chore(release): exit changesets pre mode — next release is 1.0.0 - #843
Merged
Conversation
The 1.0 line has been publishing `1.0.0-rc.*` under the `rc` dist-tag since `pre enter rc`. Exiting pre mode graduates the release train to stable: the next "Version Packages" PR opens as 1.0.0 and publishes under `latest`. - `.changeset/pre.json` moves to `mode: "exit"`. The next `changeset version` run graduates every package, consumes the ~140 accumulated changesets into `CHANGELOG.md`, and deletes the file. Verified by running `changeset version` in an isolated copy of the tree: stash, @cipherstash/stack, stack-drizzle, stack-supabase, prisma-next, wizard and migrate all land on 1.0.0. - The Stack 1.0 changeset headline no longer says "(release candidate)" — that line becomes the top of the 1.0.0 changelog. - CONTRIBUTE.md documents the stable flow as the default and keeps the pre-mode recipe as an explicitly exceptional path, including the trap that pre mode retains consumed changeset markdown until exit.
🦋 Changeset detectedLatest commit: 29ee37a The changes in this PR will be included in the next version bump. This PR includes changesets to release 12 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughThe PR finalizes stable release metadata, documents the ChangesRelease and EQL v3 alignment
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CONTRIBUTE.md`:
- Line 116: Update the “Pre release process” heading in CONTRIBUTE.md to use the
hyphenated spelling “Pre-release process,” preserving the rest of the heading
unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 71f02186-4521-4a6f-98d7-4f89a069a9be
📒 Files selected for processing (3)
.changeset/pre.json.changeset/stack-1-0-0-rc.mdCONTRIBUTE.md
freshtonic
approved these changes
Jul 30, 2026
freshtonic
left a comment
freshtonic
left a comment
Contributor
There was a problem hiding this comment.
Reviewed by reproducing changeset version against the PR head in an isolated worktree (now removed; main tree untouched).
Approving. Correct, well-scoped release-mechanics change.
Verified end-to-end
- Exiting pre mode graduates the fixed group (
stash,@cipherstash/stack,-drizzle,-supabase,prisma-next,wizard) and@cipherstash/migrateall to exactly 1.0.0;@cipherstash/nextjs→ 4.1.2,@cipherstash/bench→ 0.0.5..changeset/pre.jsonis deleted and all 144 changesets consumed on exit — matches the PR's table precisely, nothing stranded atrc, no stray bump past 1.0.0. - Keeping
pre.jsonatmode: "exit"(rather than deleting it) is correct — the nextchangeset versionis what consumes retained changesets and deletes the file. - The
stack-1-0-0-rc.mdheadline edit renders as "CipherStash Stack 1.0." at the top of the 1.0.0 changelog. release.ymlrunspnpm run release=build && changeset publishwith no hardcoded--tag, so publish deriveslatestcorrectly once pre mode is exited.CONTRIBUTE.mdstable-flow and pre-mode recipes are accurate; no changeset in this PR is correct per AGENTS.md (release tooling +CONTRIBUTE.md, no shipped package surface).
Not blocking this PR, but must be handled in the "Version Packages" release PR before it publishes — retained rc-era changeset prose will re-aggregate into the customer-facing 1.0.0 CHANGELOG (the first latest changelog customers see), and two entries now contradict later ones:
eql-v3-drizzle.md("the v3 text-search helper iscontains") contradictseql-v3-rename-contains-to-matches.md(renamescontains()→matches())..changeset/stash-supabase-contains-substrings.mddescribescontains()as fuzzy-substring, contradicting the rename semantics (matches()= fuzzy,contains()= exact containment).
These are changelog text, not release behaviour, so they belong in the release PR where CHANGELOG.md is generated and can be hand-edited. Given the CONTRIBUTE.md trap note, I'd recommend a full pass over the ~140 retained entries there, not just these two.
Caveat: I couldn't exercise the actual npm publish/dist-tag resolution (needs the release workflow + OIDC), but confirmed statically that changeset publish has no --tag override.
