fix(release): count the -dev bump under its parent's CI and harden the plan

The workflow's -dev bump is pushed with GITHUB_TOKEN, so it never gets a CI
run. A main commit with no CI run now stands on its parent's CI when it only
rewrites version fields, so nightlies and stable releases keep working after
a release. A stable tag waits up to 20 minutes for its commit's CI, the npm
nightly dist-tag also blocks a second nightly that UTC day, version patterns
reject leading zeros, and the approval test pins the publish condition
exactly.

Author: thymikee

.github/workflows/release.yml

@@ -37,7 +37,8 @@ jobs:
   plan:
     name: Plan
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    # A stable tag waits up to 20 minutes for its commit's CI to finish.
+    timeout-minutes: 25
     permissions:
       actions: read
       contents: read

scripts/__tests__/release-plan.test.ts

@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict';
 import { test } from 'vitest';
-import { planRelease } from '../release-plan.mjs';
+import { isVersionOnlyCommit, planRelease } from '../release-plan.mjs';
 
 const MAIN = 'a'.repeat(40);
 const NIGHTLY_COMMIT = 'b'.repeat(40);
@@ -44,6 +44,8 @@ test('a scheduled nightly waits for new commits, a new day, and green CI', () =>
   assert.match(planRelease(run({ sha: NIGHTLY_COMMIT })).reason, /already ships/);
   assert.match(planRelease(run({ today: '20261010' })).reason, /shipped today/);
   assert.match(planRelease(run({ ciConclusion: 'in_progress' })).reason, /is in_progress/);
+  const published = run({ publishedNightly: '0.21.25-nightly.20261011.40' });
+  assert.match(planRelease(published).reason, /20261011\.40 shipped today/);
 });
 
 test('a dispatched nightly skips the cadence checks but still requires green CI', () => {
@@ -78,3 +80,38 @@ test('a stable tag publishes its own commit once it is on main and its CI passed
 test('releases refuse to run from any other branch', () => {
   assert.throws(() => planRelease(run({ ref: 'refs/heads/feature' })), /main or a vX\.Y\.Z tag/);
 });
+
+test("the workflow's -dev bump stands on its parent's CI, and nothing else does", () => {
+  const bump = {
+    parents: [{ sha: MAIN }],
+    files: [
+      {
+        filename: 'package.json',
+        patch: '@@ -2 +2 @@\n-  "version": "0.21.25",\n+  "version": "0.21.26-dev",',
+      },
+      {
+        filename: 'packages/proxy/package.json',
+        patch: '-  "version": "0.21.25",\n+  "version": "0.21.26-dev",',
+      },
+      {
+        filename: 'server.json',
+        patch: '-      "version": "0.21.25"\n+      "version": "0.21.26-dev"',
+      },
+    ],
+  };
+  assert.equal(isVersionOnlyCommit(bump), true);
+  const dependency = {
+    ...bump,
+    files: [
+      { filename: 'package.json', patch: '-    "undici": "7.29.0",\n+    "undici": "8.0.0",' },
+    ],
+  };
+  assert.equal(isVersionOnlyCommit(dependency), false);
+  const source = { ...bump, files: [...bump.files, { filename: 'src/index.ts', patch: '+x' }] };
+  assert.equal(isVersionOnlyCommit(source), false);
+  assert.equal(
+    isVersionOnlyCommit({ ...bump, parents: [{ sha: MAIN }, { sha: NIGHTLY_COMMIT }] }),
+    false,
+  );
+  assert.equal(isVersionOnlyCommit({ ...bump, files: [] }), false);
+});

scripts/__tests__/release-version.test.ts

@@ -19,6 +19,7 @@ test('a nightly is refused unless main carries a -dev version', () => {
   assert.throws(() => nightlyVersion('0.21.25', '20261010', 1), /X\.Y\.Z-dev/);
   assert.throws(() => nightlyVersion('0.21.25-dev', '2026-10-10', 1), /YYYYMMDD/);
   assert.throws(() => nightlyVersion('0.21.25-dev', '20261010', 0), /positive integer/);
+  assert.throws(() => nightlyVersion('0.21.025-dev', '20261010', 1), /X\.Y\.Z-dev/);
 });
 
 test('the latest nightly orders by base, then date, then run number', () => {
@@ -54,4 +55,5 @@ test('release versions compare numerically per segment', () => {
   assert.ok(compareReleaseVersions('1.0.0', '0.99.99') > 0);
   assert.equal(compareReleaseVersions('0.21.25', '0.21.25'), 0);
   assert.throws(() => compareReleaseVersions('0.21.25-dev', '0.21.25'), /release version/);
+  assert.throws(() => compareReleaseVersions('01.2.3', '0.21.25'), /release version/);
 });

scripts/release-plan.mjs

@@ -34,9 +34,11 @@ function planNightly(run) {
   if (scheduled && latest && run.tags.get(latest) === run.sha) {
     return skip(`${latest} already ships ${run.sha}.`);
   }
-  if (scheduled && latest?.includes(`-nightly.${run.today}.`)) {
-    return skip(`${latest} shipped today.`);
-  }
+  // The npm dist-tag is the durable record: a nightly can publish and then fail to tag.
+  const shippedToday = [latest, run.publishedNightly].find((shipped) =>
+    shipped?.includes(`-nightly.${run.today}.`),
+  );
+  if (scheduled && shippedToday) return skip(`${shippedToday} shipped today.`);
   if (run.ciConclusion !== 'success') {
     const reason = `CI on ${run.sha} is ${run.ciConclusion}; a nightly ships only a commit whose CI passed.`;
     if (scheduled) return skip(reason);
@@ -66,6 +68,28 @@ function planStable(run, tag) {
   return { mode: 'stable', version, distTag: 'latest', commit: run.sha, previousTag };
 }
 
