From 33f1c50c113a5df1a9e72066b75a68c903f6526b Mon Sep 17 00:00:00 2001 From: abhithesys Date: Fri, 11 Sep 2026 10:18:21 +0530 Subject: [PATCH 1/3] ci: fix release PR creation and CLI e2e pnpm matrix - release.yml: create the Version Packages PR with a token minted from the THESYS_PR_CREATOR GitHub App (vars.THESYS_PR_CREATOR_APP_ID + secrets.THESYS_PR_CREATOR_PRIVATE_KEY). GITHUB_TOKEN is not permitted to create PRs in this org, so every Release run has been failing at PR creation; app-made pushes and PRs also trigger workflows, giving the Version PR normal CI. Token goes to the action's github-token input (v2) and to env GITHUB_TOKEN for @changesets/changelog-github lookups; workflow permissions drop to contents:read + id-token:write. - cli-e2e.yml: the pnpm matrix step's explicit version collides with the root packageManager field (action-setup v6 hard-errors on the mismatch); point package_json_file at packages/openui-cli/package.json so the matrix version stays authoritative for template testing. Requires the app var/secret to be configured on the repo before the next Release run can succeed. Co-Authored-By: Claude Fable 5 --- .github/workflows/cli-e2e.yml | 5 +++++ .github/workflows/release.yml | 25 +++++++++++++++++++------ 2 files changed, 24 insertions(+), 6 deletions(-) diff --git a/.github/workflows/cli-e2e.yml b/.github/workflows/cli-e2e.yml index 8f6e69ff5..71ce488fc 100644 --- a/.github/workflows/cli-e2e.yml +++ b/.github/workflows/cli-e2e.yml @@ -160,6 +160,11 @@ jobs: if: matrix.package-manager == 'pnpm' with: version: ${{ matrix.package-manager-version }} + # The matrix version must win here; reading the repo root's + # packageManager field (pnpm@10.33.0) alongside an explicit version + # is a hard error in action-setup v6, so point it at a manifest + # without that field. + package_json_file: packages/openui-cli/package.json - name: Verify package manager version shell: bash diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index dbdc5b512..9a5393bb5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,18 +7,31 @@ on: concurrency: release permissions: - contents: write # push the changeset-release branch, create tags + GitHub Releases - pull-requests: write # maintain the Version Packages PR + contents: read # checkout only; push/PR/release rights come from the app token id-token: write # npm OIDC trusted publishing jobs: release: runs-on: ubuntu-latest steps: + # Branch pushes, the Version Packages PR, tags, and GitHub Releases are + # made with a GitHub App token instead of GITHUB_TOKEN: GITHUB_TOKEN is + # not permitted to create PRs in this org, and app-made pushes and PRs + # trigger workflows, so the Version PR gets normal CI. The app needs + # Contents + Pull requests read/write on this repo. + - name: Mint app token + id: app-token + uses: actions/create-github-app-token@v2 + with: + app-id: ${{ vars.THESYS_PR_CREATOR_APP_ID }} + private-key: ${{ secrets.THESYS_PR_CREATOR_PRIVATE_KEY }} + - uses: actions/checkout@v4 with: # Full history: @changesets/changelog-github links commits/PRs fetch-depth: 0 + # Persist the app token so the action's branch pushes use the app identity + token: ${{ steps.app-token.outputs.token }} - uses: pnpm/action-setup@v6 - uses: actions/setup-node@v4 with: @@ -47,11 +60,11 @@ jobs: create-github-releases: true pr-title: "chore: version packages" commit-message: "chore: version packages" + # PR creation, tags, and GitHub Releases act as the app + github-token: ${{ steps.app-token.outputs.token }} env: - # GITHUB_TOKEN-pushed branches trigger no workflows: the Version - # Packages PR runs zero CI. Swap in a PAT/GitHub App token here if - # CI on that PR (or required status checks on main) is