`publish-all` rewrites the tree with `format` and `rebuild` *before* `require-green-ci` checks the pre-format commit — the gate's own docstring names the divergence it then creates

[sroussey]

What

The restored gate (#916, b214ea6fd) is good and it works — see the reinstatement proof at the bottom. This is one ordering residual in the chain around it.

package.json:56:

"publish-all": "bun run format && bun run rebuild && bun run require-green-ci && bun run bunset && bun run publish-login && bun run publish-workspaces",

format is oxlint --fix && oxfmt "{packages,providers,examples}/*/src/**/*.{js,ts,tsx,json}" — it writes to source. rebuild regenerates dist. Both run before the gate. require-green-ci then resolves git rev-parse HEAD and asks GitHub about that SHA:

$ sed -n '44,47p' scripts/require-green-ci.ts
  const head = spawnSync("git", ["rev-parse", "HEAD"], { encoding: "utf8" });
  if (head.status !== 0) fail(`Could not read HEAD: ${head.stderr.trim()}`);
  const sha = head.stdout.trim();

So the run it checks covers the commit as it was before format touched it, while publish-workspaces packs the working tree. The script knows:

$ sed -n '84,93p' scripts/require-green-ci.ts
  const dirty = spawnSync("git", ["status", "--porcelain"], { encoding: "utf8" });
  if (dirty.status === 0 && dirty.stdout.trim() !== "") {
    // Not fatal — `publish-all` runs `format` and `rebuild` ahead of this, so a
    // dirty tree is expected. But the run above tested the commit, not the tree
    // about to be packed, and that difference is worth naming.
    console.warn(
      `⚠ Working tree is not clean; the run above tested ${sha.slice(0, 7)}, not what is on disk.`
    );
  }

A console.warn inside a release script that runs unattended and is followed immediately by bunset (commit = true, tag = true, push = true, release = true in .bunset.toml) is not a control. It is the same shape as the comment-counts that #906 replaced with a ratchet.

Why it matters

The gate's own docstring states the principle it is then arranged to violate:

"the commit is what consumers install, not the working tree"

Under the current ordering the thing checked and the thing published are, by construction, two different trees whenever format has anything to do — which is exactly the case an unattended release cannot distinguish from the clean one. The severity is bounded (oxfmt is whitespace, oxlint --fix is autofixes) but the guarantee is unbounded in the wrong direction: oxlint --fix applies rule autofixes to source, and nothing re-runs a test after it.

This is not the 0.4.7 failure returning. It is the one seam the replacement left, and it costs two characters to close.

Proposed fix

Pick one:

1. Reorder — bun run require-green-ci && bun run format && bun run rebuild && bun run bunset && …. The gate then reads the commit while it still is the commit. format before the gate buys nothing anyway: format-check has run in CI since 509724031 (.github/workflows/test.yml:95-96), so a commit that is green is already formatted, and format at publish time is a no-op on exactly the commits the gate lets through.
2. Or make the dirty-tree check fatal rather than a warning, with the same WORKGLOW_SKIP_CI_GATE=1 escape the rest of the script uses.

Option 1 is strictly better: it removes the divergence instead of refusing to publish through it, and it makes format at publish time redundant, which is the honest reading of what CI now covers.

Extend PublishGate.test.ts with the ordering assertion it already has the shape for — it asserts require-green-ci comes before bunset; add that it comes before format.

The gate itself is verified — reinstated and measured

$ python3 -c "...replace 'bun run rebuild && bun run require-green-ci && bun run bunset'
                   with  'bun run rebuild && bun run bunset' in package.json"
$ bunx vitest run packages/test/src/test/util/PublishGate.test.ts
 FAIL  src/test/util/PublishGate.test.ts > the release gate on publish-all > checks the commit's CI run before it publishes
 AssertionError: expected 'bun run format && bun run rebuild && …' to contain 'require-green-ci'
 FAIL  src/test/util/PublishGate.test.ts > the release gate on publish-all > gates before it bumps, not after
 Test Files  1 failed (1)

The ratchet fails when the defect it was written for is reinstated. #902 is closed for the right reason.

Measured on origin/main @ 2d36880 (0.6.0). Found during the 2026-09-14 review of packages/.

[sroussey]

Landed on claude/upbeat-feynman-59uare — 308afb62f. Option 1 and option 2: the reorder removes the divergence, and the dirty-tree console.warn becomes a refusal, because after the reorder the tree is expected to be clean at that point and a warning was never a control.

