fix(gh-aw): activate from standalone releases - #1901
Conversation
Closes #1895 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
🛫 PR Readiness Check
PR Scope: 🔧 Infrastructure
|
| Status | Check | Details |
|---|---|---|
| ❌ | Single commit | 4 commits — consider squashing before review |
| ✅ | Not in draft | Ready for review |
| ✅ | Branch up to date | Up to date with dev |
| ❌ | Copilot review | No Copilot review yet — it may still be processing |
| ✅ | Changeset present | No source files changed — changeset not required |
| ✅ | Scope clean | No .squad/ or docs/proposals/ files |
| ✅ | No merge conflicts | No merge conflicts |
| ✅ | Copilot threads resolved | 1 active Copilot thread(s) resolved (4 outdated skipped) |
| ✅ | CI passing | All checks passing |
Files Changed (9 files, +216 −126)
| File | +/− |
|---|---|
.github/workflows/squad-cli-pin-drift.yml |
+52 −36 |
.github/workflows/squad-release.yml |
+24 −0 |
docs/src/content/docs/features/standalone-install.md |
+8 −3 |
docs/src/content/docs/guide/gh-aw.md |
+5 −3 |
scripts/bump-activation-pin.mjs |
+18 −19 |
test/gh-aw-quality.test.ts |
+14 −7 |
test/squad-cli-pin.test.ts |
+49 −42 |
test/standalone-release-workflow.test.ts |
+11 −0 |
workflows/shared/squad.md |
+35 −16 |
Total: +216 −126
This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.
🏗️ Architectural Review
Automated architectural review — informational only. |
🟠 Impact Analysis — PR #1901Risk tier: 🟠 HIGH 📊 Summary
🎯 Risk Factors
📦 Modules Affectedci-workflows (2 files)
docs (2 files)
root (1 file)
scripts (1 file)
tests (3 files)
This report is generated automatically for every PR. See #733 for details. |
There was a problem hiding this comment.
🟡 Changes recommended
The release workflow’s new validation step contains a shell-quoting bug that will break manual dispatch runs, and there are a few additional consistency/validation fixes needed.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR updates gh-aw activation to install Squad from immutable, npm-free standalone GitHub Release bundles (via the SHA-pinned squad-init action), and tightens the “activation pin”/drift-guard story around complete release assets rather than npm dist-tags. It also adds a dev-only, confirmation-gated manual release dispatch path and updates tests/docs to match the new activation and drift behavior.
Changes:
- Replace activation-time npm install with a pinned
squad-initaction that installs from GitHub Release assets, including tag normalization and an npm-free wiring check. - Retarget drift detection and pin consistency checks from npm metadata to “latest release + required asset set” verification.
- Add
workflow_dispatchconfirmation gating to the release workflow (dev-only) and update quality/contract tests accordingly.
File summaries
| File | Description |
|---|---|
workflows/shared/squad.md |
Switch activation to standalone release install + add release tag resolution/validation and npm-free state wiring check. |
test/standalone-release-workflow.test.ts |
Assert the new confirmation-gated manual release dispatch behavior. |
test/squad-cli-pin.test.ts |
Update pin guards to expect vX.Y.Z tags and standalone-release semantics. |
test/gh-aw-quality.test.ts |
Compile with --approve and update contracts to assert standalone action wiring (no npm/npx). |
scripts/bump-activation-pin.mjs |
Normalize/validate TARGET_VERSION as a stable vX.Y.Z tag and update bump messaging. |
docs/src/content/docs/guide/gh-aw.md |
Document SQUAD_CLI_VERSION as a standalone GitHub Release tag (default v0.13.1). |
docs/src/content/docs/features/standalone-install.md |
Refresh examples and clarify npm usage boundaries (bundle build only). |
.github/workflows/squad-release.yml |
Add confirmation-gated workflow_dispatch validation for dev-only manual releases. |
.github/workflows/squad-cli-pin-drift.yml |
Drift guard now checks releases/latest and required standalone assets, and files an issue on drift. |
Review details
- Files reviewed: 9/9 changed files
- Comments generated: 4
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🟡 Changes recommended
There are still a couple of user-facing strings (manual dispatch input description and drift issue title) that can mislead operators in non-“behind” drift scenarios and should be corrected before merge.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Suppressed comments (1)
.github/workflows/squad-cli-pin-drift.yml:108
- The drift issue TITLE says the pin is "behind the published release", but drift is also triggered when the latest release is missing required standalone assets (even if PINNED == LATEST). In that case the issue title is misleading for triage/search.
