[amondnet]

Summary

@pleaseai/emulate@0.4.0 cannot be installed. Its tarball pins the service packages to their previous versions, and two of those were never published:

npm view @pleaseai/emulate@0.4.0 dependencies
  "@pleaseai/emulate-asana": "0.3.1", ...           # package.json at the tag: 0.3.2
  "@pleaseai/emulate-jira": "0.3.0",                # never published
  "@pleaseai/emulate-tossinvest": "0.3.0",          # never published

0.3.1 has the same defect: it pins every service package to 0.3.0, which was never published.

Cause: on Bun 1.4.3, the version pinned in mise.toml and used by the publish job, bun pm pack writes each workspace:* dep at the version in that package's bun.lock workspace entry, not the one in its package.json. release-please bumps package.json only, and bun install --frozen-lockfile does not flag the drift. So every release packs the versions from the release before it. Bun 1.4.4 reads package.json instead, which is why a local pack on 1.4.4 looks correct.

This PR changes the publish job:

• Sync the lockfile: a non-frozen bun install runs after the frozen one. On the release commit it rewrites only the 16 workspace version lines in bun.lock.
• Verify before publishing: a new step packs every released package. It compares each in-repo dep in the packed package.json against that package's package.json version. If any differ, the step fails, and because publishing is now a separate step that runs only after every tarball passes, nothing is published.

It also re-releases only @pleaseai/emulate as 0.4.1:

• release-as: 0.4.1 for packages/emulate in release-please-config.json.
• packages/emulate/README.md: the npm page has no README. It also says to install 0.4.1 or later. This file is also what makes release-please pick up packages/emulate: a path with no commits is skipped even when it has release-as.

Verification

• Fresh clone of main, bun install --frozen-lockfile, then pack packages/emulate:
  • Bun 1.4.3: deps pinned at 0.3.1/0.3.0, the same as the published 0.4.0.
  • Bun 1.4.4: deps pinned at 0.3.2/0.3.1.
• Extracted the new "Pack and verify" run block and ran it with bash -eo pipefail on Bun 1.4.3, with PATHS_RELEASED='["packages/asana","packages/emulate"]':
  • Before bun install: exit 1, with all 15 mismatches listed (@pleaseai/emulate-jira: packed 0.3.0, package.json 0.3.1, ...).
  • After bun install: exit 0. Both tarballs are listed for the publish step. The bun.lock diff is 16 version lines.
• actionlint and shellcheck pass on the workflow and the extracted script. eslint passes on the changed files.
• release-please@17.6.0 release-pr --dry-run against this branch: packages/emulate → 0.4.1 (Setting version for packages/emulate from release-as configuration). The other 15 paths are skipped with No commits for path.
• I did not run npm publish.

Follow-up after 0.4.1 is published

• Remove release-as from packages/emulate. While it is set, every later release of the package tries 0.4.1 again.
• Deprecate the broken versions (requires an npm owner with 2FA):

  npm deprecate @pleaseai/emulate@0.4.0 "Broken dependency pins; install 0.4.1 or later"
  npm deprecate @pleaseai/emulate@0.3.1 "Broken dependency pins; install 0.4.1 or later"

• Not in this PR: moving mise.toml to Bun 1.4.4 would also stop the stale pins. The new check stays useful either way.

Related issue

Follow-up to #52 and #53 (the 0.3.2 / 0.4.0 release).

Checklist

• PR title follows Conventional Commits
• Tests added or updated (not applicable: workflow, release config, and README only. The workflow check was run locally as described above)
• Lint/format pass (eslint on changed files, actionlint, shellcheck)
• Documentation updated if behavior changed (packages/emulate/README.md)
• No breaking change

---

Summary by cubic

Fixes @pleaseai/emulate 0.3.1 and 0.4.0 being uninstallable: both tarballs pin the @pleaseai/emulate-* service packages to versions that were never published. On Bun 1.4.3, bun pm pack writes workspace:* deps from bun.lock instead of package.json, and release-please bumps only package.json, so every release packs stale pins.

The publish job now syncs bun.lock with a non-frozen bun install, then packs every released package and compares each in-repo dep in the tarball against the package's package.json version; any mismatch fails the step before anything is published. This PR also re-releases @pleaseai/emulate as 0.4.1 via release-as and adds the README the npm page was missing, including how --service and the config choose which services start. Not included: bumping mise.toml to Bun 1.4.4 (which reads package.json instead), so the new verification guard stays useful regardless.

Follow-up after 0.4.1 ships

• Remove release-as from packages/emulate, or later releases will keep retrying 0.4.1.
• Deprecate 0.4.0 and 0.3.1 on npm; requires an owner with 2FA.

^{Written for commit 77aaab4. Summary will update on new commits.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; the earlier README issue is fixed.

Summary

The PR syncs workspace versions before packing and checks every released tarball before publishing.

• Released packages are checked before the workflow publishes them.
• The emulate package's release is set to 0.4.1.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Install dependencies] --> B[Sync workspace versions]
  B --> C[Build]
  C --> D[Pack all released packages]
  D --> E{Packed dependencies match?}
  E -->|Yes| F[Publish checked tarballs]
  E -->|No| G[Stop without publishing]

Loading

_{Reviews (2) · Last reviewed commit: "docs(emulate): explain how --service and..." · Reviewed by Greptile}

[cubic-dev-ai]

All reported issues were addressed across 3 files

Architecture diagram

sequenceDiagram
    participant GH as GitHub Actions
    participant RJ as release-please
    participant Pkg as Package Directory (packages/*)
    participant BL as bun.lock
    participant Pack as bun pm pack
    participant Verify as Verify Script
    participant NPM as npmjs.com

    Note over GH,NPM: Release Pipeline with Workspace Version Sync and Verification

    GH->>RJ: trigger release (main commit)
    RJ->>RJ: bump package.json versions (release-as: 0.4.1)
    RJ-->>GH: paths_released JSON output

    GH->>GH: checkout, bun install --frozen-lockfile
    GH->>BL: CHANGED: sync workspace versions (bun install)

    GH->>Pack: for each released package
    Pack->>Pkg: read package.json (workspace:* deps)
    Pack->>BL: read workspace version entries (Bun 1.4.3)
    Pack-->>GH: packed tarball with concrete dep versions

    GH->>Verify: CHANGED: verify packed deps
    Verify->>Pack: extract packed package.json
    Verify->>Pkg: read all workspace package.json versions
    alt all deps match
        Verify-->>GH: success, add tarball to list
    else any mismatch
        Verify-->>GH: fail with mismatch details
        GH->>GH: exit, nothing published
    end

    Note over GH,NPM: Publish step runs only if all tarballs verified

    GH->>NPM: publish verified tarball(s)
    NPM-->>GH: provenance attached via OIDC
    GH-->>GH: complete release

    Note over GH,RJ: Follow-up manual actions after 0.4.1 (not in PR)
    GH->>NPM: deprecate @pleaseai/emulate@0.4.0 and 0.3.1

Loading

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud