[sfmskywalker]

Cherry-pick of #9042 (main 4b34093b) onto release/3.10.0.

Refs #8725

git cherry-pick -x 4b34093b applied cleanly. The candidate inventory baseline was regenerated from release/3.10.0 itself: 366 projects, 231 packages, 135 exclusions. That package set is the 231-ID list. This is not main's 233/158 inventory.

build_npm needs build. publish_npm publishes the Studio pair to Feedz only. npmjs.com is not in this job. Stable 3.10.x npm stays fail-closed. No publish or Feedz dispatch was run.

Scope

• Bug fix (behavior change)
• Refactor (no behavior change)
• Documentation update
• Formatting / code cleanup
• Dependency / build update
• New feature

Checklist

• The PR is focused on a single concern
• Commit messages follow the recommended convention
• Tests added or updated (if applicable)
• Documentation updated (if applicable)
• No unrelated cleanup included
• All tests pass

  

[sfmskywalker]

@elsa-workflows-bot review

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Essentials
• Run ID: a35a1cd3-ac04-4ecc-83c1-dad6cf4bae5c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] No outstanding findings block merging. The previously reported Studio npm build failure is addressed in the current workflow.

Summary

This PR adds the 231-package build path for the 3.10.0 tag and Studio npm publication to Feedz.

• The 3.10.0 tag now packs the branch's 231-ID release candidate.
• Operators can publish the Studio npm pair to Feedz from eligible release tags.

_{Reviews (2) · Last reviewed commit: "fix(ci): keep packages build_npm from wr..." · Reviewed by Greptile}

[elsa-workflows-review-bot]

Elsa 3 Code Review: REQUEST_CHANGES + HIGH @ b04e078

Code Review, Round 1/6

This is the [3.10] pick of #9042 (4b34093b). The pick itself is faithful, but one inherited bug stops the new build_npm job on any allowed tag, so this can't merge as is.

What I checked

• Faithful backport. Every changed line in the 8 script, test and skill files matches #9042. packages.yml and package-publisher-gates.md differ only in the comment and doc wording about the per-branch baseline. Nothing else changes behaviour.
• Baseline matches the ID set. consolidated-candidate-inventory-baseline.json at this head has 231 packages and 135 exclusions (366 projects). The package IDs exactly match scripts/validate_packages_id_set.txt (231 on each side, no differences). Every listed project exists on this branch, with no duplicates. evidence.source_commit is the cherry-pick commit 4c272d6f. The follow-up commit only touches the JSON, so the evaluation still holds for this head. There are no Studio BPMN/X6 rows, so main's 233/158 inventory did not leak in.
• Patch safety on release/3.10.0. Branch pushes and non-3.10.0 tags still run Core-only Compile+Pack. Only a 3.10.0 release event, or a non-promote dispatch from that tag, takes the consolidated pack. That pack writes to ./packages, so the existing elsa-nuget-packages upload and the PACKAGES_DIR 231-ID guard see the same bytes. The consolidated pack's own clean-worktree check is safe, because its imports stay under scripts/integration-program/ and that folder ignores __pycache__/. Stable 3.10.x npm is rejected both in selection and in the job. build_npm keeps needs: build. The npmjs host check uses a regex.
• The other changes apply to every build run: the 180-minute timeout and the extra 8.0/9.0 SDKs. There's no root global.json, so SDK selection still resolves to 10.x. That's acceptable, and it's the same as main.

Blocking

1. build_npm fails source-checkout before it builds anything (packages.yml, the "Build the Studio npm pair" step). This confirms Greptile's P1. prove_studio_npm_pair.py loads .agents/skills/elsa-release/scripts/verify_packages.py with spec_from_file_location plus exec_module, and that writes .agents/skills/elsa-release/scripts/__pycache__/. No .gitignore covers that path: the root file only ignores extensions/src/**/__pycache__/, and the scripts/integration-program/ one doesn't reach .agents/. prove() then requires an empty git status --porcelain and fails with source-checkout. Every allowed publish_npm dispatch (3.10.x prerelease tags) therefore fails, and nothing gets published. studio-npm-pair.yml avoids this with PYTHONDONTWRITEBYTECODE: '1'.
   • Fix: add env: PYTHONDONTWRITEBYTECODE: '1' to the build_npm job or step. Prefer that over python3 -B: the gates validator finds the step by the exact NPM_PAIR = "python3 scripts/integration-program/prove_studio_npm_pair.py" substring, and -B would break that match. Pin the env in validate_packages_workflow_gates.py, with a test in test_validate_packages_workflow_gates.py, so the regression can't come back.
   • The same bug is already on main through #9042. Land the fix on main and add it to this pick, or carry the same commit on both branches, so the two workflows don't drift.

