[juliusmarminge]

Summary

• Moves the version bump commit and tag push out of the preflight job into a new finalize job that only runs after build, publish, and GitHub release all succeed
• Prevents orphaned version commits and tags on main when any downstream job fails
• Adds make_latest: true to softprops/action-gh-release so the action creates the tag for workflow_dispatch triggers

How it works

Job	Before	After
Preflight	Validate, lint/test, bump versions, commit+tag+push	Validate, lint/test only
Build	Checkout tag ref	Checkout triggering SHA
Release	Create GitHub release (tag must exist)	Create GitHub release (action creates tag if missing)
Finalize	(didn't exist)	Bump package.json versions, refresh lockfile, commit+push to main

Test plan

• Trace workflow_dispatch flow: preflight validates → build/publish/release use --build-version/--app-version flags → release action creates tag → finalize bumps package.json and pushes to main
• Trace push tag flow: preflight validates → build/publish/release run → finalize no-ops if versions already match
• Verify failed build/publish leaves no version commit or tag on main

🤖 Generated with Claude Code

---

Note

Medium Risk
Medium risk because it changes the release automation flow (tagging/target commit, version bump commits, and lockfile updates), which can break or mis-tag releases if misconfigured.

Overview
Release workflow now defers repo mutations until after a successful release. preflight no longer bumps versions/lockfile or creates/pushes tags; downstream jobs build/publish from ${{ github.sha }} captured as needs.preflight.outputs.ref.

GitHub Release publishing is adjusted. The release step now sets target_commitish to the captured ref and enables make_latest: true, and a new finalize job updates package versions on main, refreshes bun.lock, and commits/pushes the version bump only when changes are detected.

CLI npm publish metadata is expanded. apps/server/package.json gains a repository field, and apps/server/scripts/cli.ts now includes repository and bin when generating the temporary publish package.json.

^{Written by Cursor Bugbot for commit 630be05. This will update automatically on new commits. Configure here.}

Note

Defer release commit and tag to a finalize job by updating GitHub Actions workflow to publish against github.sha and mark the release as latest

Update release workflow to publish releases against github.sha, add make_latest: true, and move version bump, lockfile refresh, and commit to a new finalize job on main. Include repository metadata in apps/server and pass repository and bin through the publishCmd package.json payload.

📍Where to Start

Start with the release flow changes in .github/workflows/release.yml, then review the publishCmd logic in apps/server/scripts/cli.ts.

^{Macroscope summarized 630be05.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 58a02887-fadf-4111-a0fd-24452771d033

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch defer-release-commit-to-finalize

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Missing target_commitish may tag wrong commit
  • Added target_commitish: ${{ needs.preflight.outputs.ref }} to the softprops/action-gh-release@v2 step so the tag is always created at the exact commit that was built.
• ✅ Fixed: Finalize runs formatting and lockfile refresh unconditionally
  • Propagated the changed state from the node script to GITHUB_OUTPUT and added if: steps.update_versions.outputs.changed == 'true' conditions to the formatting and lockfile refresh steps.

Or push these changes by commenting:

@cursor push 5ce934a6e8

Preview (5ce934a6e8)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -257,6 +257,7 @@
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ needs.preflight.outputs.tag }}
+          target_commitish: ${{ needs.preflight.outputs.ref }}
           name: T3 Code v${{ needs.preflight.outputs.version }}
           generate_release_notes: true
           make_latest: true
@@ -290,12 +291,13 @@
         with:
           node-version-file: package.json
 
-      - name: Update version strings
+      - id: update_versions
+        name: Update version strings
         env:
           RELEASE_VERSION: ${{ needs.preflight.outputs.version }}
         run: |
           node --input-type=module -e '
-            import { readFileSync, writeFileSync } from "node:fs";
+            import { readFileSync, writeFileSync, appendFileSync } from "node:fs";
 
             const files = [
               "apps/server/package.json",
@@ -314,15 +316,18 @@
               }
             }
 
+            appendFileSync(process.env.GITHUB_OUTPUT, `changed=${changed}\n`);
             if (!changed) {
               console.log("All package.json versions already match release version.");
             }
           '
 
       - name: Format package.json files
+        if: steps.update_versions.outputs.changed == 'true'
         run: bunx oxfmt apps/server/package.json apps/desktop/package.json apps/web/package.json packages/contracts/package.json
 
       - name: Refresh lockfile
+        if: steps.update_versions.outputs.changed == 'true'
         run: bun install
 
       - name: Commit and push version bump