Merge branch 'main' into changeset-release/main

Author: elkaix

.github/workflows/changeset-policy.yml

@@ -0,0 +1,45 @@
+name: Changeset policy
+
+# A major bump renames the release and breaks every pinned consumer, and npm
+# publishes are irreversible. `gen-changesets` already says a major is never an
+# agent's call; this makes that a merge gate rather than a convention.
+#
+# `labeled`/`unlabeled` are listed so adding the approval label re-runs the
+# check instead of leaving a stale red on the pull request.
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+permissions:
+  contents: read
+
+jobs:
+  major-bump-approval:
+    name: Major bump needs approval
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
+        with:
+          # The gate diffs against the base commit, which a shallow clone of
+          # the merge ref alone does not contain.
+          fetch-depth: 0
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # pinned from v7.0.0
+        with:
+          node-version-file: .nvmrc
+
+      # The gate decides what ships, so a silent break in the gate is worse
+      # than a red pull request. Its own cases run first.
+      - name: Self-test the gate
+        run: node scripts/release/check-major-changeset.mjs --self-test
+
+      # Both values reach the script through the environment and are never
+      # interpolated into a shell command. `base.sha` is used rather than the
+      # branch name so no caller-chosen text reaches git at all.
+      - name: Check for an unapproved major changeset
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PR_LABELS_JSON: ${{ toJSON(github.event.pull_request.labels.*.name) }}
+        run: node scripts/release/check-major-changeset.mjs

apps/desktop/scripts/stage-runtime.ts

@@ -57,6 +57,60 @@ export function deployTargetArgument(workspaceRoot: string, target: string): str
   return relative(workspaceRoot, target)
 }
 
+/** How many times the deploy is attempted before the build gives up. */
+export const DEPLOY_ATTEMPTS = 3
+
+/**
+ * Back-off before a retry, in milliseconds, indexed by the retry number.
+ *
+ * `pnpm deploy --legacy` re-resolves from the registry and ignores the
+ * lockfile, so a package published in a partially-propagated state fails the
+ * build even though every pin here is installable. That happened with
+ * `@tanstack/react-query@5.102.3`, whose `query-core` peer of the same version
+ * was not yet resolvable — the desktop packaging gate went red for a package
+ * nothing in the shipped runtime uses.
+ *
+ * A deterministic failure still fails; it just costs the sum of these waits
+ * first. That is the trade: about half a minute added to a genuinely broken
+ * build, against a release gate that no longer turns red because npm was
+ * mid-publish.
+ * @param retry - 1 for the first retry, 2 for the second.
+ * @returns Milliseconds to wait before that retry.
+ */
+export function deployRetryDelayMs(retry: number): number {
+  return retry <= 1 ? 5_000 : 20_000
+}
+
+/**
+ * Run an operation, retrying a failure up to {@link DEPLOY_ATTEMPTS} times.
+ *
+ * `sleep` and `onRetry` are injected so the policy is testable without a real
+ * wait or a real registry.
+ * @param operation - Receives the 1-based attempt number.
+ * @param options - Injected clock and retry reporter.
+ * @returns Nothing; the last failure is rethrown when every attempt fails.
+ */
+export async function withDeployRetries(
+  operation: (attempt: number) => Promise<void>,
+  options: {
+    readonly attempts?: number
+    readonly sleep: (milliseconds: number) => Promise<void>
+    readonly onRetry?: (attempt: number, error: unknown) => void
+  },
+): Promise<void> {
+  const attempts = options.attempts ?? DEPLOY_ATTEMPTS
+  for (let attempt = 1; ; attempt += 1) {
+    try {
+      await operation(attempt)
+      return
+    } catch (error) {
+      if (attempt >= attempts) throw error
+      options.onRetry?.(attempt, error)
+      await options.sleep(deployRetryDelayMs(attempt))
+    }
+  }
+}
+
 async function run(command: string, args: readonly string[]): Promise<void> {
   const invocation = packageManagerInvocation(process.platform, command, args)
   await new Promise<void>((accept, reject) => {
@@ -109,12 +163,21 @@ async function materializeLinks(): Promise<void> {
 async function deploy(target: string): Promise<void> {
   const savedWorkspaceState = existsSync(workspaceState) ? await readFile(workspaceState) : undefined
   try {
-    await run('pnpm', [
-      '--config.verify-deps-before-run=false', '--filter', deployPackage, 'deploy', '--legacy', '--prod',
-      '--config.node-linker=hoisted', '--config.auto-install-peers=false', '--config.link-workspace-packages=true',
-      '--config.allow-unused-patches=true',
-      deployTargetArgument(repositoryRoot, target),
-    ])
+    await withDeployRetries(
+      () => run('pnpm', [
+        '--config.verify-deps-before-run=false', '--filter', deployPackage, 'deploy', '--legacy', '--prod',
+        '--config.node-linker=hoisted', '--config.auto-install-peers=false', '--config.link-workspace-packages=true',
+        '--config.allow-unused-patches=true',
+        deployTargetArgument(repositoryRoot, target),
+      ]),
+      {
+        sleep: (milliseconds) => new Promise(resolve => { setTimeout(resolve, milliseconds) }),
+        onRetry: (attempt, error) => {
+          const reason = error instanceof Error ? error.message : String(error)
+          console.warn(`desktop runtime staging attempt ${attempt} failed, retrying: ${reason}`)
+        },
+      },
+    )
   } finally {
     if (savedWorkspaceState === undefined) await rm(workspaceState, { force: true })
     else await writeFile(workspaceState, savedWorkspaceState)

