From a9fde49bc05973b5d1acaa319180f225f28453c1 Mon Sep 17 00:00:00 2001 From: David Antoon Date: Sat, 21 Feb 2026 14:21:47 +0200 Subject: [PATCH 1/5] chore(release): bump versions to 2.11.0 --- libs/ast/package.json | 2 +- libs/broker/package.json | 8 ++++---- libs/client/package.json | 6 +++--- libs/core/package.json | 6 +++--- libs/react/package.json | 4 ++-- libs/runtime/package.json | 8 ++++---- libs/stream/package.json | 4 ++-- libs/types/package.json | 2 +- 8 files changed, 20 insertions(+), 20 deletions(-) diff --git a/libs/ast/package.json b/libs/ast/package.json index 7f78fd0..0dbd3f5 100644 --- a/libs/ast/package.json +++ b/libs/ast/package.json @@ -1,6 +1,6 @@ { "name": "@enclave-vm/ast", - "version": "2.10.0", + "version": "2.11.0", "description": "A production-ready AST security guard for JavaScript - validate, protect, and enforce code safety with extensible rules", "author": "AgentFront ", "homepage": "https://github.com/agentfront/enclave/tree/main/libs/ast-guard", diff --git a/libs/broker/package.json b/libs/broker/package.json index 18b2ea0..65563ee 100644 --- a/libs/broker/package.json +++ b/libs/broker/package.json @@ -1,6 +1,6 @@ { "name": "@enclave-vm/broker", - "version": "2.10.0", + "version": "2.11.0", "description": "Tool broker and session management for the EnclaveJS streaming runtime", "author": "AgentFront ", "homepage": "https://github.com/agentfront/enclave", @@ -35,9 +35,9 @@ } }, "dependencies": { - "@enclave-vm/types": "2.10.0", - "@enclave-vm/stream": "2.10.0", - "@enclave-vm/core": "2.10.0", + "@enclave-vm/types": "2.11.0", + "@enclave-vm/stream": "2.11.0", + "@enclave-vm/core": "2.11.0", "minimatch": "^10.1.1", "zod": "^4.3.6" } diff --git a/libs/client/package.json b/libs/client/package.json index 48bdb6f..5f1ebaf 100644 --- a/libs/client/package.json +++ b/libs/client/package.json @@ -1,6 +1,6 @@ { "name": "@enclave-vm/client", - "version": "2.10.0", + "version": "2.11.0", "description": "Browser and Node.js client SDK for the EnclaveJS streaming runtime", "author": "AgentFront ", "homepage": "https://github.com/agentfront/enclave", @@ -34,7 +34,7 @@ } }, "dependencies": { - "@enclave-vm/types": "2.10.0", - "@enclave-vm/stream": "2.10.0" + "@enclave-vm/types": "2.11.0", + "@enclave-vm/stream": "2.11.0" } } diff --git a/libs/core/package.json b/libs/core/package.json index 86f88b4..21155a0 100644 --- a/libs/core/package.json +++ b/libs/core/package.json @@ -1,6 +1,6 @@ { "name": "@enclave-vm/core", - "version": "2.10.0", + "version": "2.11.0", "description": "Sandbox runtime for secure JavaScript code execution", "author": "AgentFront ", "homepage": "https://github.com/agentfront/enclave", @@ -39,8 +39,8 @@ }, "dependencies": { "@babel/standalone": "^7.29.0", - "@enclave-vm/types": "2.10.0", - "@enclave-vm/ast": "2.10.0", + "@enclave-vm/types": "2.11.0", + "@enclave-vm/ast": "2.11.0", "acorn": "8.15.0", "acorn-walk": "8.3.4", "astring": "1.9.0", diff --git a/libs/react/package.json b/libs/react/package.json index 5b6450e..eaf9388 100644 --- a/libs/react/package.json +++ b/libs/react/package.json @@ -1,6 +1,6 @@ { "name": "@enclave-vm/react", - "version": "2.10.0", + "version": "2.11.0", "description": "React hooks and components for the EnclaveJS streaming runtime", "author": "AgentFront ", "homepage": "https://github.com/agentfront/enclave", @@ -34,7 +34,7 @@ } }, "dependencies": { - "@enclave-vm/client": "2.10.0" + "@enclave-vm/client": "2.11.0" }, "peerDependencies": { "react": ">=18.0.0" diff --git a/libs/runtime/package.json b/libs/runtime/package.json index b2d236f..fb0d6f9 100644 --- a/libs/runtime/package.json +++ b/libs/runtime/package.json @@ -1,6 +1,6 @@ { "name": "@enclave-vm/runtime", - "version": "2.10.0", + "version": "2.11.0", "description": "Standalone runtime worker for EnclaveJS - deployable execution environment", "author": "AgentFront ", "homepage": "https://github.com/agentfront/enclave", @@ -37,9 +37,9 @@ "enclave-runtime": "./dist/cli.js" }, "dependencies": { - "@enclave-vm/types": "2.10.0", - "@enclave-vm/stream": "2.10.0", - "@enclave-vm/core": "2.10.0" + "@enclave-vm/types": "2.11.0", + "@enclave-vm/stream": "2.11.0", + "@enclave-vm/core": "2.11.0" }, "devDependencies": { "ws": "^8.19.0" diff --git a/libs/stream/package.json b/libs/stream/package.json index db2bad5..8e740a3 100644 --- a/libs/stream/package.json +++ b/libs/stream/package.json @@ -1,6 +1,6 @@ { "name": "@enclave-vm/stream", - "version": "2.10.0", + "version": "2.11.0", "description": "Streaming protocol implementation for EnclaveJS runtime (NDJSON, encryption, reconnection)", "author": "AgentFront ", "homepage": "https://github.com/agentfront/enclave", @@ -35,6 +35,6 @@ } }, "dependencies": { - "@enclave-vm/types": "2.10.0" + "@enclave-vm/types": "2.11.0" } } diff --git a/libs/types/package.json b/libs/types/package.json index 9537713..f152ad8 100644 --- a/libs/types/package.json +++ b/libs/types/package.json @@ -1,6 +1,6 @@ { "name": "@enclave-vm/types", - "version": "2.10.0", + "version": "2.11.0", "description": "Type definitions and Zod schemas for the EnclaveJS streaming runtime protocol", "author": "AgentFront ", "homepage": "https://github.com/agentfront/enclave", From 927e65ed7df535a0918009ad016519e4cbecf5a2 Mon Sep 17 00:00:00 2001 From: David Antoon Date: Sat, 21 Feb 2026 14:27:27 +0200 Subject: [PATCH 2/5] feat: enhance release workflow with cherry-pick version sync to main --- .github/workflows/publish-release.yml | 152 ++++++++++++++++++++++++++ yarn.lock | 82 +++++++++++++- 2 files changed, 233 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index b913a8b..1da517f 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -35,6 +35,10 @@ jobs: publish: runs-on: ubuntu-latest environment: release + outputs: + version: ${{ steps.version.outputs.version }} + is_prerelease: ${{ steps.version.outputs.is_prerelease }} + branch: ${{ steps.context.outputs.branch }} env: NX_DAEMON: "false" @@ -433,3 +437,151 @@ jobs: echo "| Pre-release | ${{ steps.version.outputs.is_prerelease }} |" >> "$GITHUB_STEP_SUMMARY" echo "| Branch | \`${{ steps.context.outputs.branch }}\` |" >> "$GITHUB_STEP_SUMMARY" echo "| Packages | All libs/* |" >> "$GITHUB_STEP_SUMMARY" + + cherry-pick-version-to-main: + needs: publish + if: > + inputs.dry_run != true && + needs.publish.outputs.is_prerelease == 'false' + runs-on: ubuntu-latest + permissions: + contents: write + pull-requests: write + issues: write + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + fetch-depth: 0 + token: ${{ secrets.GITHUB_TOKEN }} + + - name: Check if latest semver + id: check + run: | + set -euo pipefail + VERSION="${{ needs.publish.outputs.version }}" + + git fetch --tags + + # Get all stable version tags, sort by semver, pick highest + LATEST=$(git tag --list 'v*' \ + | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' \ + | sort -V \ + | tail -1 \ + | sed 's/^v//') + + echo "Released version: $VERSION" + echo "Latest stable tag: $LATEST" + + if [ "$VERSION" = "$LATEST" ]; then + echo "is_latest=true" >> "$GITHUB_OUTPUT" + echo "This is the latest version — will cherry-pick to main" + else + echo "is_latest=false" >> "$GITHUB_OUTPUT" + echo "Skipping: v$VERSION is not the latest (v$LATEST is newer)" + fi + + - name: Configure git + if: steps.check.outputs.is_latest == 'true' + run: | + git config user.name "github-actions[bot]" + git config user.email "github-actions[bot]@users.noreply.github.com" + + - name: Cherry-pick version bump to main + if: steps.check.outputs.is_latest == 'true' + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + set -euo pipefail + + VERSION="${{ needs.publish.outputs.version }}" + RELEASE_BRANCH="${{ needs.publish.outputs.branch }}" + DEFAULT_BRANCH="${{ github.event.repository.default_branch }}" + + # Find the version bump commit on the release branch + VERSION_COMMIT=$(git log "origin/$RELEASE_BRANCH" \ + --grep="chore(release): v${VERSION}" \ + --format="%H" -1) + + if [ -z "$VERSION_COMMIT" ]; then + echo "::warning::Could not find version bump commit for v${VERSION}" + exit 0 + fi + + echo "Found version bump commit: $VERSION_COMMIT" + + # Prepare cherry-pick branch + CHERRY_BRANCH="cherry-pick/v${VERSION}-version-to-main" + + git fetch origin "$DEFAULT_BRANCH" + git checkout "$DEFAULT_BRANCH" + git pull origin "$DEFAULT_BRANCH" + + # Clean up existing remote branch if any + git push origin --delete "$CHERRY_BRANCH" 2>/dev/null || true + git checkout -b "$CHERRY_BRANCH" + + # Attempt cherry-pick + if git cherry-pick "$VERSION_COMMIT" --no-commit; then + git commit -m "$(cat < Date: Sat, 21 Feb 2026 14:38:00 +0200 Subject: [PATCH 3/5] feat: add check to skip cherry-pick if version bump is already on default branch --- .github/workflows/publish-release.