From 2a860b2e7909427f23085c8e95cb09215d643a5c Mon Sep 17 00:00:00 2001 From: Rome-1 Date: Tue, 8 Sep 2026 18:18:31 -0700 Subject: [PATCH] fix(release): bump BOTH gated skill manifests, and give every full-suite job the differential baseline MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two separate things blocking #237, both larger than they first looked. 1. THE VERSION GATE NAMED ONE FILE BECAUSE IT EXITS AT THE FIRST. validate-versions loops over TWO manifests and `exit 1`s on the first mismatch, so it reported only node/resources/rafter-security-skill.md. python/rafter_cli/resources/rafter-security-skill.md was equally stale at 0.10.0 and would have failed the very next run. Both bumped to 0.10.1; gate simulated over both files, OK on each. Four more manifests carry a version and are NOT in the loop (rafter/SKILL.md and rafter-code-review at 0.7.0, rafter-secure-design and rafter-skill-review at 0.1.0, each duplicated node/python). Left alone deliberately — they are not release-versioned — but a gate that checks two of six is a gate with a blind spot, and prod history already contains "fix(release): bump ClawHub skill resource versions to 0.8.9". Recurrence is the finding; bead to follow. 2. FIVE OTHER CHECKS WERE FAILING, ALL OF THEM MINE. test-build and all four cross-platform legs failed on tests/rf6pqx-differential.test.ts: Command failed: git show origin/main:node/src/core/risk-rules.ts fatal: invalid object name 'origin/main'. The differential FAILS rather than skips when the baseline is missing, which is right — but that makes the baseline a precondition of every job that runs the suite, and I had added the fetch to exactly the two jobs whose failure I happened to be looking at. So I swept all four workflows for jobs running a FULL suite instead of patching the instances again: test-comprehensive test-node already had it test-comprehensive test-python already had it test-comprehensive cross-platform ADDED validate-release test-build ADDED publish test-node ADDED publish test-python ADDED The last two are the ones that matter most: publish.yaml runs the full node and python suites, and publish-node/publish-python are gated on them. Without this the release would have passed every check on #237 and then FAILED AT THE MOMENT ROME MERGED — the worst place to find it. e2e-node, secret-detection-accuracy and backend-api run single targeted files, so they never collect the differential and need nothing. Checked rather than assumed. Local: the differential and battery suites pass in both runtimes. --- .github/workflows/publish.yaml | 12 ++++++++++++ .github/workflows/test-comprehensive.yml | 7 +++++++ .github/workflows/validate-release.yml | 7 +++++++ node/resources/rafter-security-skill.md | 2 +- python/rafter_cli/resources/rafter-security-skill.md | 2 +- 5 files changed, 28 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index bd8ed3da..1b1704ab 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -48,6 +48,12 @@ jobs: run: | pip install -e ".[dev]" 2>/dev/null || pip install -e . + # The rf-6pqx differential FAILS rather than skips when main's classifier is + # unobtainable, and this job runs the FULL suite — so the publish path needs + # the baseline too, or the release breaks at the moment it fires. + - name: Fetch main for the differential gate + run: git fetch --depth=1 origin main:refs/remotes/origin/main + - name: Run tests run: pnpm exec vitest run --reporter=default --reporter=json --outputFile.json=vitest-report.json @@ -85,6 +91,12 @@ jobs: pip install -e ".[dev]" 2>/dev/null || pip install -e . pip install pytest pytest-mock pytest-asyncio + # The rf-6pqx differential FAILS rather than skips when main's classifier is + # unobtainable, and this job runs the FULL suite — so the publish path needs + # the baseline too, or the release breaks at the moment it fires. + - name: Fetch main for the differential gate + run: git fetch --depth=1 origin main:refs/remotes/origin/main + - name: Run all tests run: python -m pytest tests/ -v -o junit_family=xunit1 --junitxml=pytest-report.xml env: diff --git a/.github/workflows/test-comprehensive.yml b/.github/workflows/test-comprehensive.yml index d9096f43..0aa3be0e 100644 --- a/.github/workflows/test-comprehensive.yml +++ b/.github/workflows/test-comprehensive.yml @@ -404,6 +404,13 @@ jobs: - name: Enable pnpm run: corepack enable && corepack prepare pnpm@10 --activate + # The rf-6pqx differential compares this branch's classifier against main's + # and FAILS rather than skips when the baseline is missing — correctly, but + # that means EVERY job running the suite has to supply it. actions/checkout + # fetches only the PR ref. A depth-1 fetch is enough: one blob, not history. + - name: Fetch main for the differential gate + run: git fetch --depth=1 origin main:refs/remotes/origin/main + - name: Install and build run: | pnpm install --frozen-lockfile diff --git a/.github/workflows/validate-release.yml b/.github/workflows/validate-release.yml index 96e40376..903fb4b7 100644 --- a/.github/workflows/validate-release.yml +++ b/.github/workflows/validate-release.yml @@ -84,6 +84,13 @@ jobs: with: python-version: "3.11" + # The rf-6pqx differential compares this branch's classifier against main's + # and FAILS rather than skips when the baseline is missing — correctly, but + # that means EVERY job running the suite has to supply it. actions/checkout + # fetches only the PR ref. A depth-1 fetch is enough: one blob, not history. + - name: Fetch main for the differential gate + run: git fetch --depth=1 origin main:refs/remotes/origin/main + - name: Build Node package run: | cd node diff --git a/node/resources/rafter-security-skill.md b/node/resources/rafter-security-skill.md index 758c1d5f..84445a0a 100644 --- a/node/resources/rafter-security-skill.md +++ b/node/resources/rafter-security-skill.md @@ -1,7 +1,7 @@ --- name: rafter-security description: Security toolkit for AI workflows. Use when scanning code or repos for vulnerabilities, auditing third-party skills/MCPs/agent configs before installing, evaluating shell commands before running them, or generating secure design questions for new features. Provides `rafter run` (remote SAST + SCA, needs RAFTER_API_KEY), `rafter secrets` (offline secrets-only), `rafter agent exec --dry-run` (command-risk classification), and `rafter skill review`. -version: 0.10.0 +version: 0.10.1 homepage: https://rafter.so metadata: openclaw: diff --git a/python/rafter_cli/resources/rafter-security-skill.md b/python/rafter_cli/resources/rafter-security-skill.md index 758c1d5f..84445a0a 100644 --- a/python/rafter_cli/resources/rafter-security-skill.md +++ b/python/rafter_cli/resources/rafter-security-skill.md @@ -1,7 +1,7 @@ --- name: rafter-security description: Security toolkit for AI workflows. Use when scanning code or repos for vulnerabilities, auditing third-party skills/MCPs/agent configs before installing, evaluating shell commands before running them, or generating secure design questions for new features. Provides `rafter run` (remote SAST + SCA, needs RAFTER_API_KEY), `rafter secrets` (offline secrets-only), `rafter agent exec --dry-run` (command-risk classification), and `rafter skill review`. -version: 0.10.0 +version: 0.10.1 homepage: https://rafter.so metadata: openclaw: