ci: add release-prepare and release-publish workflows for npm releases by tejaskash · Pull Request #2206 · aws/agentcore-cli

tejaskash · 2026-09-03T22:28:37Z

Summary

Two workflows give the refactor branch a PR-gated npm release process for @aws/agentcore, in the shape of the Python SDK's release-prepare and release-publish pair.

release-prepare.yml, workflow_dispatch with bump (major, minor, patch) and channel (rc, stable). Bumps package.json with bun pm version, refreshes the vended @aws/agentcore-cdk pin in the template, force-pushes release/v<version> and opens the PR as the automation App. The PR is the only release gate.
- Version arithmetic: 0.28.1 → 1.0.0-rc.0 → 1.0.0-rc.1 → 1.0.0 → 1.1.0-rc.0. bump is ignored while an rc series is open. Graduation strips the suffix explicitly because Bun's pm version major on 1.0.0-rc.3 yields 2.0.0.
release-publish.yml, pull_request: closed into refactor for merged release/v* PRs. Runs check, build and unit-test on the merge commit, then on ubuntu-latest builds, packs, cross-compiles six binaries, npm publish --provenance under rc for prereleases or latest otherwise, and creates the GitHub release with generated notes, tarball and binaries. Publish is skipped if the version is already on npm, so a rerun after a failed release step completes. workflow_dispatch with dry_run exists for verification.
scripts/sync-vended-cdk.ts, Bun port of feat(release): auto-bump the vended CDK pin during release prep #2118's pin sync. Dependency-free because it runs before bun install.
package.json renamed to @aws/agentcore, set to the last published version 0.28.1, with the repository field provenance requires.
Telemetry fix found by the first dry run: src/telemetry/shapes.tsx only accepted X.Y.Z, so a binary versioned 1.0.0-rc.0 printed its version and exited 1 at startup. Now accepts a prerelease suffix, length-capped like the other attributes, with a test.each for accepted and rejected shapes.

No GitHub environments and no concurrency groups. Publish runs on a GitHub-hosted runner because npm refuses provenance from self-hosted ones.

Verification

workflow_dispatch only lists workflow files that exist on main, and these two do not yet, so neither could be dispatched from this branch. Verified instead:

actionlint with shellcheck clean on both workflows.
Version bump shell simulated locally for all five transitions listed above, each producing the expected version.
scripts/sync-vended-cdk.ts run with node_modules absent: bumps alpha.45 → alpha.51, is a no-op on the second run, exits 1 on an unknown dist-tag.
The build, pack, cross-compile and artifact steps are unchanged from the earlier single-file version, which ran end to end in dry-run mode: https://github.com/aws/agentcore-cli/actions/runs/33810416086 (artifact held aws-agentcore-1.0.0-rc.0.tgz with the stamped version and six binaries). The release PR path also ran end to end then: https://github.com/aws/agentcore-cli/actions/runs/33810398072 opened chore(release): v1.0.0 #2203, and https://github.com/aws/agentcore-cli/actions/runs/33816972577 re-dispatched against an existing PR without failing.
After the telemetry fix, a local bundle stamped 1.0.0-rc.0 runs --version and exits 0.

Review fixes after the rebuild

Release notes only consider this workflow's own tags (vX.Y.Z and vX.Y.Z-rc.N). Without the filter, the first rc's notes would have started at main's v1.0.0-preview.29, which sorts just below 1.0.0-rc.0. Verified against the real tag list: 1.0.0-rc.0 and 1.0.0 start at v0.28.1, 1.0.0-rc.1 at v1.0.0-rc.0, 1.1.0-rc.0 at v1.0.0.
gh release create is rerun-safe: if the release already exists the step re-uploads assets with --clobber instead of failing on the tag.
The package rename is followed through: pr-automation.yml's PR tarball step and the README looked for agentcore-*.tgz, Bun names a scoped tarball aws-agentcore-*.tgz.

Before the first real release

Add NPM_TOKEN as a repo secret (granular token with publish rights on @aws/agentcore). The Trusted Publisher stays bound to release-main-and-preview.yml on main.
release-prepare.yml becomes dispatchable once refactor lands on main, or once the file exists there.
Publishing 1.0.0 to latest will supersede main's 0.28.x line and sort above its preview tag.
Runner allowlisting for a dedicated release runner, if we want one, with @aidandaly24.