…s at 1.0.0 (#791) Pre mode retains consumed changeset markdown until exit, so the aggregated 1.0.0 changelog was the union of every rc entry — including ones that later changes made wrong. Reconciled against the surface main actually ships. Changesets: - Re-homed adapter entries onto the packages that own the code (`@cipherstash/stack-drizzle` / `@cipherstash/stack-supabase` instead of `@cipherstash/stack`), so the details land in the changelog of the package that exposes the behaviour, and split the drizzle-root collapse from its one-line `stash` / `@cipherstash/stack` follow-on. - Rewrote entries naming removed APIs to their final names: the `@cipherstash/stack/eql/v3/drizzle` and `@cipherstash/stack-drizzle/v3` subpaths, `createEncryptionOperatorsV3` / `extractEncryptionSchemaV3`, the encrypted `contains()` operator (now `matches()`), and the alpha-era bare domain names (now `public.eql_v3_*`). - Dropped the "Superseded later in this release" footers. Where the entry was wholly about an rc-only surface 1.0.0 removed (`--eql-version`, `db push`, `encrypt cutover`), the entry is deleted — the rc changelog sections still record it; where the substance survives, the stale paragraph is gone and the body describes 1.0.0. - Removed the blanket "order() on any encrypted column is rejected" claim that the OPE ord_term entry contradicts. Skills (#791): - `skills/stash-edge` and `skills/stash-cli` pinned `1.0.0-rc.4` in four places. Nothing rewrites those literals — tsup copies `skills/` verbatim and the runtime-versions embed only reaches compiled CLI code — so the published skill would have told Deno and Supabase Edge users to pin a release candidate in production. They now pin `1.0.0`, and the paragraph explaining why `@^1.0.0` misses `1.0.0-rc.4` is gone with the rc pin. - The `supabase-worker` example pins `1.0.0` too. - `release-train.test.ts` now sweeps every `skills/*/SKILL.md`: an exact pin of a release-train package must be a stable version on the current major. Verified it fails on a reintroduced rc pin.
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.changeset/eql-v3-adapter-type-robustness.md:
- Around line 2-3: Update the changeset entries for `@cipherstash/stack-drizzle`
and `@cipherstash/stack-supabase` from minor to major to reflect the breaking
typed client contract change in createEncryptionOperators. Only retain minor
bumps if the project’s explicit prerelease-exit plan is intended to absorb this
compatibility break.
In @.changeset/eql-v3-drizzle-fail-open-guards.md:
- Around line 19-20: Update the “Terms of 3+ codepoints are unaffected”
statement in the breaking-changes description to refer to terms at or above the
configured token_length, preserving the default of 3 without hardcoding it as
the universal threshold.
In @.changeset/eql-v3-supabase-adapter.md:
- Around line 5-17: Update the unsupported-domain lifecycle description in the
changeset to match the implementation: explicitly declared schemas are validated
during construction, while unmodeled public.eql_v3_* columns are rejected when a
caller names the affected table. Remove the claim that every unsupported-domain
column throws at construction.
In `@packages/cli/src/__tests__/release-train.test.ts`:
- Around line 17-20: Update manifestVersion to accept the existing
ReleaseTrainPackage type and narrow regex captures with a type guard before
indexing RELEASE_TRAIN_MANIFESTS. Apply the same typed narrowing to the regex
handling around lines 100-103, preserving the existing invalid-package behavior
and verify with pnpm run code:check.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: ad8c8ef5-c8e8-4e3c-938a-a9180357c1cf
📒 Files selected for processing (38)
