From 26938bdb140bcdcb82d3f5d8c3a5aecb2e453754 Mon Sep 17 00:00:00 2001
From: t <t@t>
Date: Thu, 8 Oct 2026 09:20:51 +0530
Subject: [PATCH] chore: release.sh gates on GitHub CI for the exact commit

Today's release waited hours on a green local CI that kept failing on
host-load timeouts while the same commit was green on GitHub CI, and the
script also refused once main moved past the release commit. It now
requires the CI workflow run for the exact sha to be green (the
authoritative CI) and the commit to be on origin/main, runs the release
gate on request (--gate), and no longer calls scripts/ci.sh, which #1630
removes.

Claude-Session: https://claude.ai/code/session_01SZ72LSPAo4NvYvBDSD6RLo
---
 scripts/release.sh | 45 ++++++++++++++++++++++++++++-----------------
 1 file changed, 28 insertions(+), 17 deletions(-)

diff --git a/scripts/release.sh b/scripts/release.sh
index f528b2577..daa059789 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -7,12 +7,13 @@
 # The flow, end to end:
 #   1. A release PR (branch chore/release-*, title "chore: release ...")
 #      bumps the versions; the pre-commit hook writes changelog/<pkg>/<v>.md.
-#   2. `scripts/ci-merge.sh <N> --release` runs the full local list plus the
-#      release gate on the PR head and squash-merges it when green.
-#   3. `scripts/release.sh` on the merged main (this script):
-#        - finds the changelog files the head commit added (or takes paths),
-#        - refuses unless local CI is green on that commit (runs
-#          `scripts/ci.sh --release` unless a PASS marker already exists),
+#   2. The PR merges on green GitHub CI, like any PR, after
+#      `node scripts/release-gate.mjs` passed on its head.
+#   3. `scripts/release.sh` on the merged release commit (this script):
+#        - finds the changelog files the commit added (or takes paths),
+#        - refuses unless GitHub CI is green on that exact commit (the CI
+#          workflow run for the sha, all required checks passing) and the
+#          commit is on origin/main; main may have moved on since,
 #        - pushes the tag publish-<sha12>, which triggers release.yml to
 #          publish exactly those packages to npm and GitHub Packages and
 #          lockstep-publish the wrappers when cli moved,
@@ -22,9 +23,10 @@
 #          (scripts/purge-cdn.sh).
 #   Every step is idempotent, so re-running after a partial failure is safe.
 #
-#   scripts/release.sh                      # the head commit of origin/main
+#   scripts/release.sh                      # the checked-out release commit
 #   scripts/release.sh changelog/core/0.7.65.md changelog/cli/0.10.70.md
 #   scripts/release.sh --no-purge           # skip the CDN purge
+#   scripts/release.sh --gate               # also run scripts/release-gate.mjs here first
 #
 # Credentials stay where they are: gh's login (tag push, releases), the npm
 # registry is only read, CLOUDFLARE_API_TOKEN for the purge. Nothing here
@@ -34,10 +36,11 @@ set -euo pipefail
 REPO="webjsdev/webjs"
 cd "$(git rev-parse --show-toplevel)"
 
-purge=1 files=()
+purge=1 gate=0 files=()
 for a in "$@"; do
   case "$a" in
     --no-purge) purge=0 ;;
+    --gate) gate=1 ;;
     -h|--help) sed -n '2,33p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
     changelog/*.md) files+=("$a") ;;
     *) echo "release: unknown argument '$a'" >&2; exit 2 ;;
@@ -45,10 +48,10 @@ for a in "$@"; do
 done
 
 git fetch -q origin main --tags
-sha="$(git rev-parse origin/main)"
-[ "$(git rev-parse HEAD)" = "$sha" ] || {
-  echo "release: check out origin/main first (HEAD is $(git rev-parse --short=12 HEAD), main is ${sha:0:12}); a detached worktree is fine:" >&2
-  echo "  git worktree add --detach ../webjs-release origin/main && cd ../webjs-release && npm ci" >&2
+sha="$(git rev-parse HEAD)"
+git merge-base --is-ancestor "$sha" origin/main || {
+  echo "release: HEAD ${sha:0:12} is not on origin/main; check out the merged release commit (a detached worktree is fine):" >&2
+  echo "  git worktree add --detach ../webjs-release <sha> && cd ../webjs-release && npm ci" >&2
   exit 2
 }
 [ -z "$(git status --porcelain --untracked-files=no)" ] || { echo "release: the tree has uncommitted changes" >&2; exit 2; }
@@ -59,12 +62,20 @@ fi
 [ ${#files[@]} -gt 0 ] || { echo "release: HEAD adds no changelog/<pkg>/<version>.md; nothing to release"; exit 0; }
 echo "release: ${sha:0:12} releases:"; printf '  %s\n' "${files[@]}"
 
-# 1. The gate, on the exact commit being published.
-if [ -f "${TMPDIR:-/tmp}/webjs-ci-${sha:0:12}/PASS" ]; then
-  echo "release: local CI already green on ${sha:0:12}"
-else
-  bash scripts/ci.sh --release
+# 1. The gate, on the exact commit being published: GitHub CI green on this
+#    sha (the authoritative CI), and the release gate when asked for.
+ci_run="$(gh run list --repo "$REPO" --workflow ci.yml --commit "$sha" --limit 1 --json databaseId,status,conclusion -q '.[0] | "\(.databaseId) \(.status) \(.conclusion)"' 2>/dev/null || true)"
+read -r ci_id ci_status ci_conclusion <<<"${ci_run:-"" "" ""}"
+if [ -z "$ci_id" ]; then
+  echo "release: no GitHub CI run for ${sha:0:12}; it runs on the PR and on the push to main. Dispatch one with: gh workflow run ci.yml --repo $REPO --ref main" >&2
+  exit 1
+fi
+if [ "$ci_status" != completed ] || [ "$ci_conclusion" != success ]; then
+  echo "release: GitHub CI run $ci_id for ${sha:0:12} is $ci_status/$ci_conclusion; wait for it or rerun its failed jobs: gh run rerun $ci_id --repo $REPO --failed" >&2
+  exit 1
 fi
+echo "release: GitHub CI green on ${sha:0:12} (run $ci_id)"
+if [ "$gate" = 1 ]; then node scripts/release-gate.mjs; fi
 
 # 2. The tag that makes release.yml publish. The workflow diffs HEAD~1..HEAD
 #    at the tag, so it publishes exactly what this commit added.