[chaliy]

Requested by Михайло · project thread

What changed

Publish JS and Publish Web accept an optional tag input on manual dispatch. When it is set, every job builds that release tag's exact commit, using the current workflow definition, and publishes as npm latest:

gh workflow run publish-js.yml   --ref main -f tag=v0.20.1
gh workflow run publish-wasm.yml --ref main -f tag=v0.20.1

• scripts/resolve_publish_source.sh resolves the source commit and dist-tag once in verify-source. Every later checkout uses that SHA, and the publish jobs assert it.
• Guards: the tag must match vX.Y.Z, the workflow ref must be the tag or current main, the source must be reachable from main, and the version must match package.json.
• Without the input, behavior is unchanged: a release-tag ref publishes latest, and any other ref publishes next.
• Publish JS gates a re-published tag with the workflow commit's crates/bashkit-js/__test__. Tests aren't in the tarball, so the shipped bytes are still the tag's. This lets fix(js): unblock npm release by sizing the host-callback timeout for Rosetta #2780's Rosetta timeout fix apply to v0.20.1.

Why

0.20.1 never reached npm (both packages are still on 0.19.0). Re-running at the tag uses the tag's workflow, which still reads the revoked NPM_TOKEN. A plain dispatch from main builds main's code and publishes next. This publishes the real 0.20.1 bytes without a new version.

Before / After

• Before: npm recovery required a patch release (knowledge/operations/release-process.md).
• After: the commands above republish an existing tag. The resolver was run locally against this repo:
  • tag=v0.20.1 from main resolves to 0e9bb551 (v0.20.1) as latest.
  • A plain main dispatch resolves to the main SHA as next.
  • A bad tag, or a workflow ref other than the tag or main, is rejected.

Tests: scripts/tests/test_resolve_publish_source.py (7 cases on a scratch git origin), plus a workflow test that every post-verify checkout uses the resolved SHA. python3 -m unittest discover -s scripts/tests passes, and so do just check-workflow-parity and the doc link check.

Risk

• Medium: this changes the publish workflows. The normal release path (dispatch with --ref vX.Y.Z, no input) resolves to the same SHA and dist-tag as before.
• Overlaying __test__ from main assumes main's tests still target the tag's API. For v0.20.1 the only difference is fix(js): unblock npm release by sizing the host-callback timeout for Rosetta #2780.

Checklist

• Tests added or updated
• Backward compatibility considered

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	4169a6a	Commit Preview URL Branch Preview URL	Oct 29 2026, 10:26 PM

[chaliy]

CI notes for the first push:

• Audit failed on site/pnpm-lock.yaml. Two new moderate advisories for seroval (GHSA-9wx9-5pv9-3349, GHSA-f86p-h4j2-7qgj) came in through solid-js, unrelated to this change; main has the same lockfile. No fix existed, so 75b4bb3 refreshes the lockfile to seroval 1.6.12, which is within solid-js's ~1.6.8 range. Only that lockfile changes, and pnpm audit is clean.
• CodeQL flagged cache poisoning in the build jobs, which restore default-branch caches after checking out the resolved source. bb3257e removes the pnpm, cargo and rust-cache caches from build-js, build-wasm and release-js, so the shipped artifacts build from a clean state.

---

Generated by Claude Code