fix(release): carry DISCLAIMER-WIP in the npm CLI tarball - #3220

Joob1n · 2026-08-18T15:00:08Z

Summary

#3141 wired the Apache Incubator DISCLAIMER-WIP into every desktop artifact, but the real npm CLI publication chain landed on main in parallel, so the next CLI tarball built from main would have shipped without the disclaimer. @hqhq1025 reported this in the #3141 post-merge review with the four exact seams; this PR closes all four:

copyReleaseDocuments() copies the root DISCLAIMER-WIP into the staging root, next to LICENSE/NOTICE as Incubator policy suggests
the npm manifest files whitelist and the validateStaging() required-files assertion both include it
validatePackedFiles() requires it in the packed file list, and the offline install smoke checks it inside the installed package, so the assertion holds at pack time and end to end
cli-package-validation.yml triggers (PR and push) on changes to DISCLAIMER-WIP itself, so editing only the disclaimer can no longer skip CLI package validation

Verification

npm run release:cli:pack under the pinned npm toolchain: the tarball carries package/DISCLAIMER-WIP, and the .files.json inventory lists it
node scripts/smoke-release-cli-package.mjs <tarball>: offline install completes with the new installed-file check green
Mutation check: reverting only the copyReleaseDocuments() line makes packaging fail with Required release file is missing: DISCLAIMER-WIP
lint, format:check, check:release (28/28) — pass

Breaking change

None. Release tooling and its assertions only.

AI use

Select exactly one:

No generative tool made a substantive contribution
Generative tooling made a substantive contribution

Tool(s) and scope: Claude Code — drafted the change and ran the verification above. Reviewed and submitted by the contributor of record. Generated-by: Claude Code is on the commit.

Checklist

Tests cover the change and fail without it
Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

Yes — the published CLI tarball gains DISCLAIMER-WIP
No

Refs #3141

https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

@hqhq1025

Apache Incubator policy requires podling releases to carry the incubating disclaimer, and apache#3141 wired it into every desktop artifact — but the npm CLI publication chain landed on main in parallel, so the next CLI tarball would have shipped without it. The staging copy step now places DISCLAIMER-WIP next to LICENSE/NOTICE, the npm files whitelist and the staging/packed-files assertions require it, the installed-package smoke checks it end to end, and the CLI package validation workflow triggers on changes to the disclaimer itself. Reported by @hqhq1025 in the apache#3141 post-merge review. Generated-by: Claude Code Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

coderabbitai · 2026-08-18T15:00:35Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 58a9ac64-0b66-48ce-bd57-448a62b23d28

📥 Commits

Reviewing files that changed from the base of the PR and between a3c4d0b and e07d121.

📒 Files selected for processing (3)

.github/workflows/cli-package-validation.yml
scripts/release-cli-package.mjs
scripts/smoke-release-cli-package.mjs

Included review availability: Your plan includes up to 3 reviews per rolling hour; 2 remain after this review.

📝 Walkthrough

Summary

This PR ensures published npm CLI tarballs include DISCLAIMER-WIP. It updates staging, npm manifest generation, tarball validation, installed-package smoke tests, and workflow triggers.

The PR extends the existing release pipeline source of truth. It does not create a parallel packaging path. Each validation layer now checks the same required file.

The change is the smallest coherent solution. The added checks are necessary to prevent drift between staging, packing, and installed-package validation. No code or tests can be removed without weakening regression coverage.

Reported validation passed for packaging, smoke tests, mutation checks, linting, formatting, and release checks. Final check status was not independently verified.

Complexity delta

Adds one required file to staging and package manifests.
Adds one required-file assertion to staging, tarball, and installed-package validation.
Adds workflow triggers for DISCLAIMER-WIP.
Adds no public API, exported entity, release branch, or parallel authority.
Slightly increases test-maintenance burden because the required-file list now includes DISCLAIMER-WIP.
Keeps packaging and validation aligned with the existing release pipeline.

Total maintenance complexity stays justified because the added checks protect the published artifact requirement.

Review-relevant risks

The published CLI tarball gains a user-visible file. Release artifact contents therefore change.

The file supports Apache Incubator disclaimer coverage. This creates a licensing and governance effect in published packages. Material changes in licensing, governance, or release behavior require independent human review under repository policy.

No security or public API effect was identified in the current diff.

The person performing the merge must review the final diff. A maintainer makes the final determination.

Walkthrough

The CLI release process now includes DISCLAIMER-WIP in staged packages, npm manifests, tarballs, installed-package checks, and relevant CI path triggers.

