Add runtime-driven canary and unstable SDK publishing by MackinnonBuck · Pull Request #2544 · github/copilot-sdk

MackinnonBuck · 2026-09-04T21:09:33Z

Problem

Maintainers need branch-capable unstable Node SDK releases and runtime-driven canary/unstable releases. npm trusted publishing recognizes only .github/workflows/publish.yml, so every production npm publication must execute directly in that workflow.

Changes

Make publish.yml the sole production release workflow and remove runtime-sdk.yml.
Preserve existing stable/prerelease behavior across Node, .NET, Rust, Python, Java, Go, and GitHub Releases.
Use one dispatch surface:
- dist-tag: latest, prerelease, unstable, or canary
- version: optional direct SDK version/base
- mode: publish or dry-run
- runtime: optional automation JSON with exactly {version,sha,run_id}
Parse and validate runtime JSON once, then pass validated provenance through job outputs. Canary requires runtime JSON; runtime handoffs are limited to canary/unstable; stable/prerelease dry-runs are rejected.
Keep runtime-backed acquisition, Ubuntu/macOS/Windows tests, exact nine-package verification, retained manifests, retries, and idempotent publication.
Keep direct unstable public npm → Azure ordering and runtime unstable Azure verification → public npm ordering. Canary remains Azure-only.
Keep dry-runs non-mutating and outside publication concurrency locks.

Versioning

Canary versions use:

X.Y.(Z+1)-canary.<workflow_run_number>.g<sdk_sha7>

Generated unstable versions use:

<target_core>-unstable.<workflow_run_id>.g<sdk_sha7>

Explicit direct unstable versions use:

<explicit_unstable_base>.<workflow_run_id>.g<sdk_sha7>

The source runtime run ID is provenance only. Re-running the same SDK workflow run preserves its release identity; a new dispatch receives a new version.

Merge order

Merge this SDK receiver before github/copilot-agent-runtime#20157 enables runtime dispatch to publish.yml.

Copilot

Copilot review overview

🟡 Changes recommended

Critical argument-validation and moderate provenance, version-comparison, and SemVer handling issues remain unresolved.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1 · 4

New issues introduced by this change (5)

Severity	Finding
	`nodejs/scripts/runtime-package-acquisition.ts` — Missing or misspelled required flags are silently converted to empty strings. In particular,…
	`.github/workflows/publish.yml` — `runtime_run_id` is only checked for numeric syntax and then copied into the release manifest;…
	`.github/workflows/publish.yml` — This substring match can select and test a different runtime version whose output merely contains…
	`.github/workflows/sdk-canary.yml` — This is a substring check, so a different runtime version can pass (for example, expected `1.0.8`…
	`.github/workflows/sdk-canary.yml` — SemVer permits build metadata. If the public latest is `1.2.3+build`, this leaves `PATCH=3+build`;…

What changed in this PR

Adds gated canary and unstable Node SDK publishing with deterministic versioning, runtime acquisition, integrity-aware manifests, and recovery support.

Changes:

Adds runtime acquisition, versioning, manifest, and publishing helpers.
Reworks canary and unstable workflows with cross-platform validation.
Adds focused release tests and operator documentation.