Follow-ups, not in this PR

src/handlers/update/index.tsx maps any prerelease to dist-tag preview and compares against latest, so rc users would not be offered a newer rc by agentcore update.
A telemetry attribute validation failure takes the whole CLI down. Telemetry should degrade, not crash.
The vended CDK pin bump lands in the release PR, so any template incompatibility with a newer @aws/agentcore-cdk surfaces as red CI on that PR.

- release.yml: workflow_dispatch (bump, channel, dry_run) publishes <next>-rc.N under the rc dist-tag after approval, or opens a release PR whose merge publishes under latest. rc numbers derive from tags, never commits. - package.json: publish as @aws/agentcore, version tracks the last stable release (0.28.1), repository field required for npm provenance. - update.test.ts: read the version from constants instead of a literal.

…other job

…ersion, drop redundant setup

…schema The rc dry run's binary printed its version and then exited 1: service.version was validated against ^\d+\.\d+\.\d+$, so any -rc.N build crashed at startup.

agentcore-devx-automation

AgentCore Harness Review

Verdict: Looks good

Reviewed the release workflow, the package.json rename to @aws/agentcore, and the update.test.ts refactor to use PACKAGE_VERSION. The design is clean: version resolution is centralized in one job, rc numbers are derived from tags (keeping package.json as the stable-only source of truth), the pull_request re-entry pattern properly gates stable publishes on human merge review, and packing happens before compile so the tarball never carries the platform binaries.

A few small things worth verifying before this workflow runs against main, but none block merging the PR:

The scaffolding assumes bun pm version <bump> --no-git-tag-version prints the new tag with a v prefix (${BASE#v} and refs/tags/$BASE both rely on that). Worth confirming on the first dry-run — if Bun ever drops the prefix, BASE="v..." becomes X.Y.Z, the tag-existence guard silently misses, and downstream tags/notes go out with a wrong prefix.
PREVIOUS="v$(git tag -l 'v*' | xargs bunx semver@7 --range \"<$VERSION\" | tail -1)" degenerates to PREVIOUS="v" if there are no matching prior tags (i.e. a truly-first stable release). gh api generate-notes and gh release create --notes-start-tag v would fail on that. Not reachable given 0.28.1 already exists, just something to be aware of.
release-pr uses gh pr create, which errors if a PR for release/vX.Y.Z is already open. The --force push updates the branch but won't refresh the PR title/body. Fine for the normal path; just means re-dispatching the same stable bump requires closing the old PR first.
if: github.event_name == 'workflow_dispatch' || ... on the version job doesn't restrict workflow_dispatch to any branch, so a stable dispatch from a non-refactor branch will open a release PR against that branch but the pull_request re-entry (branches: [refactor]) won't fire on merge. Presumably harmless during the refactor phase — worth tightening when the TODO to switch to main is picked up.

Telemetry guidance doesn't apply here (CI-only change), and the test change is a straightforward improvement over hardcoded "1.0.0".

agentcore-devx-automation · 2026-09-03T22:33:05Z

Claude Security Review: no high-confidence findings. (run)

agentcore-devx-automation · 2026-09-03T22:38:01Z

Claude Security Review: no high-confidence findings. (run)

codecov-commenter · 2026-09-03T22:38:38Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.09%. Comparing base (ef32ae3) to head (59fa397).
⚠️ Report is 14 commits behind head on refactor.

Additional details and impacted files

@@            Coverage Diff            @@
##           refactor    #2206   +/-   ##
=========================================
  Coverage     97.09%   97.09%           
=========================================
  Files           544      544           
  Lines         37794    37794           
=========================================
  Hits          36695    36695           
  Misses         1099     1099

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

…lish job - concurrency keyed on the resolved version at the publish job, so a closed unrelated PR can no longer cancel a pending stable publish - skip npm publish when the version is already on npm, so a rerun after a failed release step completes instead of failing on the republish - re-dispatching stable edits the existing release PR instead of failing - cap service.version length like every other telemetry attribute

agentcore-devx-automation · 2026-09-03T23:19:24Z

Claude Security Review: no high-confidence findings. (run)

Hweinstock

I kind of like how the python sdk does this with two workflows. In this case, it might look something like:

prepare-release.yml takes in the versionBumpType and releaseChannel, and prepares a PR for the release on a branch with release/<channel>/<version> or some pattern so that we can extract it below.
release.yml triggers on closed PRs that follow release// from the GH bot. This could just run the build/check and release.

