fix(release): unify component versions at 0.2.0 - #752
Conversation
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
Pull request overview
Unifies Codex Security component versions at 0.2.0 and strengthens release consistency checks.
Changes:
- Synchronizes SDK, plugin, MCP, and Python metadata versions.
- Validates packaged artifacts and container release commits.
- Updates release documentation, notes, and tests.
Reviewed changes
Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
sdk/typescript/tests-ts/sync-versions.test.ts |
Tests version synchronization. |
sdk/typescript/tests-ts/container-release-source.test.ts |
Tests container source validation. |
sdk/typescript/src/version.ts |
Derives plugin version from package version. |
sdk/typescript/scripts/sync-versions.mjs |
Synchronizes component manifests. |
sdk/typescript/scripts/smoke-package.mjs |
Verifies installed version exports and MCP metadata. |
sdk/typescript/scripts/check-package.mjs |
Checks bundled plugin version alignment. |
sdk/typescript/package.json |
Bumps version and adds synchronization scripts. |
RELEASING.md |
Documents the shared version policy. |
plugins/codex-security/pyproject.toml |
Aligns Python tooling metadata. |
plugins/codex-security/mcp-app/package.json |
Aligns MCP package version. |
plugins/codex-security/.codex-plugin/plugin.json |
Aligns plugin manifest version. |
docker/verify-container-release-source.sh |
Validates the npm release commit. |
docker/README.md |
Documents container publication requirements. |
.github/workflows/container-release.yml |
Enforces release-source validation. |
.github/release-notes.md |
Prepares 0.2.0 release notes. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
@codex review |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Please review the current head |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
This reverts commit d9aaac4.
|
@codex review Please review the current head |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
…/codex/unify-versions-0.2.0
|
@codex review Please review the current head |
|
Codex Review: Didn't find any major issues. Hooray! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Summary
Codex Security currently ships a CLI package, bundled plugin, and MCP server with separate version counters. Move the components to
0.2.0and keep them synchronized so each product release also refreshes cached plugin installations.Changes
sdk/typescript/package.jsonas the version source and synchronize the plugin manifest, private MCP package, and Python test-tooling metadata withsync:versions. Check for drift duringprepack, including CI and Docker builds.BUNDLED_PLUGIN_VERSIONfrom the package version while preserving the public export and CLI output fields. Verify the bundled manifest, installed SDK exports, CLI, and MCP handshake against the package version.0.2.0release notes, including the explicit upgrade needed for SDK consumers on^0.1.x.Testing
3208788f6c: 304 passed.git diff --check: passed.907037f505(--seed=3939255787, canonical macOS temporary directory): 2,099 passed, 44 skipped, 1 sandbox-related failure. The process-group check could not runpsinside the execution sandbox; that check passed separately with native process access.0.2.0archive at907037f505: passed, including CLI/SDK/plugin/MCP version agreement and nested-worker startup.Risk and rollout
SDK dependency ranges such as
^0.1.24require an explicit update to^0.2.0. This change adds no public CLI arguments and preserves existing version fields. Production dependencies, artifact schemas, database migration versions, historical fixtures, and custom plugin producer versions are unchanged.Container publication now requires the corresponding npm release tag to exist at the same commit. If
mainhas advanced, create the existingcontainer-vX.Y.Ztag at the npm release commit. External plugin catalogs retain their own publishing process.Merging the version bump enters the existing CI and protected npm publication process. This PR does not publish packages, create release tags, or publish container images.
Public disclosure review