+const VERSION_FILE = /^(packages\/[^/]+\/)?package\.json$|^server\.json$/;
+
+/**
+ * Whether a single-parent commit only rewrites `"version"` fields, as the release workflow's
+ * `-dev` bump does. Its push runs no workflows, so the parent's CI stands for it.
+ */
+export function isVersionOnlyCommit(commit) {
+  return (
+    commit.parents.length === 1 &&
+    commit.files.length > 0 &&
+    commit.files.every(
+      (file) =>
+        VERSION_FILE.test(file.filename) &&
+        typeof file.patch === 'string' &&
+        file.patch
+          .split('\n')
+          .filter((line) => /^[+-]/.test(line))
+          .every((line) => /^[+-]\s*"version": "[^"]*",?$/.test(line)),
+    )
+  );
+}
+
 function skip(reason) {
   return { mode: 'skip', reason };
 }
@@ -93,22 +117,34 @@ function remoteTags() {
   return tags;
 }
 
-async function ciConclusion(env) {
+async function ciConclusion(env, sha) {
   const { workflow_runs: runs } = await github(
     env,
-    `actions/workflows/ci.yml/runs?head_sha=${env.GITHUB_SHA}&event=push&per_page=1`,
+    `actions/workflows/ci.yml/runs?head_sha=${sha}&event=push&per_page=1`,
   );
-  if (runs.length === 0) return 'missing';
-  return runs[0].status === 'completed' ? runs[0].conclusion : runs[0].status;
+  if (runs.length > 0) return runs[0].status === 'completed' ? runs[0].conclusion : runs[0].status;
+  const commit = await github(env, `commits/${sha}`);
+  return isVersionOnlyCommit(commit) ? ciConclusion(env, commit.parents[0].sha) : 'missing';
+}
+
+/** A tag pushed right after a merge waits, within the Plan job's budget, for that merge's CI. */
+async function settledCiConclusion(env, sha) {
+  for (let attempt = 0; ; attempt += 1) {
+    const conclusion = await ciConclusion(env, sha);
+    if (!['queued', 'in_progress', 'waiting', 'pending'].includes(conclusion) || attempt >= 40) {
+      return conclusion;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 30_000));
+  }
 }
 
 async function isOnMain(env) {
   const { status } = await github(env, `compare/main...${env.GITHUB_SHA}`);
   return status === 'identical' || status === 'behind';
 }
 
-async function latestStable() {
-  const response = await fetch('https://registry.npmjs.org/agent-device/latest');
+async function publishedVersion(distTag) {
+  const response = await fetch(`https://registry.npmjs.org/agent-device/${distTag}`);
   if (response.status === 404) return null;
   if (!response.ok) throw new Error(`npm registry lookup failed: ${response.status}`);
   return (await response.json()).version;
@@ -138,8 +174,13 @@ async function readRun(env) {
     today: new Date().toISOString().slice(0, 10).replaceAll('-', ''),
     runNumber: env.GITHUB_RUN_NUMBER,
     tags: event === 'pull_request' ? new Map() : remoteTags(),
-    latestStable: onBranch || onTag ? await latestStable() : null,
-    ciConclusion: onBranch || onTag ? await ciConclusion(env) : undefined,
+    latestStable: onBranch || onTag ? await publishedVersion('latest') : null,
+    publishedNightly: onBranch ? await publishedVersion('nightly') : null,
+    ciConclusion: onTag
+      ? await settledCiConclusion(env, env.GITHUB_SHA)
+      : onBranch
+        ? await ciConclusion(env, env.GITHUB_SHA)
+        : undefined,
     onMain: onTag ? await isOnMain(env) : undefined,
   };
 }

scripts/release-version.mjs

@@ -7,9 +7,10 @@ import { pathToFileURL } from 'node:url';
 // it is building towards; a nightly publishes that base as `X.Y.Z-nightly.<YYYYMMDD>.<run>`; a
 // stable release publishes a tagged commit on `main` as `X.Y.Z`. Registry scanners diff the tool surface
 // per version string, so neither `main` nor a nightly may ever carry a published stable version.
-const RELEASE = /^(\d+)\.(\d+)\.(\d+)$/;
-const DEVELOPMENT = /^(\d+)\.(\d+)\.(\d+)-dev$/;
-const NIGHTLY = /^(\d+)\.(\d+)\.(\d+)-nightly\.(\d{8})\.(\d+)$/;
+const N = String.raw`(0|[1-9]\d*)`;
+const RELEASE = new RegExp(`^${N}\\.${N}\\.${N}$`);
+const DEVELOPMENT = new RegExp(`^${N}\\.${N}\\.${N}-dev$`);
+const NIGHTLY = new RegExp(`^${N}\\.${N}\\.${N}-nightly\\.(\\d{8})\\.([1-9]\\d*)$`);
 
 export function isReleaseVersion(version) {
   return RELEASE.test(version);

test/ci/release-workflow.test.ts

@@ -49,7 +49,7 @@ test('a stable publish waits for the release environment approval', () => {
   expect(workflow.jobs.approve?.environment).toBe('release');
   expect(workflow.jobs.approve?.if).toBe("needs.plan.outputs.mode == 'stable'");
   expect(workflow.jobs.publish?.needs).toContain('approve');
-  expect(workflow.jobs.publish?.if).toMatch(
-    /needs\.plan\.outputs\.mode == 'nightly' \|\| needs\.approve\.result == 'success'/,
+  expect(workflow.jobs.publish?.if?.replaceAll(/\s+/g, ' ').trim()).toBe(
+    "!cancelled() && needs.build.result == 'success' && (needs.plan.outputs.mode == 'nightly' || needs.approve.result == 'success')",
   );
 });