mirror of
https://github.com/garrytan/gstack.git
synced 2026-05-02 11:45:20 +02:00
Garry Tan
b2d6eb1d89
/ship Step 12's idempotency check read only VERSION and its bump
action wrote only VERSION. package.json's version field was never
updated, so the first bump silently drifted and re-runs couldn't
see it (they keyed on VERSION alone). Any consumer reading
package.json (bun pm, npm publish, registry UIs) saw a stale semver.
Rewrites Step 12 as a four-state dispatch:
FRESH → normal bump, writes VERSION + package.json in sync
ALREADY_BUMPED → skip, reuse current VERSION
DRIFT_STALE_PKG → sync-only repair path, no re-bump (prevents
double-bump on re-run)
DRIFT_UNEXPECTED → halt and ask user (pkg edited manually,
ambiguous which value is authoritative)
Hardening: NEW_VERSION validated against MAJOR.MINOR.PATCH.MICRO
pattern before any write; node-or-bun required for JSON parsing
(no sed fallback — unsafe on nested "version" fields); invalid
JSON fails hard instead of silently corrupting.
Adds test/ship-version-sync.test.ts with 12 cases covering every
state transition, including the critical drift-repair regression
that verifies sync does not double-bump (the bug Codex caught in
the plan review of my own original fix).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>