Skip to content

Make release manifest shortNames legal install slugs - #397

Draft
Maximo-Guk wants to merge 1 commit into
mainfrom
maximo/release-slug-safe-shortname
Draft

Make release manifest shortNames legal install slugs#397
Maximo-Guk wants to merge 1 commit into
mainfrom
maximo/release-slug-safe-shortname

Conversation

@Maximo-Guk

@Maximo-Guk Maximo-Guk commented Aug 31, 2026

Copy link
Copy Markdown
Member

WIP

The deploy wizard sends a gatekeeper's manifest shortName as the install slug
verbatim, and the deploy service turns that slug into a GATEKEEPER_<SLUG>
binding name, so it rejects anything outside /^[a-z][a-z0-9]*$/.
gatekeeper-mcp-portal was the only installable gatekeeper whose shortName
carried a hyphen, so installing Mcp-Portal failed zod validation on the first
line of install() — before the workflow was ever created, surfacing to users as
a redacted "Something unexpected went wrong on our side." with no workflow logs.

Fold the release manifest's shortName into the slug charset via a new
releaseShortName(), leaving gatekeeperShortName() alone: staging and preview
bind gatekeepers as GATEKEEPER_<PKG_NAME> and the router maps _ back to -, so a
hyphen does round-trip there and folding globally would point their BASE_URL at
a 404.

Assert in the generator test that every emitted shortName is a legal slug. The
client passes shortName through unfolded, so this is what turns the next
hyphenated gatekeeper into a release-build failure instead of a runtime 500.

mcp-portal's deployed path becomes /gatekeeper/mcpportal, which stays
self-consistent end to end; it registers no external redirect URI.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@github-actions github-actions Bot added the delivery Changes to CI or release delivery label Aug 31, 2026
* bindings (underscores, router maps _ -> -) where a hyphen does round-trip.
*/
export function releaseShortName(pkgName: string): string {
return gatekeeperShortName(pkgName).replace(/[^a-z0-9]/g, "");

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P2] Guard against normalized short-name collisions

This transformation is lossy: for example, gatekeeper-foo-bar and gatekeeper-foobar both emit foobar. The deploy service then gives both installs the same GATEKEEPER_FOOBAR binding and the router can expose only one at /gatekeeper/foobar. The new manifest test checks validity per entry but not uniqueness, so such a release would pass. Please reject duplicate emitted shortNames (or use an explicit exceptional mapping) when assembling the manifest.

@ask-bonk

ask-bonk Bot commented Aug 31, 2026

Copy link
Copy Markdown

Posted 1 actionable inline finding.

github run

@github-actions

Copy link
Copy Markdown

Preview: pr397-maximo-releas-d3f8b0f9

https://pr397-maximo-releas-d3f8b0f9-router.cloudflare-os-previews.workers.dev

Dashboard · deleted when this PR closes

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

delivery Changes to CI or release delivery

1 participant