to complete the release and bring npm to 0.8.10, restoring registry parity.What was broken & fixed
The
test-nodefailure wasgithub-action.test.ts"CLI detects secrets in fixture file" (exit 0, expected 1). Root cause: the repo-root.rafter.ymladded in #184 declassifies**/fixtures/**, so six fixture-detection checks (the unit test, bothpublish.yamlsmoke tests, threetest-action.ymljobs) had their findings suppressed by the repo's own self-scan policy.Fixed in #187 (merged to
main): the detection checks are now hermetic — they scan an isolated copy outside the repo, so.rafter.ymlis untouched (its #184 backend-verified suppressions stay intact) while the checks verify the detection engine. The threetest-action.ymljobs now pass in CI;github-action.test.tspasses 81/81 locally.On merge (publish.yaml)
test-node/test-package: now green (fix included)publish-node: npm publish 0.8.10 (not yet on npm → publishes) ✅publish-python:twine --skip-existing→ 0.8.10 already on PyPI → no-op ✅create-release: cuts thev0.8.10git tag (does not exist yet) + GitHub releasesmoke-test-node/smoke-test-python: now green (fix included)publish-clawhub: publishes the 0.8.10 skill (was skipped last time)Version stays 0.8.10 (node + python both at 0.8.10; parity holds).
Merging this triggers an irreversible npm publish and is gated by prod branch protection (REVIEW_REQUIRED). Leaving the final approve+merge to Rome, per sable-ehb1.
Beads: sable-ehb1 (release), sable-nfjq (fix), follow-up sable-8860 (run full tests on PRs→main)
🤖 Generated with Claude Code