[github-actions]

Release 8.0.0

This PR was created by the Create Release Branch workflow.

Checklist

• Release notes reviewed and finalized
• Selected SDK versions verified
• RC published and validated
• Final release published via Release workflow

Note: This PR will be merged automatically by the Release workflow upon final release.

RC1 passed the Release workflow at source 34e6d361aeae2b4f7eee96c4d3359ed2f2c15b0d. Node, Browser, Agent, Android, iOS, and the backend are public at 8.0.0-rc1. Public package archives and registry metadata are verified. The backend image contains Linux amd64 and arm64. All six installed Node package platform tests passed. The RC docs are merged in #4450 and deployed.

Branch update (2026-10-14)

This PR now targets main, and main is merged into the branch (b6b4d3291e). The release workflow fixes that were made on this branch are already on main: ff6109b5e0 (#4456 and the npm tag fixes) landed them, and later commits hardened them further. The merge kept main's version of npm-publish.yml, push-release-tag.yml, and dev/tests/test_release_push.py. The PR diff is now only docs/release-notes/release-8.0.0.json.

Checked on the merged tree:

• Every SDK caller (Android, iOS, Node, Browser, Agent, CLI) resolves the source SHA in check-release-push, then checks out, builds, publishes, and tags that SHA. Version classification still uses the requested ref.
• npm-publish checks that HEAD and the prepared tag match the source SHA, and pushes the tag in the separate push-release-tag job.
• push-release-tag accepts all six SDKs.
• dev/tests/test_release_push.py and dev/tests/test_ci_suites.py pass (28 tests).
• The SDK manifests are still at 8.0.0 and libxmtp is still at 1.12.0-dev, matching the release record. Its sourceCommit is on this branch.

Note

Rework release workflows to resolve source SHA in preflight and isolate tag pushes

Adds a shared preflight job to all SDK release workflows (node, browser, agent, CLI, iOS, Android). The preflight resolves the requested ref to a commit SHA; setup, build, and publish jobs then check out that fixed SHA, and version classification still uses the requested ref.

• npm-publish.yml now has read-only contents permission, creates release tags locally as validated Git bundles, and pushes them via a separate push-release-tag job instead of from the publish job.
• push-release-tag.yml accepts four new SDK identifiers: node-sdk, browser-sdk, agent-sdk, and cli.
• check-release-push.yml gains a dry-run input that skips GitHub App token creation.
• Adds extensive test coverage in test_release_push.py for tag preparation, dry-run isolation, and preflight-pinned checkouts, plus release metadata in release-8.0.0.json.
• Behavioral Change: non-dry-run npm releases now fail if checkout HEAD or the prepared tag does not match the preflight source SHA; Android and iOS version classification switches from the preflight SHA output to the requested workflow ref.

^{Macroscope summarized d94bf17.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The diff adds only release metadata and does not change library runtime code, but the required validation evidence is incomplete: several checks were skipped and the repository Lint and Test checks failed. Human review is therefore needed before merging.

Not approved because:

• Insufficient credits. Approvability relies on correctness review in order to determine eligibility

No code changes detected at d94bf17. Prior analysis still applies.

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}