[lilyshen0722]

"Package Version Guard" has failed on every main push since 22:43Z: npm-artifact-diff: npm pack failed in cli — @commonlyai/seats is not installed in cli/node_modules. Since #2739 the cli bundles packages/seats, and its prepack refuses to pack without node_modules/@commonlyai/seats. The guard checked out the tagged commit and packed with no install.

The fix runs the same npm ci --ignore-scripts in the package dir that npm-publish.yml runs before its own compare, right after the guard checks out the tagged commit.

Verified locally at cli-v0.1.180 (d0681dc): npm ci --ignore-scripts in cli/, then scripts/npm-artifact-diff.sh cli 0.1.180 gives "this tree packs the same files as 0.1.180", exit 0. The guard isn't a merge gate; after merge, the next main push's run should be green.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VD3azQJZrdMmw8g51iscWD

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Team-Commonly/commonly
• Branch: main
• File: .coderabbit.yaml
• Commit: d0681dc
• Layers: Repository YAML
• Review profile: QUIET
• Plan: Advanced
• Run ID: f494152e-f3ae-484d-8e41-d2b7bc00324f

Commits

Reviewing files that changed from the base of the PR and between d0681dc and 7f9a0cd.

Files selected for processing: 1

• .github/workflows/package-version-guard.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

Walkthrough

The package-version guard now installs the selected package’s dependencies with npm ci --ignore-scripts before comparing its packed artifact with the npm registry version.

Changes: Package Artifact Version Guard

Layer / File(s)	Summary
Install dependencies before artifact comparison .github/workflows/package-version-guard.yml	The workflow runs npm ci --ignore-scripts in the selected package directory before comparing artifacts. The comments note that the CLI’s prepack requires node_modules/@commonlyai/seats.

Priority: Low

Estimated code review effort: 2 (Simple) | ~7 minutes

Change: Bug fix

Possibly related PRs

• Team-Commonly/commonly#2610: Introduced the artifact comparison that this workflow change updates.
• Team-Commonly/commonly#2739: Added the CLI dependency and prepack check that the new install step supports.
• Team-Commonly/commonly#2672: Added the bundled dependency and a dependency installation step before a related artifact comparison.

Merge Risk: Minimal · up to 7f9a0

The dependency setup matches the package version guard’s prepack requirements, with no actionable merge-blocking risk identified.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title names the change: it adds an install step so the package is installed before the version guard packs it. It matches the single workflow change, which runs npm ci --ignore-scripts before th…
Description check		The description explains the failure: the Package Version Guard fails on main pushes because @commonlyai/seats is not installed in cli/node_modules, and the CLI's prepack refuses to pack without…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the change: it adds an install step so the package is installed before the version guard packs it. It matches the single workflow change, which runs npm ci --ignore-scripts before the packed artifact is compared with the registry version. The title is specific and uses the conventional fix(ci): prefix.

Full details: Description check

Explanation

The description explains the failure: the Package Version Guard fails on main pushes because @commonlyai/seats is not installed in cli/node_modules, and the CLI's prepack refuses to pack without it. It states that the fix runs the same npm ci --ignore-scripts step that npm-publish.yml uses, and it reports a local verification at cli-v0.1.180. This directly describes the changed workflow.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[lilyshen0722]

Gate on #2764 at 7f9a0cd: PASS.

Checked against the three asks:

1. Install runs on the tagged commit. The step sits after git checkout -q --detach "$sha" (line 130) and before the diff (line 134), so npm ci reads that commit's cli/package-lock.json or commonly-mcp/package-lock.json, not main's.
2. Token posture unchanged. The diff is 3 added lines. permissions: contents: read and persist-credentials: false are untouched, and npm ci needs no credential.
3. commonly-mcp works too. Its lockfile is present at the tag.

Reproduced locally on tagged commits:

• cli-v0.1.180 with npm ci --ignore-scripts in cli/, then scripts/npm-artifact-diff.sh cli 0.1.180: exit 0, "packs the same files as 0.1.180".
• The same diff with no install: exit 2, "@commonlyai/seats is not installed in cli/node_modules". This is the failure the PR fixes.
• mcp-v0.3.21 with npm ci in commonly-mcp/, then the diff against 0.3.21: exit 0.

The step's npm ci and the publish job's npm ci both run in the package directory, so they match.

No defects found. The step runs with set -euo pipefail, so a failed install fails the guard by name.

Written by Rhea, a Commonly agent — https://commonly.me/v2/pods/6a8f6dc7a1dccf2e02f31015

GATE: PASS at 7f9a0cd

[lilyshen0722]

Gate on #2764 at 7f9a0cd: PASS. Re-filed with the verdict on the last line, as the press requires.

Checked against the three asks:

1. Install runs on the tagged commit. The step sits after git checkout -q --detach "$sha" (line 130) and before the diff (line 134), so npm ci reads that commit's cli/package-lock.json or commonly-mcp/package-lock.json, not main's.
2. Token posture unchanged. The diff is 3 added lines. permissions: contents: read and persist-credentials: false are untouched, and npm ci needs no credential.
3. commonly-mcp works too. Its lockfile is present at the tag.

Reproduced locally on tagged commits:

• cli-v0.1.180 with npm ci --ignore-scripts in cli/, then scripts/npm-artifact-diff.sh cli 0.1.180: exit 0, "packs the same files as 0.1.180".
• The same diff with no install: exit 2, "@commonlyai/seats is not installed in cli/node_modules". This is the failure the PR fixes.
• mcp-v0.3.21 with npm ci in commonly-mcp/, then the diff against 0.3.21: exit 0.

The step's npm ci and the publish job's npm ci both run in the package directory, so they match.

No defects found. The step runs with set -euo pipefail, so a failed install fails the guard by name.

Written by Rhea, a Commonly agent — https://commonly.me/v2/pods/6a8f6dc7a1dccf2e02f31015

GATE: PASS