Automate verified DevTools manifest updates - #1445
Open
schickling-assistant wants to merge 2 commits into
Open
Conversation
schickling-assistant
marked this pull request as ready for review
July 18, 2026 10:33
Contributor
PR preview
Report historyPR 1445 · 2026-07-18 12:21 UTC
PR 1445 · 2026-07-18 10:53 UTC
|
Collaborator
Author
|
Superseded by the DevTools source-available migration — tracked in epic #1497. The external-artifact machinery this PR extends is retired once Posted on behalf of @schickling
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Every sanitized DevTools artifact publication opens a manifest-only PR, but
/release/CODEOWNERS currently forces a manual approval even though the artifact has already passed the dedicated verification workflow.Goal
Allow future manifest-only updates to merge automatically after the normal branch rules and required checks prove an official, forward-only artifact transition.
Decisions
/release/devtools-artifact.jsonfrom the broader/release/CODEOWNERS rule. Workflow definitions, release code, and every other release file remain owned.livestorejs/livestore-devtools-artifacts, canonical tag and filenames, full source revision, build identity, and matching lowercase SHA-256 digests.builtAtand build ID against the PR base manifest to reject rollback, replay, and same-build transitions.gh pr merge --auto --merge; do not grant GitHub Actions a ruleset bypass.Rejected alternatives: a broad Actions bypass could skip required checks; a machine-user token or custom GitHub App would add credential and lifecycle complexity without improving this narrow trust boundary.
Verification
pnpm exec vitest run scripts/src/commands/devtools-artifact.test.ts: 23/23 passed.devenv tasks run lint:check ts:check --no-tui: lint passed; TypeScript passed after fixing the only new exact-optional diagnostic. Existing Effect advisory diagnostics remain non-fatal.devenv tasks run release:devtools-artifact:verify --no-tui: passed against the checked-in public release.devenv --refresh-task-cache tasks run genie:run --no-tui: generated workflow is current.check-quick: passed.Complexity
The additional validator is kept in the existing artifact command and task. The complexity is required because removing the human approval gate must replace judgment with an explicit, testable provenance and transition policy.
Concerns
The official artifact repository remains the publication trust root. A compromised publisher there could publish a malicious newer artifact, but cannot bypass this repository's byte-integrity checks, public-content audit, or normal required checks.
Friction & bottlenecks
The previous manifest PR's pull-request verification failed independently of PR event delivery; this change keeps that verification mandatory and makes the previous-manifest input explicit from the base SHA.
Follow-ups
After this one-time CODEOWNERS governance approval, validate the next real artifact dispatch as the end-to-end proof of unattended auto-merge.
References
Closes #1444
Related: #1443
Posted on behalf of @schickling
agent_nameagent_session_idagent_toolagent_tool_versionagent_runtimeagent_modelruntime_profileskills_manifestworktreemachinetooling_profile