Changes

CLI package disclaimer

Layer / File(s)	Summary
Package contents and validation `scripts/release-cli-package.mjs`, `scripts/smoke-release-cli-package.mjs`	The release scripts copy and declare `DISCLAIMER-WIP`. Staging, tarball, and installed-package validation now require the file.
Validation workflow triggers `.github/workflows/cli-package-validation.yml`	The validation workflow runs for `DISCLAIMER-WIP` changes in pull requests and pushes to `main`.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to e07d1

The CLI package will include and validate DISCLAIMER-WIP across staging, packing, installation, and workflow triggering; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: m4n5ter

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: including DISCLAIMER-WIP in the npm CLI tarball.
Description check	✅ Passed	The description includes the required summary, verification, AI use, checklist, behavior change, and issue reference details.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Ai Use Disclosure	✅ Passed	The PR selects generative use and names Claude Code with scope; its sole introduced commit has the matching standalone `Generated-by: Claude Code` trailer.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

qodo-code-review · 2026-08-18T15:01:27Z

PR Summary by Qodo

Include DISCLAIMER-WIP in npm CLI release artifacts

🐞 Bug fix 🧪 Tests ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Includes DISCLAIMER-WIP in staged and packed npm CLI release artifacts.
• Validates disclaimer presence during staging, packing, and offline installation.
• Runs CLI package validation whenever the disclaimer changes.

Diagram

graph TD
  D["DISCLAIMER-WIP"] -->|"change triggers"| W["CLI package CI"] -->|"runs"| C["Copy documents"] -->|"writes"| M["Files whitelist"] -->|"checked by"| S["Staging validation"] -->|"packs"| P["CLI tarball"] -->|"verified by"| V["Packed validation"] -->|"installed for"| I["Install smoke"]

High-Level Assessment

The layered approach is appropriate: copying and whitelisting include the disclaimer, while staging, packed-inventory, and installed-package checks prevent regressions at each release boundary. Relying only on the npm whitelist or final smoke test was considered insufficient because it would either omit the source copy or delay failures until later in the pipeline.

Files changed (3) +11 / -0

Bug fix (1) +6 / -0

release-cli-package.mjsPackage and validate the Incubator disclaimer +6/-0

Package and validate the Incubator disclaimer
• Copies DISCLAIMER-WIP into the release staging root and adds it to the npm files whitelist. Staging and packed-file validations now fail when the disclaimer is absent.
scripts/release-cli-package.mjs

Tests (1) +3 / -0

smoke-release-cli-package.mjsVerify the disclaimer after offline installation +3/-0

Verify the disclaimer after offline installation
• Extends installed runtime-file validation to require DISCLAIMER-WIP in the unpacked npm CLI package, providing end-to-end release coverage.
scripts/smoke-release-cli-package.mjs

Other (1) +2 / -0

cli-package-validation.ymlTrigger CLI validation for disclaimer changes +2/-0

Trigger CLI validation for disclaimer changes
• Adds DISCLAIMER-WIP to pull-request and main-branch push path filters. Disclaimer-only changes will now run CLI package validation.
.github/workflows/cli-package-validation.yml

qodo-code-review · 2026-08-18T15:02:10Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can keep summaries lean with Finding overflow, which tucks the rest behind 'View more'

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Astro-Han

Approved at exact head e07d121f7a362c8da19f50cd87e02d43cf102a59.

This extends the existing release pipeline cleanly: DISCLAIMER-WIP is copied into staging, included in the npm allowlist, verified in both staged and packed inventories, checked again after offline installation, and covered by the relevant workflow triggers. I found no simpler solution that would preserve the same end-to-end release guarantee.

No P0–P3 findings. All current checks pass.

AI-assisted review: Codex coordinated two independent reviewer passes and an OpenCode Go DeepSeek V4 Flash high-effort adversarial pass. I verified the exact head, diff, current CI, and the artifact path from the source document through packing and installation. This approval does not replace the repository's required independent human review for release and governance changes.

中文审查

已审查精确 head e07d121f7a362c8da19f50cd87e02d43cf102a59。

该改动直接扩展现有发布链路：将 DISCLAIMER-WIP 复制到 staging、纳入 npm 白名单、分别校验 staging 与 tarball 内容，并在离线安装后再次验证，同时补齐对应 workflow trigger。没有发现能以更低复杂度提供相同端到端保障的方案。

未发现 P0–P3 问题，当前检查全部通过。

本次为 AI 辅助审查：Codex 协调了两轮独立 reviewer 审查及 OpenCode Go DeepSeek V4 Flash high 对抗性复核，并核验了精确 head、diff、当前 CI，以及文件从源码到打包和安装产物的完整路径。该批准不能替代发布与治理改动所要求的独立人工审查。

Joob1n mentioned this pull request Aug 18, 2026

docs: add DISCLAIMER-WIP for podling releases #3141

Merged

Astro-Han approved these changes Aug 18, 2026

View reviewed changes

Astro-Han merged commit aa5a268 into apache:main Aug 18, 2026
18 checks passed

This was referenced Aug 20, 2026

release: resolve post-incubation GitHub and npm distribution status #3274

Open

[TRACKING] Apache Maka 0.2.0-incubating source release #2974

Open

release: publish an ASF-compliant npm convenience artifact #3275

Open

Navigation Menu

Uh oh!

fix(release): carry DISCLAIMER-WIP in the npm CLI tarball - #3220