The main difference is we always get a PR to gate releases consistently, and the workflow triggers are much simpler.

Hweinstock · 2026-09-03T22:35:32Z

-  "name": "agentcore",
-  "version": "1.0.0",
+  "name": "@aws/agentcore",
+  "version": "0.28.1",


are we releasing under 1.0.0-rc or the previous version number?

I think we want to do 1.0.0-rc.1

Hweinstock · 2026-09-03T22:59:01Z

+        type: choice
+        options: [major, minor, patch]
+      channel:
+        description: rc publishes after approval, stable opens a release PR


would it be simpler to always open a PR? That also allows us to see the releases in the commit history and gives a consistent way to approve releases.

I agree about this. This pr would also update the cdk-contruct version on the project's agentcore.json using this pr like here

Hweinstock · 2026-09-03T23:05:30Z

+jobs:
+  version:
+    if: github.event_name == 'workflow_dispatch' || (github.event.pull_request.merged && startsWith(github.head_ref, 'release/'))
+    runs-on: codebuild-agentcore-e2e-${{ github.run_id }}-${{ github.run_attempt }}


don't we need to do some allowlisting for this to work on the codebuild runners? I remember @aidandaly24 mentioning something recently.

…lease goes through a PR - release-prepare.yml: dispatch with bump and channel, bumps package.json with bun pm version (rc series continue with prerelease and graduate by stripping the suffix, since Bun's major would jump an rc to the next major), refreshes the vended @aws/agentcore-cdk pin, opens release/v<version> via the App - release-publish.yml: on merged release PRs, runs check/build/unit-test then publishes with provenance from a GitHub-hosted runner and creates the release. workflow_dispatch with dry_run for verification - scripts/sync-vended-cdk.ts: Bun port of the main-branch pin sync - no environments, no concurrency groups, no tag-derived rc numbering

agentcore-devx-automation · 2026-09-04T01:26:34Z

Claude Security Review: no high-confidence findings. (run)

… install

agentcore-devx-automation · 2026-09-04T01:34:59Z

Claude Security Review: no high-confidence findings. (run)

…e creation rerun-safe Also follow the package rename through: the PR tarball job and the README looked for agentcore-*.tgz, Bun names a scoped tarball aws-agentcore-*.tgz.

agentcore-devx-automation · 2026-09-04T01:49:29Z

Claude Security Review: no high-confidence findings. (run)

AlexanderRichey · 2026-09-04T03:16:53Z

+release-publish.yml (npm publish and GitHub release when a release PR merges)
+  |-- check.yml
+  |-- build.yml
+  `-- unit-test.yml


Can we take the opportunity to put all of these in one. That will be much more efficient and will save time.

Harrison and TJ seemed to think that the release workflow
From the SDKs made a lot of sense. So I restructured it to be like those, it was originally one file.

Let's discuss

I think alex's comment is in reference to the check/build/unit-test workflows which are always run together, so I think the suggestion is to make it a single workflow containing check, build, and unit-test as jobs.

My understanding is that the runtime behavior would be the same, but we no longer need to manually wire in each job as a separate call. Instead, we call a single workflow that triggers all three, so it'd simplify some of the changes here.

Hweinstock · 2026-09-04T03:34:01Z

+    types: [closed]
+    # TODO: switch to main once the refactor lands there.
+    branches: [refactor]
+  workflow_dispatch:


why do we need workflow dispatch here?

Hweinstock · 2026-09-04T04:00:35Z

+release-publish.yml (npm publish and GitHub release when a release PR merges)
+  |-- check.yml
+  |-- build.yml
+  `-- unit-test.yml


I think alex's comment is in reference to the check/build/unit-test workflows which are always run together, so I think the suggestion is to make it a single workflow containing check, build, and unit-test as jobs.

