fix(release): align published manifest version

Author: BrainerVirus

package.json

@@ -62,6 +62,7 @@
     "test:integration": "bun test tests/integration/",
     "test:all": "bun test",
     "typecheck": "tsc --noEmit",
+    "prepack": "bun run scripts/verify-manifest-version.ts",
     "verify:release-candidate": "bun run scripts/verify-release-candidate.ts",
     "generate-readme": "bun run scripts/generate-readme.ts",
     "sync": "bun run scripts/sync-models.ts",

release.config.cjs

@@ -7,6 +7,10 @@ module.exports = {
       "@semantic-release/exec",
       {
         analyzeCommitsCmd: "bun scripts/analyze-release-scope.ts",
+        // Stamp manifest.pluginVersion from nextRelease.version before
+        // the npm plugin packs, so the published tarball embeds the
+        // version it is published as.
+        prepareCmd: "bun scripts/prepare-release-manifest.ts ${nextRelease.version}",
       },
     ],
     "./scripts/semantic-release-catalog-notes.cjs",

scripts/prepare-release-manifest.ts

@@ -0,0 +1,27 @@
+#!/usr/bin/env bun
+// Semantic Release prepare step: stamp manifest.pluginVersion from
+// nextRelease.version before @semantic-release/npm packs. Catalog fields stay
+// untouched; the post-release sync PR commits the stamped versions to main.
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+import { withPluginVersion, writeManifest, type CatalogManifest } from "../src/manifest.js";
+
+const ROOT = join(import.meta.dir, "..");
+
+function usage(): never {
+  console.error("usage: prepare-release-manifest.ts <version>");
+  process.exit(1);
+}
+
+const version = process.argv[2]?.trim() || "";
+if (!version) usage();
+
+const manifestPath = join(ROOT, "manifest.json");
+if (!existsSync(manifestPath)) {
+  console.error(`manifest not found at ${manifestPath}`);
+  process.exit(1);
+}
+
+const manifest = JSON.parse(readFileSync(manifestPath, "utf-8")) as CatalogManifest;
+writeManifest(manifestPath, withPluginVersion(manifest, version));
+console.log(`stamped manifest pluginVersion to ${version}`);

scripts/verify-manifest-version.ts

@@ -0,0 +1,30 @@
+#!/usr/bin/env bun
+// Prepack guard: manifest.pluginVersion must equal package.json version.
+// Accepts an optional root path so tests can exercise the mismatch case in a
+// temporary directory. Exits non-zero on mismatch, before npm packs/publishes.
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+
+const ROOT = process.argv[2] ? join(process.argv[2]) : join(import.meta.dir, "..");
+
+const pkgPath = join(ROOT, "package.json");
+const manifestPath = join(ROOT, "manifest.json");
+
+if (!existsSync(pkgPath) || !existsSync(manifestPath)) {
+  console.error(`missing package.json or manifest.json under ${ROOT}`);
+  process.exit(1);
+}
+
+const pkg = JSON.parse(readFileSync(pkgPath, "utf-8")) as { version?: string };
+const manifest = JSON.parse(readFileSync(manifestPath, "utf-8")) as {
+  pluginVersion?: string;
+};
+
+if (pkg.version !== manifest.pluginVersion) {
+  console.error(
+    `manifest pluginVersion ${manifest.pluginVersion ?? "(missing)"} != package.json ${pkg.version ?? "(missing)"}`,
+  );
+  process.exit(1);
+}
+
+console.log(`manifest version matches package.json (${pkg.version})`);

scripts/verify-release-candidate.ts

@@ -35,7 +35,22 @@ try {
       throw new Error(`tarball must not include ${banned}`);
     }
   }
-  console.log(`verified ${tgz} (${files.length} files)`);
+  const pkgJson = JSON.parse(
+    execSync(`tar -xzOf ${JSON.stringify(join(dir, tgz))} package/package.json`, {
+      encoding: "utf-8",
+    }),
+  ) as { version?: string };
+  const packedManifest = JSON.parse(
+    execSync(`tar -xzOf ${JSON.stringify(join(dir, tgz))} package/manifest.json`, {
+      encoding: "utf-8",
+    }),
+  ) as { pluginVersion?: string };
+  if (pkgJson.version !== packedManifest.pluginVersion) {
+    throw new Error(
+      `packed manifest pluginVersion ${packedManifest.pluginVersion ?? "(missing)"} != package.json ${pkgJson.version ?? "(missing)"}`,
+    );
+  }
+  console.log(`verified ${tgz} (${files.length} files, version ${pkgJson.version})`);
 } finally {
   rmSync(dir, { recursive: true, force: true });
 }

tests/unit/release-workflow.test.ts

@@ -186,11 +186,34 @@ describe("release.config.cjs", () => {
     expect(cfg.indexOf("@semantic-release/exec")).toBeLessThan(
       cfg.indexOf("semantic-release-catalog-notes.cjs"),
     );
-    expect(cfg.indexOf("semantic-release-changelog.cjs")).toBeLessThan(
-      cfg.indexOf("@semantic-release/npm"),
+    expect(cfg.indexOf("prepare-release-manifest")).toBeGreaterThan(
+      cfg.indexOf("@semantic-release/exec"),
     );
-    expect(cfg.indexOf("@semantic-release/npm")).toBeLessThan(
-      cfg.indexOf("@semantic-release/github"),
+  });
+
+  test("sets the manifest version from nextRelease before packing", () => {
+    const cfg = read("release.config.cjs");
+    expect(cfg).toContain("prepare-release-manifest");
+    expect(cfg).toContain("nextRelease.version");
+    expect(cfg).toContain("prepareCmd");
+  });
+});
+
+describe("prepare-release-manifest.ts", () => {
+  test("updates only pluginVersion from the release version", () => {
+    const src = read("scripts/prepare-release-manifest.ts");
+    expect(src).toContain("withPluginVersion");
+    expect(src).toContain("process.argv");
+  });
+});
+
+describe("verify-manifest-version.ts", () => {
+  test("guards the packed manifest against the package version", () => {
+    const src = read("scripts/verify-manifest-version.ts");
+    expect(src).toContain("pluginVersion");
+    expect(src).toContain("process.exit");
+    expect(json<{ scripts?: Record<string, string> }>("package.json").scripts?.prepack).toContain(
+      "verify-manifest-version",
     );
   });
 });
@@ -213,4 +236,9 @@ describe("verify-release-candidate.ts", () => {
       /\b(?:npm|npx|bun)\s+(?:publish|login|adduser)\b|\bgit\s+(?:push|tag)\b/,
     );
   });
+
+  test("rejects a packed manifest whose pluginVersion differs from package.json", () => {
+    const src = read("scripts/verify-release-candidate.ts");
+    expect(src).toContain("pluginVersion");
+  });
 });