fix(release): continue agents-audit's version line at 0.5.0; freeze the bridge - #14
Merged
Conversation
…hangesets Three fixes that were left inconsistent by the publisher landing in the previous commit, plus the changeset/versioning cleanup they exposed. Docs now match reality. README.md said publishing from this repository was disabled outright and that `@workspacejson/cli` "has never been published. Do not document `npm install @workspacejson/cli` as if it works" — true when written, false the moment publish-cli.yml merges. It now carries a per-package publisher table, the release commands, and the still-accurate constraint that `agents-audit` cannot be published from here until META-243. packages/cli/CHANGELOG.md carried the same claim and records why the version line starts at 0.1.0 rather than continuing `agents-audit`: this is not that package renamed, it is the producer `agents-audit` depends on, the two ship on independent tags, and this binary has a deliberately smaller surface. Stale release metadata: `[0.4.4] - Unreleased` was published on 2026-07-23, and `## 0.4.2` was missing its brackets and date (2026-07-17). Both taken from the registry. Earlier entries have date drift of a day or so against npm; left alone rather than rewriting history on a guess. Changesets had two sources of truth and no way to reconcile them. The pending work lived as hand-written `[Unreleased]` prose while `.changeset/` held no changeset files at all, so `pnpm changeset version` was a silent no-op — it would never have bumped anything, and CI never ran it. The prose is now five changeset files, one per change, and the changelog carries a pointer instead of a duplicate. That conversion also corrects a mislabel. The pending block was headed "Patch Changes" while containing the `generate --check --dry-run` drift gate, which turns an exit 0 into an exit 1 — the same change deferred from 0.4.4 under META-157 *because* it alters exit-code semantics. It is marked `minor`; the other four are `patch`. `changeset status` now resolves the release to 0.5.0. No changeset for @workspacejson/cli: 0.1.0 is its initial release and the manifest already says so.
…he bridge Corrects the previous commit, which read the versioning question backwards. It bumped `agents-audit` to 0.5.0 and wrote a rationale for `@workspacejson/cli` NOT continuing that package's numbering. The opposite is intended: `agents-audit` is frozen and the CLI carries the line forward. `agents-audit` is locked at 0.4.4 for hackathon judging and gets no further releases. The five changesets that would have bumped it are removed and its `[Unreleased]` prose is restored — those changes exist in this tree but will not ship under that name. Where they touched the shared producer they reach users through `@workspacejson/cli`; where they touched this package's own `scan` and presenter surface they stay unreleased. The freeze is now mechanical rather than conventional: no workflow here publishes `agents-audit`, and it is listed under `ignore` in `.changeset/config.json` so a workspace-wide `changeset version` cannot bump it. Verified that ignoring it is a valid configuration — the reverse (ignoring the CLI while `agents-audit` depended on it) was the error this branch started by fixing. `@workspacejson/cli` goes to 0.5.0, not 0.4.5. Against `agents-audit@0.4.4` this binary removes surface — no `scan`, no config file, and the binary is renamed — so a patch would promise a drop-in successor that it is not. Under 0.x, breaking belongs in the minor slot. The changelog carries a migration table for the three differences. 0.5.0 is set directly in the manifest because changesets bumps relative to the current version and cannot jump 0.1.0 to 0.5.0; an empty changeset records that and keeps `changeset status` clean. Also recorded in OWNERSHIP.md: published `agents-audit@0.4.4` declares no dependency on `@workspacejson/cli`, confirmed against the registry. It is self-contained, so freezing it leaves nothing dangling. That dependency exists only in this working tree, which has never shipped. Verified: architecture guard, typecheck, 100 tests, `changeset status` clean, and release:verify-packs against both packed tarballs at their new versions (workspacejson-cli-0.5.0.tgz, agents-audit-0.4.4.tgz).
This was referenced Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #13, which landed the publisher but left three things inconsistent with how the packages are actually versioned.
@workspacejson/clicontinuesagents-audit's version line, starting at0.5.0.agents-auditis frozen at0.4.4— locked for hackathon judging — and all forward development moves here, so the numbering carries over rather than restarting at0.1.0.Why
0.5.0and not0.4.5Measured against
agents-audit@0.4.4, this binary removes surface:npx agents-audit generatenpx workspacejson generatenpx agents-audit scan.agentsauditrcA patch bump promises a drop-in successor, and the first thing a migrating user hits is a missing
scan. Under 0.x, breaking belongs in the minor slot. The migration table above ships inpackages/cli/CHANGELOG.md.0.5.0is set directly in the manifest because changesets bumps relative to the current version and cannot jump0.1.0→0.5.0. An empty changeset records that and keepschangeset statusclean; from0.5.0onward the normal add-changeset →changeset version→ tag flow applies.The freeze is now mechanical, not conventional
Two independent mechanisms, so it cannot erode by inattention:
agents-audit.changeset/config.jsonlists it underignore, so a workspace-widechangeset versioncannot bump itVerified that ignoring it is a valid changesets configuration. The reverse — ignoring
@workspacejson/cliwhileagents-auditdepended on it — was the invalid config that #13 fixed, so this needed checking rather than assuming.Its
[Unreleased]prose is restored and relabelled. Those changes exist in the tree but will not ship under that name: where they touched the shared producer they reach users through@workspacejson/cli; where they touched this package's ownscanand presenter surface they stay unreleased.Registry check
Published
agents-audit@0.4.4declares no dependency on@workspacejson/cli— confirmed against the registry, not inferred. It is self-contained, so freezing it leaves nothing dangling. That dependency exists only in this working tree, which has never shipped. Recorded inOWNERSHIP.md.Also corrected
README.mdandpackages/cli/CHANGELOG.mdstill said the package "has never been published. Do not documentnpm install @workspacejson/clias if it works" — true when written, false the moment ci(release): publish @workspacejson/cli from tagged releases (META-236) #13 merged.[0.4.4] - Unreleasedwas published 2026-07-23, and## 0.4.2was missing brackets and date (2026-07-17). Both taken from the registry. Earlier entries show a day of drift against npm; left alone rather than rewriting history on a guess.generate --check --dry-rundrift gate, which turns an exit 0 into an exit 1 — the change deferred from 0.4.4 under META-157 because it alters exit-code semantics. That mislabel is what made "is this a patch?" look settled when it wasn't.Verification
pnpm -r typecheckpnpm -r test— 104 tests (60 + 44)pnpm -r buildnode packages/agents-audit-compat/dist/cli.js scan . --fail-on errorbash migration/parity-agents-audit-runtime.sh— ran in CI, passed (Compatibility parity vs frozen source, 1m8s). Not run locally; noagents-auditruntime code changed here (changelog, changeset config and docs only), and CI runs the harness unconditionally.Also run:
pnpm run check:architecturepnpm run release:verify-packs—workspacejson-cli-0.5.0.tgzandagents-audit-0.4.4.tgzboth release-safepnpm changeset status— clean, no packages bumpedmain(post-[CLI] Exclude producer-owned outputs from fileIndex — the artifact indexed itself #12) and re-verified, so CI tests the real combined stateNotes
Release once merged:
git tag cli-v0.5.0 && git push --tags.The
NPM_TOKENcaveat from #13 still stands —@workspacejson/cliis a new package name, so a token scoped only to existing packages will not authorize the first publish.