What changed

package.json:56:

-"publish-all": "bun run format && bun run rebuild && bun run require-green-ci && bun run bunset && …"
+"publish-all": "bun run require-green-ci && bun run format && bun run rebuild && bun run require-clean-tree && bun run bunset && …"

• scripts/require-green-ci.ts:85-96 — the dirty-tree console.warn is now fail(...), moved before the gh run list call so the refusal costs no network round trip, and it names the paths. Same WORKGLOW_SKIP_CI_GATE=1 escape as the rest of the script.
• scripts/require-clean-tree.ts (new) — runs between rebuild and bunset.
• scripts/lib/cleanTree.ts (new) — readTreeState / summarizePaths, the porcelain-v1 reading both scripts share.
• packages/test/src/test/util/PublishGate.test.ts:42-80 — two ordering tests replacing the single gate < bunset assertion.

On "does anything downstream assume the gate ran after the rebuild"

No. publish-workspaces.ts reads each workspace's package.json and its dist for source stubs; it never consults the gate, and nothing else in the chain references it (grep -rn "require-green-ci" --include='*.ts' --include='*.json' --include='*.yml' finds only package.json and PublishGate.test.ts).

On the hazard the reorder exposes, and your claim about it

Your claim checks out, so I kept format/rebuild and turned the residual into an assertion rather than deleting the steps:

• format is a no-op on a gated commit. CI's lint job runs format-check over the same glob format writes (.github/workflows/test.yml:95-96) and oxlint --deny-warnings over the same source oxlint --fix fixes, so a commit green enough to pass the gate has nothing for either half to change.
• rebuild cannot dirty the tree at all. dist and *.d.ts are both gitignored (.gitignore:3,12-13), so its output is invisible to git status --porcelain.

So require-clean-tree asserts what CI already covers and fails the release if that stops being true — a release packing bytes no workflow built is refused rather than shipped. Deleting format instead would have been the other honest reading, but it would also have removed the only place that notices when the two stop agreeing.

Verification

$ bunx vitest run scripts/cleanTree.test.ts scripts/ciGate.test.ts \
      packages/test/src/test/util/PublishGate.test.ts
 Test Files  3 passed (3)
      Tests  18 passed (18)      exit 0, 16.2s

$ bun scripts/test.ts task scripts vitest unit
 Test Files  87 passed (87)
      Tests  1346 passed | 24 skipped (1370)    exit 0, 103s

$ bun scripts/test.ts --check-sections
Every test file is discovered and reachable by section+kind selection.   0.3s

$ bun run lint            # exit 0, 26.5s
$ bun run build:types     # 43 successful, 43 total, exit 0, 28.2s
$ bun run format-check    # All matched files use the correct format, exit 0

Both scripts executed against a real dirty tree:

$ bun ./scripts/require-clean-tree.ts
✖ `format` or `rebuild` changed the tree after the CI check passed:
    package.json
    packages/test/src/test/util/PublishGate.test.ts
    scripts/require-green-ci.ts
    …
EXIT=1

$ bun ./scripts/require-green-ci.ts
✖ Working tree is not clean, so the CI status for 2d36880 does not describe what would be published:
    …
EXIT=1

$ WORKGLOW_SKIP_CI_GATE=1 bun ./scripts/require-clean-tree.ts
⚠ WORKGLOW_SKIP_CI_GATE=1 — publishing without checking the working tree.
EXIT=0

Reinstatement proof

The ratchet now fails on the ordering, not only the presence.

Defect 1 — gate back after format/rebuild (exactly this issue's state, with the clean-tree check left in place):

$ publish-all := "bun run format && bun run rebuild && bun run require-green-ci && bun run require-clean-tree && bun run bunset && …"
$ bunx vitest run packages/test/src/test/util/PublishGate.test.ts
 × gates first, before anything that writes or pushes
AssertionError: expected 45 to be less than 8
 Tests  1 failed | 4 passed (5)

Defect 2 — gate after bunset, the push the issue is actually about:

$ publish-all := "bun run format && bun run rebuild && bun run bunset && bun run require-green-ci && bun run require-clean-tree && …"
 × gates first, before anything that writes or pushes     AssertionError: expected 63 to be less than 8
 × re-asserts the clean tree after the steps that write to it   AssertionError: expected 91 to be less than 45
 Tests  2 failed | 3 passed (5)

Restored:

$ bunx vitest run packages/test/src/test/util/PublishGate.test.ts
 Test Files  1 passed (1)
      Tests  5 passed (5)

No PR opened, per instructions.

---

Generated by Claude Code