apps/desktop/tests/stage-runtime.spec.ts

@@ -1,6 +1,12 @@
 import { isAbsolute, join } from 'node:path'
 import { describe, expect, it } from 'vitest'
-import { deployTargetArgument, packageManagerInvocation } from '../scripts/stage-runtime'
+import {
+  DEPLOY_ATTEMPTS,
+  deployRetryDelayMs,
+  deployTargetArgument,
+  packageManagerInvocation,
+  withDeployRetries,
+} from '../scripts/stage-runtime'
 
 describe('package manager invocation', () => {
   it('leaves non-Windows invocations untouched', () => {
@@ -50,3 +56,56 @@ describe('deploy target argument', () => {
     expect(deployTargetArgument('/repo', target)).not.toBe(target)
   })
 })
+
+describe('deploy retries', () => {
+  function recorder() {
+    const waits: number[] = []
+    return { waits, sleep: async (milliseconds: number) => { waits.push(milliseconds) } }
+  }
+
+  it('does not retry a first-attempt success', async () => {
+    const { waits, sleep } = recorder()
+    let calls = 0
+
+    await withDeployRetries(async () => { calls += 1 }, { sleep })
+
+    expect(calls).toBe(1)
+    expect(waits).toEqual([])
+  })
+
+  it('retries a transient failure and resolves', async () => {
+    const { waits, sleep } = recorder()
+    const retried: number[] = []
+
+    await withDeployRetries(
+      async (attempt) => { if (attempt < 3) throw new Error('ERR_PNPM_NO_MATCHING_VERSION') },
+      { sleep, onRetry: (attempt) => retried.push(attempt) },
+    )
+
+    expect(retried).toEqual([1, 2])
+    expect(waits).toEqual([5_000, 20_000])
+  })
+
+  // A deterministic failure must still fail the build, and must surface its own
+  // error rather than a wrapper that hides which command broke.
+  it('rethrows the last failure once the attempts run out', async () => {
+    const { waits, sleep } = recorder()
+    let calls = 0
+
+    await expect(withDeployRetries(
+      async () => { calls += 1; throw new Error(`attempt ${String(calls)} failed`) },
+      { sleep },
+    )).rejects.toThrow('attempt 3 failed')
+
+    expect(calls).toBe(DEPLOY_ATTEMPTS)
+    expect(waits).toHaveLength(DEPLOY_ATTEMPTS - 1)
+  })
+
+  // Ordering alone would accept a 0ms/1ms backoff, which retries faster than a
+  // registry propagates and turns one retry into three failures in a row.
+  it('waits five seconds before the first retry and twenty before the second', () => {
+    expect(deployRetryDelayMs(1)).toBe(5_000)
+    expect(deployRetryDelayMs(2)).toBe(20_000)
+    expect(deployRetryDelayMs(2)).toBeGreaterThan(deployRetryDelayMs(1))
+  })
+})