Non-blocking

• Greptile P2: validate-packages-gates.yml now triggers on prove_studio_npm_pair.py and its test, but none of its commands runs test_prove_studio_npm_pair.py, because the test_prove_consolidated*.py discovery skips it. Other PR workflows do run it, so this is a gap in this check, not lost coverage. It's worth adding a focused discovery line when the blocker fix touches this area.
• Carried from #9042: publish WASM before React explicitly instead of relying on glob order, the publish_npm input description, and the npmjs with: check. The already-published detection only greps EPUBLISHCONFLICT|cannot publish over. Feedz may answer a re-publish with a different error (for example a 409), which would turn a rerun red. That's fine for now, but worth confirming on the first prerelease dispatch.
• Maintainability: the refs/tags/3.10.0 and stable-3.10.x if: expressions are now repeated across the setup-python, Compile+Pack, Pack and Upload steps. A follow-up on main could compute them once as step outputs. It's not a reason to hold this pick.
• The cherry-pick message carries the full squash history, including "Keep Elsa.Testing.Extensions unpackable", which isn't in the final diff. That only matters for anyone reading the log.

CI

At posting time, validate-gates, select-tests, retained-testing-helper, CLA, GitGuardian and Greptile are green. ubuntu-latest and import-rehearsal-tests are still running. This verdict doesn't depend on them.

— Code Review (Elsa 3), via Elsa Review

[sfmskywalker]

@elsa-workflows-bot review

[elsa-workflows-review-bot]

Elsa 3 Code Review: APPROVE + HIGH @ e54f5e3

Code Review, Round 2/6

The R1 blocker is fixed, and the delta since b04e078a is small and contained. Approving.

What I checked (delta b04e078a..e54f5e3e, 3 files, +14/-0)

• R1 blocker fixed. build_npm now sets job-level env: PYTHONDONTWRITEBYTECODE: '1' (packages.yml:526-527), the same setting studio-npm-pair.yml uses. Python reads it at startup, so the in-process exec_module of .agents/skills/elsa-release/scripts/verify_packages.py no longer writes __pycache__/, and the source-checkout porcelain check at prove_studio_npm_pair.py:457 (and the re-check at :517) sees a clean tree. The helper's child processes, which run with a filtered env, only run npm and dotnet, so dropping the variable there doesn't matter. Because the setting is job-level, it covers every Python step in the job, and the pair command keeps the exact python3 scripts/integration-program/prove_studio_npm_pair.py text, so the gates NPM_PAIR match still holds.
• Validator pin. build_npm_violations now rejects a missing or non-"1" PYTHONDONTWRITEBYTECODE (it safely tolerates a non-dict env). test_build_npm_must_set_pythondontwritebytecode removes the block through mutated(), which asserts that its anchor occurs exactly once. packages.yml has only one env: block of that shape, so the test targets build_npm and nothing else. validate-gates is green on this head, which covers both the real-workflow pass and the new rejection.
• Same commit as main. The delta matches #9067 (6a70171f) line for line, so release/3.10.0 and main won't drift once #9067 lands.
• No regressions. Nothing else changed. The baseline (231/135, equal to the ID set), the Core-only behaviour on branches and non-3.10.0 tags, and the stable-3.10.x npm rejection are all as I verified in R1.

Non-blocking (carried, not reasons to hold)

• Greptile P2: validate-packages-gates.yml still doesn't discover test_prove_studio_npm_pair.py. Other PR workflows run it, so this is a gap in this check only. It's a good follow-up on main.
• From #9042: publish WASM before React explicitly instead of relying on glob order, tidy the publish_npm input description, and confirm on the first prerelease dispatch that Feedz's re-publish error matches the EPUBLISHCONFLICT|cannot publish over detection.
• Maintainability: compute the repeated refs/tags/3.10.0 and stable-3.10.x if: expressions once, as a follow-up on main.

Threads

Both Greptile threads are resolved. The P1 is fixed on this head and the P2 was answered as non-blocking. CodeRabbit skipped this PR because of its non-default base.

CI

All checks are green on this head: validate-gates, ubuntu-latest, import-rehearsal-tests, select-tests, retained-testing-helper, CLA, GitGuardian and Greptile. run-affected-tests was skipped.

This PR changes CI workflows on the release path, so I'm approving and leaving the merge to the Lead/owner (--match-head-commit e54f5e3e067295616eef96d8344c6914d869d42a).

— Code Review (Elsa 3), via Elsa Review