fix: release branch npm retry + semver comparison issues by deepshekhardas · Pull Request #7 · deepshekhardas/trigger.dev

deepshekhardas · 2026-05-12T05:25:16Z

Fixes for PR triggerdotdev#3530:\n\n- enhance-release-pr.mjs: Fix dead try/catch block (Promise only calls resolve), use proper semver comparison instead of naive cmp function\n- release.yml: Add retry loop for npm view to handle transient registry failures. Previously silent npm errors were treated as "no latest yet", which incorrectly promoted lagged hotfixes to :latest. Now distinguishes between "npm unreachable" (fail fast) vs "no latest yet" (0.0.0 fallback).

Summary by cubic

Fixes release version detection and npm registry flakiness in the release pipeline to stop bad :latest promotions and stalled releases. Also hardens CI/release with pinned actions and vouch gating, and ships supervisor compute/tracing upgrades plus stability fixes across workers and server paths.

Bug Fixes
- scripts/enhance-release-pr.mjs: proper semver comparison; remove dead try/catch.
- release.yml: retry/backoff for npm view; distinguish “registry unreachable” (fail fast) vs “no latest yet” (fallback to 0.0.0).
- Dev workers: prevent 100% CPU spin after CLI disconnect by guarding IPC sends, exiting on process.disconnect, and dropping packets when the channel is closed (.changeset/dev-worker-disconnect-loop.md).
- Fail attempts on uncaughtException instead of drifting to max duration; runs fail fast and respect retry policy (.changeset/uncaught-exception-fail-attempt.md).
- Supervisor and server stability: add compute workload manager with OTLP trace emission and delayed snapshot wheel; Kubernetes scheduling affinity for schedule-originated trees; map TASK_RUN_UNCAUGHT_EXCEPTION to failed status; and targeted fixes like sanitizing API 500s, Redis READONLY/LOADING reconnect, instant LLM pricing reload, per‑org stream basins, run-view inspector Firefox glitch fix, dev CLI disconnect auto-cancel endpoint, and session auto‑logout (.server-changes/*).
CI/Release
- Pin GitHub Actions to SHAs; add workflow-checks.yml (actionlint + zizmor), claude-md-audit.yml, and vouch gating (vouch-check-pr.yml, vouch-manage-by-issue.yml, .github/VOUCHED.td, .vouch.yml).
- Extend automation: trigger changesets-pr.yml on release/** and .server-changes/**; create a single unified GitHub release and update it after images push; add dependabot.yml for actions.
- Improve publish flows (publish*.yml): new is_latest input, better tagging, optional Sentry token; pass DockerHub creds to tests; add e2e-webapp.yml; unify Helm prerelease workflow (helm-prerelease.yml).

^{Written for commit fccc2fc. Summary will update on new commits. Review in cubic}

Lets us ship a patch (e.g. 4.4.6) from a release/4.4.x branch without including unreleased work merged into main, and without the patch clobbering floating tags incorrectly. The release-pipeline pieces this touches and how each behaves now: npm dist-tag latest if version > current latest, else release-<M.m> Docker :v4-beta same gate (highest version only) Docker :release-X.Y new per-line floating tag, always set on a semver build GitHub release --latest=true|false set explicitly (no auto-detect) How the gate is computed: release.yml's 'Compare new version to current latest' step queries npm view @trigger.dev/sdk dist-tags.latest, compares via sort -V, sets is_latest=true|false. Drives every floating tag. Triggers / refs: - pull_request:branches[main, release/**] - if-conditions allow head.ref starting with 'changeset-release/' - workflow_dispatch ref must be reachable from main OR a release/* branch - changesets-pr.yml fires on push to release/** too; PR-enhance step discovers source branch dynamically (no more hardcoded changeset-release/main) Other changes: - gh release create: drop --target main (tag carries right commit) - dispatch-changelog payload includes is_latest so the marketing site can render lagged-line releases differently - enhance-release-pr.mjs prepends a Release prep header on release/* branches showing version, current latest, and whether the PR will take the latest dist-tag release-helm.yml unchanged — already creates as draft+prerelease so it can't claim Latest. publish-worker.yml (coordinator/provider) unchanged since those don't have a :v4-beta-equivalent floating tag. Validated end-to-end in ericallam/pkgring-sandbox across both scenarios: Scenario A (lagged hotfix): latest stays put, only release-X.Y moves Scenario B (main has unreleased work, hotfix is highest): latest moves

- enhance-release-pr.mjs: fix dead try/catch, use proper semver comparison - release.yml: add retry loop for npm view to prevent silent failures incorrectly promoting lagged hotfix to :latest


      - name: Setup node
-        uses: buildjet/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0


        id: release
-        uses: softprops/action-gh-release@v1
-        if: github.event_name == 'push'
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0


cubic-dev-ai

1 issue found across 1164 files

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".server-changes/dev-cli-disconnect-md">

<violation number="1" location=".server-changes/dev-cli-disconnect-md:1">
P1: File extension typo: `dev-cli-disconnect-md` should be `dev-cli-disconnect.md`. The hyphen before `md` prevents this file from being recognized as a markdown file, so it will be silently skipped during release note generation.</violation>
</file>

_{Note: This PR contains a large number of files. cubic only reviews up to 100 files per PR, so some files may not have been reviewed. cubic prioritizes the most important files to review.

