ci(publish): push next-dev version bump as version-bot to bypass main ruleset

[NiveditJain]

Problem

The Publish to npm workflow's final step, "Bump version for next development cycle", does git push origin main to commit the next -beta.N version back to package.json. That push is rejected:

remote: error: GH013: Repository rule violations found for refs/heads/main.
remote: - Changes must be made through a pull request.
 ! [remote rejected] main -> main (push declined due to repository rule violations)

The org-level failproofai-rules ruleset requires a pull request + 1 approving review on main. The step pushed with the ambient GITHUB_TOKEN, which is not a bypass actor on that ruleset — so the automated chore: bump version … commit was declined and every release left package.json un-bumped. As a result main drifted to 0.0.14-beta.1 while npm published through 0.0.14-beta.2.

Fix (workflow)

Mirror the pattern bump-platform-submodule.yml already uses: mint a token for the version-bot GitHub App, which is a bypass actor on the same failproofai-rules ruleset.

• Add a Mint version-bot app token step (actions/create-github-app-token@v3) using the existing VERSION_BOT_APP_ID / VERSION_BOT_PRIVATE_KEY secrets.
• Persist that token through actions/checkout (token: ${{ steps.app-token.outputs.token }}) so the later git push origin main authenticates as the bypass actor. This avoids the persisted-credential (extraheader) gotcha a per-push URL token would hit.

The bump commit keeps its [skip ci] marker. That matters more now: an App-token push (unlike a GITHUB_TOKEN push) can trigger workflows, and [skip ci] keeps the version-only bump from spuriously firing ci.yml / bump-platform-submodule.yml.

Version reconcile

Because the auto-bump had been failing, main's package.json was stale at 0.0.14-beta.1. This PR also sets it to 0.0.14-beta.3 — the next development version the now-fixed automation carries forward after the 0.0.14-beta.2 release — and re-files the CHANGELOG under a matching ## 0.0.14-beta.3 heading (per repo convention: top heading matches package.json).

Why no test

There is no GitHub-Actions-workflow test harness in __tests__/ (only hook-policy tests), and the sibling bump-platform-submodule.yml app-token usage has no test either. YAML validity was checked locally (yaml.safe_load). The real verification is the next release run pushing the bump cleanly. The CI quality job's version-consistency check is unaffected (packages/ does not exist, so it no-ops).

Scope

CI/release-pipeline + a one-line package.json version reconcile. No source, CLI, public API, or docs surface changes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01S2iLV7NxXH9UY4ZMYLzzcN

Summary by CodeRabbit

• Bug Fixes
  • Fixed the post-publish version bump failing on the main branch.
  • Ensured version bumps authenticate correctly to complete automation under the repository ruleset.
  • Corrected main’s package.json version to match what was published.
• Documentation
  • Updated CHANGELOG.md with the publishing workflow fix and version reconciliation details.

[coderabbitai]

📝 Walkthrough

Walkthrough

The publish workflow now authenticates checkout and subsequent version-bump pushes with a version-bot GitHub App token. The package version is updated to 0.0.14-beta.3, and the changelog records the GH013 fix.

Changes

Publish workflow authentication and release metadata

Layer / File(s)	Summary
Mint and use the version-bot token .github/workflows/publish.yml, package.json, CHANGELOG.md	The workflow mints and persists the App token for checkout and version-bump pushes, comments explain the ruleset bypass, the package version becomes 0.0.14-beta.3, and the changelog records the fix and version correction.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PublishWorkflow
  participant GitHubApp
  participant Repository
  PublishWorkflow->>GitHubApp: Mint version-bot token
  GitHubApp-->>PublishWorkflow: Return App token
  PublishWorkflow->>Repository: Checkout with persisted token
  PublishWorkflow->>Repository: Push version bump as version-bot

Loading

Possibly related PRs

• FailproofAI/failproofai#504: Modifies workflow authentication for version-bump pushes using the version-bot token.
• FailproofAI/failproofai#505: Updates version-bot token minting and checkout usage.
• FailproofAI/failproofai#506: Updates the package version and changelog release metadata.

Suggested reviewers: hermes-exosphere

Poem

I’m a rabbit with a token to spare,
Minted by bots in workflow air.
Main-branch gates let version bumps through,
GH013 fades from the morning view.
Beta carrots hop anew!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the workflow change to push the version bump as version-bot and bypass the main ruleset.
Description check	✅ Passed	It explains the issue, workflow fix, version reconcile, and testing rationale, though it doesn't mirror the exact template headings/checklist.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hermes-exosphere]

Automated code review started - full review. Results will be posted here.

[hermes-exosphere]

⏳ Automated review in progress — Phase 2 analysis complete. Starting Phase 3: Build & Test.

[hermes-exosphere]

✅ Build & test complete. Results:

• Build: N/A (CI workflow YAML changes only, no source/build changes)
• Tests: 2328 passed / 0 failed (128 test files)
• YAML structure validated: app-token step correctly positioned before checkout, token correctly persists through checkout

Moving to Phase 4 — posting the full review.

[hermes-exosphere]

Automated review: Approved. No issues found — CI pipeline fix correctly mints a version-bot token to bypass the org-level ruleset, matching the existing bump-platform-submodule pattern. All 2328 tests passing.

[hermes-exosphere]

Code Review Summary

Executive Summary

PR #577 fixes the npm publish workflow: the post-publish version bump push to main was rejected because the default GITHUB_TOKEN is not a bypass actor on the org-level failproofai-rules ruleset. The fix mints a version-bot GitHub App token and persists it through actions/checkout, mirroring the pattern from bump-platform-submodule.yml. 12 lines of YAML, 1 changelog entry, no source changes.

Verdict: APPROVED

Evidence:

• 128 test files, 2328 tests passed
• YAML structure validated: token step before checkout, token persists through checkout, no GITHUB_TOKEN leak in push section
• Follows established pattern from bump-platform-submodule.yml

Deep Analysis Findings:

• Token minting uses existing secrets (VERSION_BOT_APP_ID, VERSION_BOT_PRIVATE_KEY) - no new secrets needed
• [skip ci] marker retained on bump commit - critical since App-token pushes CAN trigger workflows
• No hardcoded tokens, keys, or credentials

No Issues Found. The change is correct, minimal, and well-commented.

Suggestions (non-blocking):

1. Consider pinning actions/create-github-app-token to a commit SHA (rest of workflow uses semver pins too - not a regression)
2. The Bump step does git checkout main unconditionally - existing behaviour, unchanged

Automated review - 2026-07-20

[hermes-exosphere]

Automated review: Approved. ✅