.changeset/adapter-split-skills.md.changeset/cli-eql-v3-single-bundle.md.changeset/cli-v2-cutover-prompt-correction.md.changeset/decrypt-chaining-docs.md.changeset/encrypt-client-guard-parity.md.changeset/encrypt-lifecycle-mixed-table.md.changeset/eql-v3-adapter-type-robustness.md.changeset/eql-v3-cli-install.md.changeset/eql-v3-drizzle-encrypt-query.md.changeset/eql-v3-drizzle-fail-open-guards.md.changeset/eql-v3-drizzle.md.changeset/eql-v3-ga-rebaseline.md.changeset/eql-v3-rename-contains-to-matches.md.changeset/eql-v3-sole-docs.md.changeset/eql-v3-supabase-adapter.md.changeset/eql-v3-wasm-inline.md.changeset/init-drizzle-eql-v3.md.changeset/init-placeholder-eql-v3.md.changeset/init-scaffold-compiles.md.changeset/migrate-column-exists.md.changeset/migrate-eql-v3.md.changeset/remove-eql-v2-drizzle-root-consumers.md.changeset/remove-eql-v2-drizzle-root.md.changeset/rewriter-never-drops-ciphertext.md.changeset/skills-eql-v3-accuracy.md.changeset/skills-pin-stable-1-0.md.changeset/skills-v3-lifecycle-honesty.md.changeset/stash-cli-eql-v3-default.md.changeset/stash-cli-skill-refresh.md.changeset/stash-supabase-contains-substrings.md.changeset/supabase-in-list-operands.md.changeset/supabase-is-null-operands.md.changeset/supabase-or-string-parser.md.changeset/supabase-v3-order-by-ope-term.mdexamples/supabase-worker/supabase/functions/cipherstash-roundtrip/index.tspackages/cli/src/__tests__/release-train.test.tsskills/stash-cli/SKILL.mdskills/stash-edge/SKILL.md
💤 Files with no reviewable changes (6)
- .changeset/eql-v3-cli-install.md
- .changeset/skills-v3-lifecycle-honesty.md
- .changeset/cli-v2-cutover-prompt-correction.md
- .changeset/stash-cli-eql-v3-default.md
- .changeset/remove-eql-v2-drizzle-root.md
- .changeset/encrypt-lifecycle-mixed-table.md
Contributor
Author
|
Merged |
… to @cipherstash/stack-prisma Closes #842 (revised plan: all adapters use the stack- prefix). - @cipherstash/prisma-next -> @cipherstash/stack-prisma (dir packages/stack-prisma), matching @cipherstash/stack-drizzle and @cipherstash/stack-supabase, which keep their names. - skills/stash-prisma-next -> skills/stash-prisma; CLI/wizard skill maps, install-deps, release-train manifests, workflows, docs, and SECURITY.md updated to match. - examples/prisma package renamed @cipherstash/prisma-next-example -> @cipherstash/prisma-example. The prisma-next provider id, --prisma-next init flag, and prisma-next.config.ts detection are unchanged - they name the external Prisma Next framework (@prisma-next/*), not our package. Retained changesets and .changeset/{config,pre}.json are rewritten to the new name so the pre-mode exit in #843 versions and publishes @cipherstash/stack-prisma as 1.0.0 (the name is unclaimed on npm).
…h the @cipherstash/stack-prisma rename
Contributor
Author
|
Plan revised (#842 discussion): all adapters keep the |
coderdan
force-pushed
the
chore/exit-prerelease-1-0-0
branch
from
July 30, 2026 03:42
5141318 to
43dc906
Compare
This was referenced Jul 30, 2026
coderdan
added a commit
that referenced
this pull request
Jul 30, 2026
… to @cipherstash/stack-prisma (#844) Closes #842 (revised plan: all adapters use the stack- prefix). - @cipherstash/prisma-next -> @cipherstash/stack-prisma (dir packages/stack-prisma), matching @cipherstash/stack-drizzle and @cipherstash/stack-supabase, which keep their names. - skills/stash-prisma-next -> skills/stash-prisma; CLI/wizard skill maps, install-deps, release-train manifests, workflows, docs, and SECURITY.md updated to match. - examples/prisma package renamed @cipherstash/prisma-next-example -> @cipherstash/prisma-example. The prisma-next provider id, --prisma-next init flag, and prisma-next.config.ts detection are unchanged - they name the external Prisma Next framework (@prisma-next/*), not our package. Retained changesets and .changeset/{config,pre}.json are rewritten to the new name so the pre-mode exit in #843 versions and publishes @cipherstash/stack-prisma as 1.0.0 (the name is unclaimed on npm).
- CONTRIBUTE.md: hyphenate the "Pre-release process" heading. - eql-v3-drizzle-fail-open-guards: tie the unaffected-terms claim to the configured token_length instead of hardcoding 3. - eql-v3-supabase-adapter: unmodelled-column errors fire when the table is named via from(); construction-time verification covers declared schemas (matches the "NOT a construction-time veto" contract in packages/stack-supabase/src/index.ts). - release-train.test.ts: type the manifest key - isReleaseTrainPackage() guard narrows the regex capture, manifestVersion() takes ReleaseTrainPackage, and the type-erasing `as string` casts are gone.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Stops the
rcprerelease series and prepares the notes that ship with it. Thenext release PR opens as 1.0.0 and publishes under the
latestdist-tag.Closes #791.