File	Description	Review
`nodejs/test/unstable-version.test.ts`	Tests deterministic unstable versions.	No unresolved comments.
`nodejs/test/runtimeArtifacts.test.ts`	Tests local runtime selection.	No unresolved comments.
`nodejs/test/runtime-package-acquisition.test.ts`	Tests runtime acquisition and validation.	No unresolved comments.
`nodejs/test/release-workflows.test.ts`	Tests workflow contracts.	No unresolved comments.
`nodejs/test/release-manifest.test.ts`	Tests manifest integrity.	No unresolved comments.
`nodejs/test/npm-release.test.ts`	Tests integrity-aware publishing.	No unresolved comments.
`nodejs/scripts/unstable-version.ts`	Calculates deterministic unstable versions.	No unresolved comments.
`nodejs/scripts/set-cli-version.js`	Adds local-package mode.	No unresolved comments.
`nodejs/scripts/runtime-package-acquisition.ts`	Acquires exact runtime packages.	Critical (1 vote): Reject unknown, duplicate, missing, and incomplete arguments before filesystem operations; a missing `--output` currently targets the working directory.
`nodejs/scripts/releaseArtifacts.ts`	Supports pre-acquired runtime roots.	No unresolved comments.
`nodejs/scripts/release-manifest.ts`	Creates and verifies release manifests.	No unresolved comments.
`nodejs/scripts/npm-release.js`	Publishes package sets with integrity checks.	No unresolved comments.
`nodejs/README.md`	Documents runtime package inputs.	No unresolved comments.
`nodejs/package.json`	Adds release helper commands.	No unresolved comments.
`docs/developer-docs/unstable-releases.md`	Adds the operator runbook.	No unresolved comments.
`docs/developer-docs/secrets.md`	Documents token permissions.	No unresolved comments.
`.github/workflows/sdk-canary.yml`	Reworks gated canary packaging.	Moderate (1 vote each): Strip SemVer build metadata before patch arithmetic; replace substring runtime-version checks at lines 217 and 360 with exact parsed comparisons.
`.github/workflows/publish.yml`	Adds gated unstable publishing.	Moderate (1 vote each): Validate `runtime_run_id` provenance against the source repository and runtime metadata; replace substring runtime-version checks at lines 535 and 686 with exact parsed comparisons.

Suppressed comments (2)

.github/workflows/publish.yml:686

This release gate checks only that the expected text occurs somewhere in the output, so a clean install with a different version such as 1.0.83 can satisfy an expected 1.0.8. Parse the runtime's reported version and require exact equality before allowing public publication.

          "$RUNTIME" --version | grep -F "$RUNTIME_VERSION"

.github/workflows/sdk-canary.yml:360

The clean-install gate uses a substring match, so it can accept the wrong embedded runtime when the requested version is a prefix of the actual one (for example, 1.0.8 versus 1.0.83). Parse the emitted version and require exact equality so this gate proves the package contains the selected runtime.

          "$RUNTIME" --version | grep -F "$RUNTIME_VERSION"

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

Move artifact-ledger claim handling and package-set preflight into tested release scripts, keeping the workflow focused on job orchestration. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

Preserve every serialized release job and reject non-canonical dispatch identities before claiming the runtime ledger key. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

Reject zero workflow IDs and require the complete runtime acquisition CLI contract before resolving or modifying output paths. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

Derive canary versions from stable GitHub releases published by the canonical workflow creation time so reruns retain the same release identity. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

Acquire both runtime-driven channels from GitHub Packages while retaining Azure for internal SDK outputs and restoring production conflict-based package publication semantics. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

Require runtime versions to carry the exact selected prerelease channel before dispatch claims and release manifest creation or verification. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

Archive acquired runtime packages before artifact upload so Unix executable modes survive restoration, and persist the package root for legacy CLI test resolution. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

Remove cross-run dispatch claiming so each SDK workflow invocation creates its own release identity while reruns retain the same deterministic version. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

Normalize Windows Git Bash paths before extracting runtime artifacts and scope ambient acquired packages to exact requested runtime versions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

github-actions · 2026-09-11T22:45:32Z

SDK Consistency Review

I reviewed PR #2544 against the authoritative file list (pull_request_read get_files/get_diff).

Scope of changes: All modifications are confined to Node.js release/publishing infrastructure and CI:

.github/workflows/publish.yml, .github/workflows/sdk-canary.yml (removed)
docs/developer-docs/secrets.md, docs/developer-docs/unstable-releases.md
nodejs/README.md, nodejs/package.json
nodejs/scripts/* (npm-release.js, package-set-manifest.js, release-manifest.ts, releaseArtifacts.ts, runtime-package-acquisition.ts, runtime-release-identity.ts, set-cli-version.js, unstable-version.ts)
nodejs/test/* (corresponding test files)

Conclusion: No public client-facing SDK API code is touched in any language (Node/TS, Python, Go, .NET, Java, Rust). This PR is entirely about how the Node.js package is versioned, packaged, and published (unstable release tooling, CI publish workflow), not about SDK feature/API surface. There is nothing here that requires mirroring in Python, Go, .NET, Java, or Rust — these languages have their own independent release/publish tooling, and this change doesn't introduce any client API, method, or behavior that other SDKs would need to match.