My understanding is that the runtime behavior would be the same, but we no longer need to manually wire in each job as a separate call. Instead, we call a single workflow that triggers all three, so it'd simplify some of the changes here.

tejaskash added 3 commits September 3, 2026 17:14

ci(release): run the approval job on the CodeBuild runner like every …

aadd9a6

…other job

ci(release): gate publish with the environment directly, use bun pm v…

126ddf9

…ersion, drop redundant setup

github-actions Bot added the size/m PR size: M label Sep 3, 2026

agentcore-devx-automation Bot added the agentcore-harness-reviewing AgentCore Harness review in progress label Sep 3, 2026

fix(telemetry): accept prerelease versions in the resource attribute …

c967ad3

…schema The rc dry run's binary printed its version and then exited 1: service.version was validated against ^\d+\.\d+\.\d+$, so any -rc.N build crashed at startup.

agentcore-devx-automation Bot added the claude-security-reviewing Claude Code /security-review in progress label Sep 3, 2026

github-actions Bot added size/m PR size: M and removed size/m PR size: M labels Sep 3, 2026

agentcore-devx-automation Bot reviewed Sep 3, 2026

View reviewed changes

agentcore-devx-automation Bot removed the agentcore-harness-reviewing AgentCore Harness review in progress label Sep 3, 2026

agentcore-devx-automation Bot added claude-security-reviewing Claude Code /security-review in progress and removed claude-security-reviewing Claude Code /security-review in progress labels Sep 3, 2026

agentcore-devx-automation Bot removed the claude-security-reviewing Claude Code /security-review in progress label Sep 3, 2026

tejaskash had a problem deploying to npm-publish-approval September 3, 2026 22:39 — with GitHub Actions Error

github-actions Bot added size/m PR size: M and removed size/m PR size: M labels Sep 3, 2026

agentcore-devx-automation Bot added the claude-security-reviewing Claude Code /security-review in progress label Sep 3, 2026

agentcore-devx-automation Bot removed the claude-security-reviewing Claude Code /security-review in progress label Sep 3, 2026

github-actions Bot added size/m PR size: M and removed size/m PR size: M labels Sep 3, 2026

tejaskash had a problem deploying to npm-publish-approval September 3, 2026 23:25 — with GitHub Actions Error

Hweinstock reviewed Sep 3, 2026

View reviewed changes

github-actions Bot added size/m PR size: M and removed size/m PR size: M labels Sep 4, 2026

agentcore-devx-automation Bot added the claude-security-reviewing Claude Code /security-review in progress label Sep 4, 2026

agentcore-devx-automation Bot removed the claude-security-reviewing Claude Code /security-review in progress label Sep 4, 2026

ci(release): make sync-vended-cdk dependency-free, it runs before bun…

a9ed7b2

… install

tejaskash changed the title ~~ci: add release workflow for rc and stable npm publishing~~ ci: add release-prepare and release-publish workflows for npm releases Sep 4, 2026

github-actions Bot added size/m PR size: M and removed size/m PR size: M labels Sep 4, 2026

agentcore-devx-automation Bot added the claude-security-reviewing Claude Code /security-review in progress label Sep 4, 2026

agentcore-devx-automation Bot removed the claude-security-reviewing Claude Code /security-review in progress label Sep 4, 2026

ci(release): scope release notes to this workflow's tags, make releas…

59fa397

…e creation rerun-safe Also follow the package rename through: the PR tarball job and the README looked for agentcore-*.tgz, Bun names a scoped tarball aws-agentcore-*.tgz.

github-actions Bot added size/m PR size: M and removed size/m PR size: M labels Sep 4, 2026

agentcore-devx-automation Bot added the claude-security-reviewing Claude Code /security-review in progress label Sep 4, 2026

agentcore-devx-automation Bot removed the claude-security-reviewing Claude Code /security-review in progress label Sep 4, 2026

AlexanderRichey requested changes Sep 4, 2026

View reviewed changes

Hweinstock reviewed Sep 4, 2026

View reviewed changes

Uh oh!

Conversation

tejaskash commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Review fixes after the rebuild

Before the first real release

Follow-ups, not in this PR

Uh oh!

agentcore-devx-automation Bot left a comment

Choose a reason for hiding this comment

AgentCore Harness Review

Uh oh!

agentcore-devx-automation Bot commented Sep 3, 2026

Uh oh!

agentcore-devx-automation Bot commented Sep 3, 2026

Uh oh!

codecov-commenter commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

agentcore-devx-automation Bot commented Sep 3, 2026

Uh oh!

Hweinstock left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Hweinstock Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

agentcore-devx-automation Bot commented Sep 4, 2026

Uh oh!

agentcore-devx-automation Bot commented Sep 4, 2026

Uh oh!

agentcore-devx-automation Bot commented Sep 4, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

tejaskash commented Sep 3, 2026 •

edited

Loading

codecov-commenter commented Sep 3, 2026 •

edited

Loading

Hweinstock left a comment •

edited

Loading

Hweinstock Sep 3, 2026 •

edited

Loading