- name: Open drift issue
if: steps.compare.outputs.drift == 'true'
env:
GH_TOKEN: ${{ github.token }}
PINNED: ${{ steps.compare.outputs.pinned }}
LATEST: ${{ steps.compare.outputs.latest }}
MISSING: ${{ steps.compare.outputs.missing }}
TITLE: 'Squad standalone activation pin is behind the published release'
run: |
- Files reviewed: 9/9 changed files
- Comments generated: 1
- Review effort level: Lite
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🔵 Needs a closer look
It changes core activation and release workflows (high operational impact) and should receive a final human review of the workflow gating and release side effects.
Review details
- Files reviewed: 9/9 changed files
- Comments generated: 0 new
- Review effort level: Lite
Summary
d8d7ef2d6da93460fecbfd56f8de20f9d10fd377SQUAD_CLI_VERSIONsites as the synchronizedv0.13.1GitHub Release fallback and retarget drift detection to complete standalone assetsdev-only release dispatch that reuses the existingGITHUB_TOKENrelease plus direct standalone workflow handoffCloses #1895
End-to-end evidence
The distributed path is
gh aw add .../workflows/squad.md@dev->workflows/squad.md-> importedworkflows/shared/squad.md->squad-init-> its SHA-pinnedscripts/install.sh->releases/download/v0.13.1/squad-<target>. Both #1895 literals are exercised: the fallback env literal selects the artifact passed tosquad-init, while the header literal documents that exact fallback and is guarded against drift.Public
v0.13.0is tagged at47fcb79ec955919534fcd04b298e2a169a53e763and predates #1898 commit31553830. This branch starts atd8d7ef2d6da93460fecbfd56f8de20f9d10fd377, wheregit merge-base --is-ancestor 31553830 HEADsucceeds. After merge, dispatchingSquad Releaseondevwithconfirm_tag=v0.13.1tags the merged commit and directly builds all six bundles plusSHA256SUMS.txtfrom that tag, so the cold artifact contains #1898 without npm publication.The guarded dispatch is necessary because the existing release workflow otherwise runs only on
main; promoting tomainis not part of this gate. Publishing a release manually with a user token is unsafe here becauserelease.publishedcan trigger the npm publisher. The workflow-created release usesGITHUB_TOKEN, suppresses that downstream event, and already calls the standalone reusable workflow directly.npm policy
Cold activation is npm-free. GitHub Actions never configures the Microsoft npm proxy. The standalone builder retains npm only at bundle-build time because there is no practical npm-free dependency-assembly path; Actions uses its normal registry. The proxy remains mandatory only for local developer/agent npm commands. No npm package is published or used as this graduation gate.
Safe-update security review
gh aw compile --strict --approvereports one new action and the existing restricted Squad token secrets:bradygaster/squad/.github/actions/squad-init@d8d7ef2d6da93460fecbfd56f8de20f9d10fd377: reviewed; immutable same-repository SHA, runs the installer shipped at that SHA, validates inputs, downloads the selected release archive and checksum, and receives no secret input.SQUAD_GITHUB_APP_PRIVATE_KEY/SQUAD_GITHUB_TOKEN: existing activation credentials; neither is newly passed to the action. They remain scoped to token minting and the later init/health steps.No redirect changes were reported.
Validation
node --test test/*.test.cjs— 134 passedgh aw compilev0.86.2 for all four workflows with--strict --approve --no-check-update— 4 succeeded; generated locks contain the pinned standalone action and no npm/npx activation commandTARGET_VERSION=v0.13.1 node scripts/bump-activation-pin.mjs— identity rewrite passednode --check scripts/bump-activation-pin.mjsgit diff --checkDependency-backed local Vitest/build validation is unavailable because the required Microsoft proxy returns 404 for
vite@8.2.2; the proxy was not bypassed. PR CI remains the authoritative dependency-backed gate. No changeset is required because this PR does not touch the changelog gate's governed SDK/CLI source or template paths.Post-merge human step
A maintainer must dispatch Squad Release on
devwithconfirm_tag=v0.13.1. No environment approval, npm approval, main promotion, or npm publication is required. After assets attach, verify the release tag contains31553830and run the cold GH-AW install plus/squad castproof.