ci: fix binary drift — releases now build + commit binaries atomically - #10
Merged
Conversation
…cally The 0.3.0 release shipped binaries from March that predated the cc_workspace override (and other June features), so plugin traces went to the SDK workspace instead of cc_workspace. Root cause: build.yml auto-committed rebuilt binaries directly to main, but a main-branch ruleset now requires PRs, so the bot's push was rejected (GH006). The build silently failed and a stale binary was released. Marketplace installs clone main HEAD from the git tree (not release assets), so bin/ on main must always match src/. Fix: - release.yml: convert to a manually-triggered workflow_dispatch that bumps the version in plugin.json, rebuilds binaries, and commits both in one commit, then tags and publishes. Pushes via GH_PAT_TO_ACCESS_GITHUB_API so it can write to the protected main branch. Version and binaries can no longer drift. - build.yml: reduce to a PR-only compile check (go vet + make build); no longer pushes to main. - Makefile: add -trimpath so cross-platform builds are reproducible across hosts. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
collincunn
approved these changes
Jun 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
Changes how the plugin's Go binaries get built and released, so a release can never again ship a binary that's out of date with the source.
Why
The 0.3.0 release shipped binaries that were built back in March — before the
cc_workspacefeature (and other June changes) existed. That's why Claude Code traces were going to the wrong Opik workspace even though the config and source code were both correct.The reason the binaries were stale: CI used to rebuild them on every push to
mainand commit them straight back tomain. Butmainis now a protected branch that requires pull requests, so CI's direct push got rejected every time:CI didn't fail loudly — the binaries just silently never updated, and the next release picked up the old ones.
This matters because installing the plugin pulls the binaries committed in the repo (
main), so if those are stale, every user gets stale binaries.The fix
release.yml— now a single button you trigger manually (Actions → Release, orgh workflow run release.yml -f version=0.3.1). It bumps the version, rebuilds the binaries, and commits both together, then tags and publishes the release. Version and binaries always move as one, so they can't drift apart. It pushes tomainusing a PAT that's allowed past branch protection (same approach the mainopikrepo uses).build.yml— simplified to a PR check that just confirms the code still compiles (go vet+make build). It no longer tries to push tomain.Makefile— added-trimpathso builds are reproducible regardless of which machine runs them.How to cut a release after this merges
Actions tab → Release → Run workflow → enter the version (e.g.
0.3.1), or:One-time setup needed from an org admin
The release workflow can only push to
mainif:GH_PAT_TO_ACCESS_GITHUB_APIorg secret is shared with this repo.mainbranch rule.(The same PAT already pushes to
mainin theopikrepo, so this likely already works org-wide.)Good to know
Binaries are now rebuilt only at release time. So after merging meaningful source changes, cut a release — otherwise
mainwill temporarily serve binaries that lag the source to anyone installing in between.🤖 Generated with Claude Code