Repository navigation
release: v4.5.3 (sync main into develop_v4) - #658
Conversation
release: v4.5.1
v4.5.1 was published with only package.json, README.md and LICENSE. The package has no JS in it, so every consumer build fails on import while main, module, types and exports all point into dist/. The publish workflow dropped its `npm run build` step when it was rewritten on 15 Sept. Nothing else builds before publish: there is no prepack or prepublishOnly script, and with no `files` field npm falls back to .gitignore, which excludes dist. No build means an empty package. Hooking the build to prepack fixes it for every publish path rather than just the one workflow, so a later workflow edit cannot silently drop it again. A failing build now fails the publish instead of shipping nothing. Co-Authored-By: Claude <noreply@anthropic.com>
When npm-alpha-publish.yml was folded into this workflow the publish-alpha job came out identical to publish, losing the `--tag alpha` the old workflow had. An alpha release would move the `latest` dist-tag to the prerelease and hand it to every consumer on a caret range. This also restores the alpha channel as a rehearsal for a real publish: cut a prerelease, install it, confirm it resolves, then cut the release, all without touching `latest`. Co-Authored-By: Claude <noreply@anthropic.com>
A version tag is mutable, so the action owner or anyone who compromises that account can change what runs in CI without the ref changing here. Pinning to the commit sha behind v2.13.0 keeps the same code and removes that path. Co-Authored-By: Claude <noreply@anthropic.com>
…-publish fix(release): restore build before publish and the alpha dist-tag
Co-Authored-By: Claude <noreply@anthropic.com>
release: v4.5.2
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Alpha tags such as v4.5.2-alpha.0 currently enter the regular publish job and can move npm’s latest tag.
Review effort: Balanced
Findings: 1
What changed in this PR
Syncs the v4.5.2 release changes from main into develop_v4.
Changes:
- Updates README and changelog for v4.5.2.
- Restores package builds during publishing.
- Consolidates alpha publishing and pins the coverage action.
| File | Description |
|---|---|
README.md |
Pins the CDN example to v4.5.2. |
package.json |
Builds distribution files during prepack. |
CHANGELOG.md |
Restores released history and formatting. |
.github/workflows/unit-test.yml |
Pins the coverage action SHA. |
.github/workflows/npm-publish.yml |
Consolidates release and alpha publishing. |
.github/workflows/npm-alpha-publish.yml |
Removes the retired standalone alpha workflow. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
hitesh-shetty-cstk
left a comment
hitesh-shetty-cstk
left a comment
There was a problem hiding this comment.
Automated review
Critical journey at risk: the release and publish path for @contentstack/live-preview-utils. As the merged workflow stands, cutting a prerelease moves npm's latest dist-tag onto it, so anyone installing the package or upgrading on a caret range picks up a prerelease build.
What this changes: This is a merge of main into develop_v4 after v4.5.2 shipped through a release branch. No source files move. What lands is the README CDN pin at 4.5.2, a CHANGELOG.md reset to the released history from main, the coverage action pinned to a commit sha, prepack added so dist is built into the published tarball, and the v4.5.2 release-workflow rewrite, which folds alpha publishing into npm-publish.yml and deletes the standalone alpha workflow. The changelog entries for the pending discussion-highlights fix are removed here, but the version script runs auto-changelog -p, which rebuilds the file from git history, so those entries return at the next release.
The release-workflow rewrite is not new code, but it is new to this branch and this is the first review it gets on develop_v4. Two parts of it are already proven in production: dropping NODE_AUTH_TOKEN in favour of OIDC trusted publishing shipped both v4.5.1 and v4.5.2 from main. The alpha split has never run, because no alpha release exists.
Business impact: A prerelease published under latest reaches every consumer on a caret range on their next install, with no action on their part. The failure is silent at publish time: the workflow succeeds, the package appears on npm, and the dist-tag is simply pointing at the wrong build.
Security: Nothing beyond what the scanners cover in the dependency or code-scanning sense, and Snyk is clean on this head. One supply-chain note the scanners do not reach: both publish jobs run an unpinned npm install -g npm@latest inside a job that holds id-token: write and signs the published artifact. Flagged inline as should-fix.
Flow
flowchart TD
R[GitHub Release published] --> G{"endsWith(release.name, '-alpha')"}:::changed
G -->|false| P[publish job]:::changed
G -->|true| A[publish-alpha job]:::changed
P --> PL["npm publish --provenance, dist-tag latest"]
A --> AL["npm publish --tag alpha, dist-tag alpha"]
N["prerelease named v4.6.0-alpha.0"] --> G
N -.->|name has a numeric suffix, so the guard passes| P
X[removed: push to alpha branch or tag]:::changed -.->|no longer a trigger| A
classDef changed fill:#fff3cd,stroke:#d39e00
Findings: 2 blocker, 2 should fix, 0 nit. All four are inline, and all four are on the release workflow. The blocker overlaps with what Copilot reported on this head; the inline comment adds the concrete release name that triggers it and a fix that does not depend on parsing the tag.
Reviewer candidates:
@Aravind-Kumar-cstkauthored the September rewrite ofnpm-publish.ymlthat moved it to OIDC trusted publishing, which is the file carrying both blockers.@Deepak-Kharahauthored every prior commit tonpm-publish.ymlon the base branch, including the current publishing setup.
@kirtesh-cstk authored the commit that added the publish-alpha job being ported here and knows the intent behind it best. That review is already in, so this is not a request, but the blocker is specifically about whether that job can ever fire, and it would be worth a word before merge.
Not covered: The workflow was not run. A release event cannot be exercised without cutting a real release, so the alpha path is analysed from the expression and the repo's release-naming history rather than observed. Nothing was verified on the npm registry side, including which npm version the package's trusted-publishing configuration requires. No build or test run.
Automated review by Claude Code. A human review is still required.
Generated by Claude Code
Co-Authored-By: Claude <noreply@anthropic.com>
karancs06
changed the title
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
Coverage Report
File CoverageNo changed files found. |
Live Preview SDK v4.5.3
Summary
Fixes an unhandled promise rejection in the Visual Builder discussion-highlights messaging, and brings the v4.5.2 release commits from main back into develop_v4 so all branches line up again. This PR carries the v4.5.3 version bump; it promotes through develop_v4, then stage_v4 (#653), then a final stage_v4 to main PR.
What's changed
Fixes
ignoreMissingListenerhelper insrc/visualBuilder/utils/postMessageErrors.tsswallows the library's missing-listener rejection and logs a console warning for any other send failure. Both send sites use it:useVariantsPostMessageEventanduseRecalculateVariantDataCSLPValues.Tests
Synced from main (v4.5.2 release)
prepacksodistships in the published tarball, prereleases publish under thealphadist-tag, and the retired alpha-publish workflow file is removed.vitest-coverage-report-actionpinned to a commit sha.Chores
4.5.3; CHANGELOG regenerated viaauto-changelog(the pending fix now has its ownv4.5.3section).@contentstack/live-preview-utils@4.5.3.Release path
develop_v4develop_v4tostage_v4)stage_v4tomainPRv4.5.3frommain(tag created via the Release UI), which triggers thenpm-publishworkflow@contentstack/live-preview-utils@4.5.3on npm and thathttps://esm.sh/@contentstack/live-preview-utils@4.5.3resolves🤖 Generated with Claude Code