add: automated release flow for widgets/packages, and event dispatch for automated wallet integration trigger by L03TJ3 · Pull Request #131 · GoodDollar/GoodWidget

L03TJ3 · 2026-07-29T09:57:12Z

Description

This PR adds a guarded production release path for the publishable GoodWidget packages and the wallet-facing widget integration contract that release automation depends on.

Summary

add a PR validation workflow plus protected promote-next, release-next, and recover-release workflows for npm publication
add release scripts that detect affected production packages, bump authoritative versions on next, rebuild/package them, publish with provenance, verify npm integrity/latest, tag releases, and optionally notify GoodWallet
add a v2 widget integration manifest schema plus checked-in integration-manifest.json files for production widgets, with validation for schema shape, package exports, tarball contents, and npm publication metadata
make widget ./register entries SSR-safe so Node/Next.js can inspect published packages without eagerly touching DOM globals, and keep web-component dispatch wiring available for wallet automation after a verified release

Operational flow

validate-release.yml runs on PRs that touch release-relevant files and checks the release contract with:
- pnpm test:release
- pnpm lint
- pnpm build
- pnpm validate:register-entries
A maintainer manually runs Promote main to next. main stays the development/deployment branch; only next is allowed to publish packages.
A push to next triggers Release production packages, which:
- computes the affected published packages (including transitive consumers)
- updates package versions and pnpm-lock.yaml
- lint/builds/tests and verifies SSR-safe ./register exports
- packs tarballs and checks that required artifacts are present
- commits the authoritative release versions back to next
- publishes packages to npm with provenance
- waits for npm to reflect both the immutable version and the latest dist-tag
- creates and pushes per-package git tags
- dispatches widget release payloads to GoodWallet only after npm verification succeeds
If publication is interrupted after version commit, Recover committed npm release republishes or verifies the already-committed version and can replay the post-release wallet dispatch.

Required release environment configuration

Protected release environment configuration expected by these workflows:

NPM_TOKEN — required for npm publication
GOODWALLET_DISPATCH_PAT — required only when GoodWallet repository dispatch is enabled
ENABLE_GOODWALLET_DISPATCH — protected repository/environment variable gate; dispatch remains disabled unless this is explicitly set to true

Additional implementation notes

production package metadata is normalized/validated for license, repository source, and public access
widget integration manifests are published as package exports so downstream consumers can inspect immutable widget identity and entry points
release automation is intentionally topological so shared packages publish before widget consumers
CODEOWNERS now requires maintainer review for release workflows, release scripts, schemas, and widget integration manifests

Related work: #132

How Has This Been Tested?

Release-contract validation added in this PR is exercised through:

pnpm test:release
pnpm lint
pnpm build
pnpm validate:register-entries

Checklist:

…for automated wallet integration trigger

Copilot

Pull request overview

This PR introduces a production release pipeline for GoodWidget packages/widgets (versioning → build/pack/publish → tag → optional GoodWallet dispatch), and formalizes a widget integration manifest contract validated in CI. It also updates widget register entry points to be SSR-safe by deferring browser-only imports until a Custom Elements runtime is detected.

Changes:

Add release tooling (scripts/release/*) plus GitHub Actions workflows to validate, promote, release, and recover npm publications.
Introduce a v2 widget integration manifest schema + per-widget integration-manifest.json, and enforce package publication metadata consistency.
Make widget register entry points SSR-safe (dynamic element imports + DOM guards) and adjust embed/core/ui packaging details to support safe package inspection.