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 1da517f..bc5bff3 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -510,10 +510,17 @@ jobs: echo "Found version bump commit: $VERSION_COMMIT" + git fetch origin "$DEFAULT_BRANCH" + + # Skip if the version bump is already on the default branch + if git merge-base --is-ancestor "$VERSION_COMMIT" "origin/$DEFAULT_BRANCH"; then + echo "Version bump commit $VERSION_COMMIT is already on $DEFAULT_BRANCH — skipping cherry-pick" + exit 0 + fi + # Prepare cherry-pick branch CHERRY_BRANCH="cherry-pick/v${VERSION}-version-to-main" - git fetch origin "$DEFAULT_BRANCH" git checkout "$DEFAULT_BRANCH" git pull origin "$DEFAULT_BRANCH" From fe72c64b752af0aae3e211c4ad14e8c4f3e5766c Mon Sep 17 00:00:00 2001 From: David Antoon Date: Sat, 21 Feb 2026 14:48:00 +0200 Subject: [PATCH 4/5] feat: add checks to handle empty cherry-pick scenarios for version bumps --- .github/workflows/publish-release.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index bc5bff3..4451dab 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -530,6 +530,13 @@ jobs: # Attempt cherry-pick if git cherry-pick "$VERSION_COMMIT" --no-commit; then + # Check if cherry-pick produced any changes (may be empty if already applied via a different commit) + if [ -z "$(git diff --cached --name-only)" ]; then + echo "Cherry-pick produced no changes — version bump already applied on $DEFAULT_BRANCH" + git reset HEAD 2>/dev/null || true + exit 0 + fi + git commit -m "$(cat </dev/null || true + exit 0 + fi + git cherry-pick --abort || true echo "::warning::Cherry-pick had conflicts. Creating issue for manual resolution." From 3f3f7e8e25d7d3c83e5db18a4a79665fa9a6ce7d Mon Sep 17 00:00:00 2001 From: David Antoon Date: Sat, 21 Feb 2026 15:01:55 +0200 Subject: [PATCH 5/5] feat: update demo app dependencies to match new version --- .github/workflows/publish-release.yml | 31 +++++++++++++++++++++++++++ apps/streaming-demo/package.json | 8 +++---- 2 files changed, 35 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 4451dab..32ec019 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -268,6 +268,37 @@ jobs: echo "Setting version $VERSION for all libs" npx nx release version "$VERSION" --git-commit=false --git-tag=false + - name: Update demo app dependency versions + if: ${{ inputs.dry_run != true }} + shell: bash + run: | + VERSION="${{ steps.version.outputs.version }}" + echo "Updating @enclave-vm/* dependencies in apps to $VERSION" + for pkg in apps/*/package.json; do + [ -f "$pkg" ] || continue + # Update any @enclave-vm/* dependency versions + node -e " + const fs = require('fs'); + const p = JSON.parse(fs.readFileSync('$pkg', 'utf8')); + let changed = false; + for (const section of ['dependencies', 'devDependencies', 'peerDependencies']) { + if (!p[section]) continue; + for (const [name, ver] of Object.entries(p[section])) { + if (name.startsWith('@enclave-vm/') && ver !== '$VERSION') { + p[section][name] = '$VERSION'; + changed = true; + } + } + } + if (changed) { + fs.writeFileSync('$pkg', JSON.stringify(p, null, 2) + '\n'); + console.log('Updated: $pkg'); + } else { + console.log('No changes: $pkg'); + } + " + done + - name: Commit version bump if: ${{ inputs.dry_run != true }} run: | diff --git a/apps/streaming-demo/package.json b/apps/streaming-demo/package.json index 77a88e4..a46b797 100644 --- a/apps/streaming-demo/package.json +++ b/apps/streaming-demo/package.json @@ -11,10 +11,10 @@ "runtime": "ts-node src/runtime-server.ts" }, "dependencies": { - "@enclave-vm/broker": "2.10.0", - "@enclave-vm/client": "2.10.0", - "@enclave-vm/types": "2.10.0", - "@enclave-vm/core": "2.10.0", + "@enclave-vm/broker": "2.11.0", + "@enclave-vm/client": "2.11.0", + "@enclave-vm/types": "2.11.0", + "@enclave-vm/core": "2.11.0", "express": "^4.21.0", "zod": "^3.24.0" },