On a pro plan you can use ultrareview for larger PRs.
Re-trigger cubic}

cubic-dev-ai · 2026-05-16T03:28:25Z

@@ -0,0 +1,6 @@
+---


P1: File extension typo: dev-cli-disconnect-md should be dev-cli-disconnect.md. The hyphen before md prevents this file from being recognized as a markdown file, so it will be silently skipped during release note generation.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .server-changes/dev-cli-disconnect-md, line 1: <comment>File extension typo: `dev-cli-disconnect-md` should be `dev-cli-disconnect.md`. The hyphen before `md` prevents this file from being recognized as a markdown file, so it will be silently skipped during release note generation.</comment> <file context> @@ -0,0 +1,6 @@ +--- +area: webapp +type: feature </file context>

cubic-dev-ai

2 issues found across 4 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/webapp/app/v3/otlpAttributeLimits.ts">

<violation number="1" location="apps/webapp/app/v3/otlpAttributeLimits.ts:96">
P1: Backstop deletion order only includes exact prefix keys, so matched nested AI attribute keys are never removed.</violation>
</file>

<file name="apps/webapp/app/services/replicationErrorRecovery.server.ts">

<violation number="1" location="apps/webapp/app/services/replicationErrorRecovery.server.ts:31">
P2: This new replication recovery module is currently unused, so none of its reconnect/exit behavior is applied at runtime.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
Re-trigger cubic}

cubic-dev-ai · 2026-05-16T03:39:24Z

+    }
+  }
+
+  const sortedAiKeys = dropPriority.filter((k) => aiKeys.has(k));


P1: Backstop deletion order only includes exact prefix keys, so matched nested AI attribute keys are never removed.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/webapp/app/v3/otlpAttributeLimits.ts, line 96: <comment>Backstop deletion order only includes exact prefix keys, so matched nested AI attribute keys are never removed.</comment> <file context> @@ -0,0 +1,115 @@ + } + } + + const sortedAiKeys = dropPriority.filter((k) => aiKeys.has(k)); + + for (const key of sortedAiKeys) { </file context>

cubic-dev-ai · 2026-05-16T03:39:24Z

+  dispose(): void;
+};
+
+export function createReplicationErrorRecovery(


P2: This new replication recovery module is currently unused, so none of its reconnect/exit behavior is applied at runtime.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/webapp/app/services/replicationErrorRecovery.server.ts, line 31: <comment>This new replication recovery module is currently unused, so none of its reconnect/exit behavior is applied at runtime.</comment> <file context> @@ -0,0 +1,162 @@ + dispose(): void; +}; + +export function createReplicationErrorRecovery( + deps: ReplicationErrorRecoveryDeps +): ReplicationErrorRecovery { </file context>

ericallam and others added 5 commits May 11, 2026 10:08

ci(release): combine GITHUB_OUTPUT writes into a single block (SC2129)

64309e5

docs(scripts): add JSDoc to enhance-release-pr.mjs new/changed functions

b0e4550

docs(scripts): JSDoc the remaining functions in enhance-release-pr.mjs

fdb1119

fix: release branch issues - npm retry + semver comparison

5f73a3f

- enhance-release-pr.mjs: fix dead try/catch, use proper semver comparison - release.yml: add retry loop for npm view to prevent silent failures incorrectly promoting lagged hotfix to :latest

github-advanced-security AI found potential problems May 12, 2026

View reviewed changes

Fix release workflow indentation and version comparison

9c3a802

cubic-dev-ai Bot reviewed May 16, 2026

View reviewed changes

Fix error handling gaps in recent releases

fccc2fc

cubic-dev-ai Bot reviewed May 16, 2026

View reviewed changes

deepshekhardas force-pushed the main branch from d35bf04 to 4e919e7 Compare June 17, 2026 09:51

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: release branch npm retry + semver comparison issues#7

fix: release branch npm retry + semver comparison issues#7
deepshekhardas wants to merge 7 commits into
mainfrom
fix/pr-3530-release-branch

deepshekhardas commented May 12, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

cubic-dev-ai Bot May 16, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

cubic-dev-ai Bot May 16, 2026

Uh oh!

cubic-dev-ai Bot May 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

deepshekhardas commented May 12, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot May 16, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot May 16, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot May 16, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

deepshekhardas commented May 12, 2026 •

edited by cubic-dev-ai Bot

Loading