Reviewed changes

Copilot reviewed 47 out of 48 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
scripts/release/validate-register-entries.mjs	Validates that every production widget `./register` export is SSR-safe for both ESM and CJS builds.
scripts/release/validate-packages.mjs	Enforces consistent npm metadata (license, repo, publishConfig) across production packages and checks repository LICENSE.
scripts/release/validate-manifests.test.mjs	Adds unit tests for manifest validation and release-envelope creation logic.
scripts/release/validate-manifests.mjs	Implements schema + contract validation for widget integration manifests and release-envelope creation.
scripts/release/release.mjs	Adds automated versioning, packing, publishing, tagging, verification, and optional GoodWallet dispatch.
scripts/release/packages.test.mjs	Tests release relevance and dependency-cascade selection logic for the production allowlist.
scripts/release/packages.mjs	Defines the production allowlist + dependency graph and release-relevance rules.
schemas/widget-integration-manifest.schema.json	Adds JSON Schema (draft 2020-12) for integration manifest v2.
pnpm-lock.yaml	Locks Ajv version and updates workspace protocol ranges used by packages.
packages/ui/src/components-test/Select.tsx	Removes an unused Tamagui type import.
packages/ui/src/components-test/Input.tsx	Ensures both `onChange` and `onChangeText` are forwarded to the input frame.
packages/ui/src/clipboard.ts	Removes an unused type definition.
packages/ui/package.json	Adds publish metadata (license/repo/files/publishConfig/sideEffects) for release validation.
packages/streaming-widget/src/register.ts	Makes web-component registration SSR-safe via DOM guard + dynamic import; switches to async `register`.
packages/streaming-widget/package.json	Adds publish metadata, integration-manifest export, sideEffects, and updates workspace ranges.
packages/streaming-widget/integration-manifest.json	Adds v2 integration manifest for the streaming widget.
packages/staking-migration-widget/src/register.ts	Makes registration SSR-safe via DOM guard + dynamic import; switches to async `register`.
packages/staking-migration-widget/package.json	Adds publish metadata, integration-manifest export, sideEffects, and updates workspace ranges.
packages/staking-migration-widget/integration-manifest.json	Adds v2 integration manifest for the staking migration widget.
packages/governance-widget/package.json	Adds `license` field.
packages/goodreserve-widget/src/register.ts	Makes registration SSR-safe via DOM guard + dynamic import; switches to async `register`.
packages/goodreserve-widget/package.json	Adds publish metadata, integration-manifest export, sideEffects, and updates workspace ranges.
packages/goodreserve-widget/integration-manifest.json	Adds v2 integration manifest for the goodreserve widget.
packages/embed/src/createMiniAppElement.tsx	Avoids hard-failing on missing DOM globals during SSR/package inspection; minor filter cleanup.
packages/embed/package.json	Adds publish metadata and updates workspace ranges.
packages/core/src/detect.ts	Removes unused type import.
packages/core/package.json	Adds publish metadata and updates workspace ranges.
packages/claim-widget-theme-demo/src/register.ts	Adds a `customElements` guard (but still statically imports element, which undermines SSR safety).
packages/claim-widget-theme-demo/package.json	Adds `license` field.
packages/citizen-claim-widget/src/register.ts	Makes registration SSR-safe via DOM guard + dynamic import; switches to async `register`.
packages/citizen-claim-widget/package.json	Adds publish metadata, integration-manifest export, sideEffects, bumps stable version, updates workspace ranges.
packages/citizen-claim-widget/integration-manifest.json	Adds v2 integration manifest for the citizen claim widget.
packages/ai-credits-widget/src/register.ts	Makes registration SSR-safe via DOM guard + dynamic import; switches to async `register`.
packages/ai-credits-widget/src/chainClient.ts	Adjusts mock method signatures (currently diverges from interface parameter lists).
packages/ai-credits-widget/src/backendClient.ts	Adjusts mock method signatures (currently diverges from interface parameter lists).
packages/ai-credits-widget/package.json	Adds publish metadata, integration-manifest export, sideEffects, and updates workspace ranges.
packages/ai-credits-widget/integration-manifest.json	Adds v2 integration manifest for the AI credits widget.
package.json	Adds MIT license, release/validation scripts, and Ajv devDependency.
LICENSE	Adds MIT LICENSE text required by release validation.
docs/PACKAGING.md	Updates packaging guidance to recommend SSR-safe async `register` with dynamic element import.
.github/workflows/validate-release.yml	Adds CI workflow to validate release contracts (manifests/packages/register entry SSR safety).
.github/workflows/release-next.yml	Adds branch-gated npm release workflow (next-only), including optional GoodWallet dispatch.
.github/workflows/recover-release.yml	Adds a recovery workflow to republish/verify an already-committed version.
.github/workflows/promote-next.yml	Adds a maintainer-gated workflow to promote main → next.
.github/workflows/deploy-storybook.yml	Pins actions by SHA and sets minimal permissions.
.github/workflows/deploy-ai-credits-web.yml	Pins actions by SHA and sets minimal permissions.
.github/workflows/copilot-setup-steps.yml	Pins actions by SHA for deterministic Copilot setup.
.github/CODEOWNERS	Adds maintainers as owners for release automation and integration contract files.