1. Exit pre mode
.changeset/pre.json→mode: "exit"(viapnpm changeset pre exit). Keptrather than deleted: the next
changeset versionrun is what graduates theversions, consumes the retained changesets into each
CHANGELOG.md, anddeletes the file itself.
CONTRIBUTE.md: the stable flow is documented as the default; the pre-moderecipe stays, marked exceptional, and now names the trap that bit this line —
pre mode retains consumed changeset markdown until exit, so a stale entry
rides into the stable changelog.
2. Reconcile the retained 1.0.0 notes
Pre mode retains every consumed changeset until exit, so the aggregated 1.0.0
changelog was the union of the whole rc series — including entries that later
work made wrong. Reconciled against what
mainactually ships:@cipherstash/stack-drizzle/@cipherstash/stack-supabaserather than@cipherstash/stack, so Drizzle and Supabase fixes appear in the changelog ofthe package that exposes them. The drizzle-root collapse is split from its
one-line
stash/@cipherstash/stackfollow-on, which was dragging thewhole adapter body into core's changelog.
@cipherstash/stack/eql/v3/drizzleand@cipherstash/stack-drizzle/v3subpaths,
createEncryptionOperatorsV3/extractEncryptionSchemaV3, theencrypted
contains()operator (nowmatches()), and the alpha-era baredomain names (now
public.eql_v3_*).was wholly about an rc-only surface 1.0.0 removes (
--eql-version,db push,encrypt cutover), the changeset is deleted — the published rc changelogsections still record it. Where the substance survives, the negated paragraph
is gone and the body describes 1.0.0.
order()on any encrypted column is rejected" claim,which the OPE
ord_termentry in the same release contradicts.Entries flagged in the earlier review that
mainhad already fixed are leftalone: the
eql_v3_encryptedprompt domain, the DynamoDB audit caveat, the v2wire-emission contract, and the
@cipherstash/nextjsmis-assignment.3. Skills pin 1.0.0, and a guard so they stay pinned (#791)
skills/stash-edgehardcoded@cipherstash/stack@1.0.0-rc.4in its Denonpm:import anddeno.jsonimport map;skills/stash-clipinned thebare-project
npx --package=stash@…one-shot the same way. Nothing rewritesthose literals —
tsup.config.tscopiesskills/verbatim, and the__STASH_RUNTIME_VERSIONS__embed only reaches compiled CLI code — so thepublished skill would have told Deno and Supabase Edge users to pin a release
candidate in production, inside their own repo. All four now pin
1.0.0.@^1.0.0does not match1.0.0-rc.4is gonewith the rc pin; "pin exactly, Deno caches by specifier" stands on its own.
supabase-workerexample pins1.0.0instead of^1.0.0-rc.3.packages/cli/src/__tests__/release-train.test.tsnow sweeps everyskills/*/SKILL.md: an exact pin of a release-train package must be a stableversion on the current major. Confirmed red on a reintroduced rc pin, and the
existing
stash-clipin assertion compares against the stable version so theversion-bump PR is not red on arrival.
Verification
changeset versionrun against an isolated copy of the tree (throwawaydirectory — nothing versioned on the branch):
stash@cipherstash/stack@cipherstash/stack-drizzle@cipherstash/stack-supabase@cipherstash/prisma-next@cipherstash/wizard@cipherstash/migrate@cipherstash/nextjs.changeset/pre.jsonwas deleted by that run and every changeset consumed. Thegenerated 1.0.0 sections were then re-scanned for the removed names, subpaths,
and CLI commands above; the only remaining matches are entries quoting the wrong
text they correct.
pnpm --filter stash test— 909 passedpnpm run code:check— error-free (warnings only, which CI allows)Deliberately not in this PR
@cipherstash/stack: ">=1.0.0-rc.0"inpackages/cliandpackages/migrate) are left alone: they already admit 1.0.0, and tighteningthem would strand rc consumers.
Summary by CodeRabbit
Summary by CodeRabbit