needed. - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # For @changesets/changelog-github's PR/commit lookups in version-script + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} # Same build-memory headroom as build-js.yml NODE_OPTIONS: --max-old-space-size=6144 # Note: npm provenance is generated automatically with trusted From a4fc98753238e5474c3368578562e98b508a629a Mon Sep 17 00:00:00 2001 From: abhithesys Date: Fri, 11 Sep 2026 10:33:59 +0530 Subject: [PATCH 2/3] ci: verify e2e package manager version outside the repo checkout MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Inside the checkout, pnpm >=10 self-switches to the root packageManager version (pnpm@10.33.0) and reports it, failing the matrix expectation (Expected pnpm 11.x, got 10.33.0). The e2e steps all run under runner.temp, so verify there — measuring the pnpm the templates will actually use. Co-Authored-By: Claude Fable 5 --- .github/workflows/cli-e2e.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/cli-e2e.yml b/.github/workflows/cli-e2e.yml index 71ce488fc..87383e96e 100644 --- a/.github/workflows/cli-e2e.yml +++ b/.github/workflows/cli-e2e.yml @@ -168,6 +168,11 @@ jobs: - name: Verify package manager version shell: bash + # Outside the repo checkout: inside it, pnpm >=10 self-switches to the + # root packageManager version (pnpm@10.33.0) and would report that + # instead of the matrix-installed version. The e2e steps below all run + # under runner.temp too, so this verifies what they will actually use. + working-directory: ${{ runner.temp }} env: PACKAGE_MANAGER: ${{ matrix.package-manager }} EXPECTED_MAJOR: ${{ matrix.package-manager-version }} From f433a0e737691272de5d1ebcf6c0661659b95e30 Mon Sep 17 00:00:00 2001 From: abhithesys Date: Fri, 11 Sep 2026 11:13:00 +0530 Subject: [PATCH 3/3] fix: release devtools as minor, not patch react-lang 0.2.x depends on devtools ^0.1.0, so a devtools 0.1.x release carrying the new peer requirement (react-lang >=0.3.0) would be pulled into existing react-lang 0.2.x installs and break them with an unsatisfiable peer at install time. Releasing 0.2.0 instead escapes ^0.1.0: old react-lang keeps resolving old devtools, and only react-lang >=0.3.0 (released in the same train, depending on devtools ^0.2.0) picks up the new line. Same reasoning as react-email's minor in the original release-automation PR. Co-Authored-By: Claude Fable 5 --- .changeset/bounded-internal-peer-ranges.md | 1 - .changeset/devtools-bounded-peer-ranges.md | 10 ++++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) create mode 100644 .changeset/devtools-bounded-peer-ranges.md diff --git a/.changeset/bounded-internal-peer-ranges.md b/.changeset/bounded-internal-peer-ranges.md index 6b20a229d..dce17b72c 100644 --- a/.changeset/bounded-internal-peer-ranges.md +++ b/.changeset/bounded-internal-peer-ranges.md @@ -1,6 +1,5 @@ --- "@openuidev/assistant-ui": patch -"@openuidev/devtools": patch --- Internal `@openuidev/*` peer dependencies now declare bounded diff --git a/.changeset/devtools-bounded-peer-ranges.md b/.changeset/devtools-bounded-peer-ranges.md new file mode 100644 index 000000000..3c8993b9f --- /dev/null +++ b/.changeset/devtools-bounded-peer-ranges.md @@ -0,0 +1,10 @@ +--- +"@openuidev/devtools": minor +--- + +Internal peer dependencies now declare bounded tested-compatibility ranges: +`@openuidev/react-lang` requires `">=0.3.0 <0.4.0"`. Minor (breaking) rather +than patch on purpose: react-lang 0.2.x depends on devtools with `^0.1.0`, so +a 0.1.x release would be pulled into existing react-lang 0.2.x installs and +fail them with an unsatisfiable peer. Bumping to 0.2.0 keeps old react-lang +paired with old devtools; react-lang >=0.3.0 picks up the new line.