Files not reviewed (1)

pnpm-lock.yaml: Generated file

Comments suppressed due to low confidence (3)

packages/ai-credits-widget/src/chainClient.ts:313

MockAiCreditsChainClient.getWithdrawableUsd no longer accepts the buyer parameter, even though the interface requires it. This makes direct calls on the mock type-invalid. Keep the signature consistent and ignore the argument if unused.

  async getWithdrawableUsd(): Promise<string> {
    return '0'
  }

packages/ai-credits-widget/src/backendClient.ts:441

MockAiCreditsBackendClient.closeChannel dropped the optional body parameter even though the interface includes it. This makes it harder to use the mock as a drop-in replacement when code passes request bodies.

  async closeChannel(channelId: string): Promise<ChannelOperationResponse> {
    await sleep(MOCK_DELAY_MS)
    return { channelId, action: 'close', bridge: { enabled: true, txHash: '0xmock' } }
  }

packages/ai-credits-widget/src/backendClient.ts:458

MockAiCreditsBackendClient.submitOperatorConsent removed the required body parameter, but AiCreditsBackendClient.submitOperatorConsent requires it (and callers pass it). This prevents using the mock directly without retyping it as the interface. Keep the parameter and ignore it if unused.

  async submitOperatorConsent(buyer: string): Promise<OperatorConsentResponse> {
    await sleep(MOCK_DELAY_MS)
    const normalizedBuyer = normalizeAddress(buyer)
    markMockOperatorConsent(normalizedBuyer)

L03TJ3 · 2026-07-30T15:16:05Z

@copilot can you produce a pull-request description for the changes proposed

Copilot · 2026-07-30T15:20:27Z

@copilot can you produce a pull-request description for the changes proposed

Updated the PR description with the release flow, required release environment configuration, manifest/SSR packaging changes, and the verification commands.

L03TJ3 · 2026-07-31T08:49:31Z

@copilot Follow up on your comments and resolve:

there should be no effective changes to ai-credits-widgets that are not related to supporting the release of the widget or integration in the wallet

Co-authored-by: L03TJ3 <6606028+L03TJ3@users.noreply.github.com>

Copilot · 2026-07-31T08:55:04Z

@copilot Follow up on your comments and resolve:

there should be no effective changes to ai-credits-widgets that are not related to supporting the release of the widget or integration...

Addressed in a2d8ca6.

I reverted the unrelated ai-credits mock signature changes, fixed the SSR-safe lazy import for claim-widget-theme-demo/register, and hardened manifest validation so malformed nested objects fail with a clear error.

add: automated release flow for widgets/packages, and event dispatch …

1b56b15

…for automated wallet integration trigger

Copilot AI review requested due to automatic review settings July 29, 2026 09:57

Copilot started reviewing on behalf of L03TJ3 July 29, 2026 09:57 View session

Copilot AI reviewed Jul 29, 2026

View reviewed changes

This was referenced Jul 29, 2026

Prepare AI Credits Widget for GoodWallet Integration #132

Open

[PLAN] Prepare AI Credits Widget for GoodWallet integration #133

Open

Copilot AI mentioned this pull request Jul 29, 2026

Prepare AI Credits Widget for GoodWallet integration #134

Open

Copilot started work on behalf of L03TJ3 July 30, 2026 15:16 View session

L03TJ3 temporarily deployed to internal July 30, 2026 15:20 — with GitHub Actions Inactive

L03TJ3 deployed to preview July 30, 2026 15:20 — with GitHub Actions View deployment

Copilot finished work on behalf of L03TJ3 July 30, 2026 15:20

Copilot started work on behalf of L03TJ3 July 31, 2026 08:50 View session

Fix release follow-up review items

a2d8ca6

Co-authored-by: L03TJ3 <6606028+L03TJ3@users.noreply.github.com>

Copilot finished work on behalf of L03TJ3 July 31, 2026 08:55

L03TJ3 marked this pull request as ready for review July 31, 2026 09:35

L03TJ3 requested a review from a team July 31, 2026 09:35

L03TJ3 temporarily deployed to internal July 31, 2026 09:35 — with GitHub Actions Inactive

L03TJ3 deployed to preview July 31, 2026 09:35 — with GitHub Actions View deployment

L03TJ3 requested a review from sirpy July 31, 2026 09:38

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

add: automated release flow for widgets/packages, and event dispatch for automated wallet integration trigger - #131

add: automated release flow for widgets/packages, and event dispatch for automated wallet integration trigger#131
L03TJ3 wants to merge 2 commits into
mainfrom
widget-release-flow

L03TJ3 commented Jul 29, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

L03TJ3 commented Jul 30, 2026

Uh oh!

Copilot AI commented Jul 30, 2026

Uh oh!

L03TJ3 commented Jul 31, 2026

Uh oh!

Copilot AI commented Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

L03TJ3 commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Summary

Operational flow

Required release environment configuration

Additional implementation notes

How Has This Been Tested?

Checklist:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

L03TJ3 commented Jul 30, 2026

Uh oh!

Copilot AI commented Jul 30, 2026

Uh oh!

L03TJ3 commented Jul 31, 2026

Uh oh!

Copilot AI commented Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

L03TJ3 commented Jul 29, 2026 •

edited

Loading