[AAASM-2336] ♻️ (release-node): Listen for repository_dispatch from agent-assembly; remove retry workaround

[Chisanan232]

Description

Companion to agent-assembly's notify-downstream job (AAASM-2336). Replaces AAASM-2328's retry-with-backoff workaround with explicit event-driven coordination.

Changes

Aspect	Before	After
Trigger	push: tags: ['v*.*.*']	repository_dispatch: types: [agent-assembly-release-published]
Release tag source	github.ref_name	github.event.client_payload.release_tag
gh release download	20×60s retry loop (AAASM-2328)	Single attempt — no retry needed
workflow_dispatch for manual re-run	kept	kept

After this

• release-node only fires when agent-assembly's Release is actually published
• Total time from agent-assembly tag-push to npm publish: ~5 min (vs 10-25 min with retry)
• No more 'release not found' race
• No more false-failure noise

🚨 PAT prerequisite

Document on agent-assembly companion PR — CROSS_REPO_DISPATCH_PAT must be configured in agent-assembly repo before either side works end-to-end.

Related

• Jira: AAASM-2336
• Companion: agent-assembly PR
• Supersedes: AAASM-2328 retry workaround

— Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Chisanan232]

Claude Code review — AAASM-2336 (node-sdk side)

CI state

25/25 SUCCESS — mergeable=MERGEABLE, mergeStateStatus=CLEAN. Full node-sdk matrix green: napi-build × 4 OS-Node combinations, module-smoke (18/20/22), test (3 × 3 OS-Node combinations), quality, coverage-and-analysis, SonarCloud, Codecov.

Notably: workflow-yaml CI doesn't exercise the new repository_dispatch trigger directly (no PR-side simulation possible). That's verified by actually firing the dispatch from the agent-assembly companion PR after both merge + the PAT secret is configured.

Scope vs. AC

AC	Verified	Status
on: block replaces push: tags: ['v*.*.*'] with repository_dispatch: types: [agent-assembly-release-published]	yes	✅
workflow_dispatch trigger kept for operator-initiated re-runs	yes	✅
Resolve release tag step reads github.event.client_payload.release_tag for repository_dispatch event	yes — branches on EVENT_NAME == "repository_dispatch"	✅
Resolve release tag step errors clearly on unexpected event_name	yes — ::error::unexpected event_name '$EVENT_NAME'	✅
gh release download retry loop (AAASM-2328 workaround) removed	yes — single attempt, no retry	✅
actionlint clean	yes	✅
Comment explains supersedes AAASM-2328 + cross-repo coordination	yes	✅

Implementation choice notes

• Removed push: tags trigger entirely, replaced with repository_dispatch. Alternative would have been keeping both (so manual tag-push still works), but that re-introduces the race. Keep workflow_dispatch as the manual re-run lever instead.
• The client_payload.release_tag is passed as a JSON string from agent-assembly's notify-downstream. node-sdk validates the shape via the same regex check (^v[0-9]+\.[0-9]+\.[0-9]+) that was applied to github.ref_name.
• EVENT_NAME check is fail-safe: any unexpected event type errors out explicitly, no silent fallback.

After this + companion PR merge + PAT configured

End-to-end release flow becomes:

1. Operator pushes v0.0.1-alpha.4 tag → agent-assembly
2. agent-assembly release.yml runs: build × 4 → publish → update-homebrew-tap → smoke-test → notify-downstream fires repository_dispatch to node-sdk
3. node-sdk release-node.yml triggered by dispatch event, reads release_tag from client_payload
4. gh release download succeeds on FIRST try (no race, no retry)
5. node-sdk builds + publishes npm packages

Total: agent-assembly → node-sdk takes ~5 min after agent-assembly publishes (vs 10-25 min under AAASM-2328's retry workaround).

Verdict

Ready for human approval and merge, paired with agent-assembly's PR #842. Either PR can merge first — if node-sdk merges first, the next tag push fires its old push:tags trigger one last time before this lands; if agent-assembly merges first, node-sdk continues to use the retry loop until this lands. Either is fine. Best ordering: agent-assembly first (after PAT secret configured), then node-sdk.

— Claude Code (Opus 4.7, 1M context)