No cross-SDK consistency issues found. ✅

Generated by SDK Consistency Review Agent for #2544 · copilot · sonnet50 · 15.3 AIC · ⌖ 12.2 AIC · ⊞ 8.3K · ◷

MackinnonBuck requested a review from a team as a code owner September 4, 2026 21:09

Copilot AI balanced review requested due to automatic review settings September 4, 2026 21:09

Copilot started reviewing on behalf of MackinnonBuck September 4, 2026 21:10 View session

Copilot AI reviewed Sep 4, 2026

View reviewed changes

Comment thread nodejs/scripts/runtime-package-acquisition.ts Outdated

Comment thread .github/workflows/publish.yml Outdated

Comment thread .github/workflows/publish.yml Outdated

Comment thread .github/workflows/sdk-canary.yml Outdated

Comment thread .github/workflows/sdk-canary.yml Outdated

MackinnonBuck changed the title ~~Add gated unstable SDK publishing~~ Add runtime-driven canary and unstable SDK publishing Sep 4, 2026

This comment has been minimized.

Sign in to view

github-advanced-security Bot found potential problems Sep 8, 2026

View reviewed changes

Comment thread nodejs/scripts/runtime-dispatch-ledger.ts Fixed

github-actions Bot mentioned this pull request Sep 8, 2026

[aw] SDK Consistency Review Agent produced no safe outputs #2575

Open

Mackinnon Buck and others added 17 commits September 11, 2026 09:38

Add gated unstable SDK publishing

bd556d9

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Share runtime-backed Node release pipeline

d709198

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Unify runtime-driven SDK publishing

5d41b9a

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Harden runtime-driven SDK workflows

7e58a0d

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

Fix runtime SDK reruns and canary versions

c2378ad

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

Fix pre-check working directory

1cb1ed0

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

Unify runtime-driven SDK workflow

06246f2

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

Harden runtime SDK release queueing

0c5da6b

Preserve every serialized release job and reject non-canonical dispatch identities before claiming the runtime ledger key. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

Validate runtime release inputs

4063d71

Reject zero workflow IDs and require the complete runtime acquisition CLI contract before resolving or modifying output paths. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

Shorten runtime SDK job names

59bc2e1

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

MackinnonBuck force-pushed the mackinnonbuck-sdk-unstable-publishing branch from 03bace3 to 59bc2e1 Compare September 11, 2026 16:45

Mackinnon Buck added 3 commits September 11, 2026 10:58

Rename runtime SDK publish mode

42550fe

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

Restore direct unstable SDK publishing

691ce53

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

Trim unstable publishing scope

23d3ea7

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

This comment has been minimized.

Sign in to view

Mackinnon Buck added 2 commits September 11, 2026 13:25

Simplify unstable release tooling

463c28b

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

Unify SDK release dispatch

dc024f4

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

This comment has been minimized.

Sign in to view

Make release workflow test cross-platform

15083b8

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d81fc7cf-d30a-470e-b7bf-42a02f62841d

Navigation Menu

Uh oh!

Add runtime-driven canary and unstable SDK publishing - #2544

Add runtime-driven canary and unstable SDK publishing#2544
MackinnonBuck wants to merge 23 commits into
mainfrom
mackinnonbuck-sdk-unstable-publishing

MackinnonBuck commented Sep 4, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

Uh oh!

This comment has been minimized.

This comment has been minimized.

github-actions Bot commented Sep 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

MackinnonBuck commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Changes

Versioning

Merge order

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

Uh oh!

This comment has been minimized.

This comment has been minimized.

github-actions Bot commented Sep 11, 2026

SDK Consistency Review

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

MackinnonBuck commented Sep 4, 2026 •

edited

Loading