Skip to content

fix(release): unify component versions at 0.2.0 - #752

Open
mldangelo-oai wants to merge 6 commits into
mainfrom
mdangelo/codex/unify-versions-0.2.0
Open

fix(release): unify component versions at 0.2.0#752
mldangelo-oai wants to merge 6 commits into
mainfrom
mdangelo/codex/unify-versions-0.2.0

Conversation

@mldangelo-oai

@mldangelo-oai mldangelo-oai commented Aug 30, 2026

Copy link
Copy Markdown
Collaborator

Summary

Codex Security currently ships a CLI package, bundled plugin, and MCP server with separate version counters. Move the components to 0.2.0 and keep them synchronized so each product release also refreshes cached plugin installations.

Changes

  • Keep sdk/typescript/package.json as the version source and synchronize the plugin manifest, private MCP package, and Python test-tooling metadata with sync:versions. Check for drift during prepack, including CI and Docker builds.
  • Derive BUNDLED_PLUGIN_VERSION from the package version while preserving the public export and CLI output fields. Verify the bundled manifest, installed SDK exports, CLI, and MCP handshake against the package version.
  • Require container publication to use the same commit as the matching npm release tag. Preserve the existing protected publication workflows and immutable container versions.
  • Document the shared version policy and prepare reviewed 0.2.0 release notes, including the explicit upgrade needed for SDK consumers on ^0.1.x.

Testing

  • Focused version synchronization, container source, package, and release automation checks at 3208788f6c: 304 passed.
  • Required plugin Ruff checks, formatting, and portable source compatibility checks: passed.
  • Component version synchronization check and git diff --check: passed.
  • Full randomized SDK suite at 907037f505 (--seed=3939255787, canonical macOS temporary directory): 2,099 passed, 44 skipped, 1 sandbox-related failure. The process-group check could not run ps inside the execution sandbox; that check passed separately with native process access.
  • Installed-package smoke against the CI-built 0.2.0 archive at 907037f505: passed, including CLI/SDK/plugin/MCP version agreement and nested-worker startup.

Risk and rollout

SDK dependency ranges such as ^0.1.24 require an explicit update to ^0.2.0. This change adds no public CLI arguments and preserves existing version fields. Production dependencies, artifact schemas, database migration versions, historical fixtures, and custom plugin producer versions are unchanged.

Container publication now requires the corresponding npm release tag to exist at the same commit. If main has advanced, create the existing container-vX.Y.Z tag at the npm release commit. External plugin catalogs retain their own publishing process.

Merging the version bump enters the existing CI and protected npm publication process. This PR does not publish packages, create release tags, or publish container images.

Public disclosure review

  • No customer, partner, prospect, or user identities, data, or identifying details are included.
  • No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
  • I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

@github-actions github-actions Bot added the bug Something isn't working label Aug 30, 2026
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Aug 30, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review Completed 2026-08-30T14:11:19.614989Z 727375e Manual request
🔒 Security Review Completed 2026-08-30T14:12:39.315915Z 727375e New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@mldangelo-oai
mldangelo-oai marked this pull request as ready for review August 30, 2026 06:37
@mldangelo-oai
mldangelo-oai requested review from soyeon-oai and a balanced review from Copilot August 30, 2026 06:38

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Unifies Codex Security component versions at 0.2.0 and strengthens release consistency checks.

Changes:

  • Synchronizes SDK, plugin, MCP, and Python metadata versions.
  • Validates packaged artifacts and container release commits.
  • Updates release documentation, notes, and tests.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
sdk/typescript/tests-ts/sync-versions.test.ts Tests version synchronization.
sdk/typescript/tests-ts/container-release-source.test.ts Tests container source validation.
sdk/typescript/src/version.ts Derives plugin version from package version.
sdk/typescript/scripts/sync-versions.mjs Synchronizes component manifests.
sdk/typescript/scripts/smoke-package.mjs Verifies installed version exports and MCP metadata.
sdk/typescript/scripts/check-package.mjs Checks bundled plugin version alignment.
sdk/typescript/package.json Bumps version and adds synchronization scripts.
RELEASING.md Documents the shared version policy.
plugins/codex-security/pyproject.toml Aligns Python tooling metadata.
plugins/codex-security/mcp-app/package.json Aligns MCP package version.
plugins/codex-security/.codex-plugin/plugin.json Aligns plugin manifest version.
docker/verify-container-release-source.sh Validates the npm release commit.
docker/README.md Documents container publication requirements.
.github/workflows/container-release.yml Enforces release-source validation.
.github/release-notes.md Prepares 0.2.0 release notes.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread sdk/typescript/package.json
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 907037f505

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review the current head d9aaac4404b02654840d86c2b6172aa66aa37df5, including the triage eval Codex SDK alignment.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: d9aaac4404

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review the current head 3208788f6c3561562d4ec200a748cbad2321610b.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 3208788f6c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review the current head 727375ec8c99d45fde57dab687bed3bd8aaf7cff.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 727375ec8c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants