Skip to content

docs(skill): capture lessons from poly-uri bootstrap#12

Open
jadb wants to merge 1 commit into
mainfrom
docs/skill-lessons-from-poly-uri
Open

docs(skill): capture lessons from poly-uri bootstrap#12
jadb wants to merge 1 commit into
mainfrom
docs/skill-lessons-from-poly-uri

Conversation

@jadb
Copy link
Copy Markdown
Contributor

@jadb jadb commented May 16, 2026

Summary

Distills the painful lessons from hop-top/poly-uri's bootstrap session into the skill so the next polyglot setup doesn't replay them. Three new docs under `docs/` plus surgical edits to SKILL.md.

What's added

docs/bootstrap-checklist.md (NEW, 171 lines)

Ordered greenfield setup for a brand-new polyglot hop-top repo:

  1. Component layout decision
  2. Org-level secrets — with an explicit list of secrets that EXIST on the org but are NOT consumed by any workflow (`PACKAGIST_TOKEN`, `PACKAGIST_USERNAME` — both dead since Packagist auto-polls)
  3. Mirror repo creation
  4. Per-registry registration (npm, crates.io, PyPI, Packagist, go proxy) — pointers into browser-playbooks.md
  5. Workflow installation (with the install-before-tagging warning)
  6. release-please config + manifest seed values (avoids the 0.0.0 trap)
  7. First release walkthrough
  8. Per-registry verification commands

docs/failure-modes.md (NEW, 218 lines)

Extended symptom→cause→fix entries for each non-obvious failure mode encountered:

  • `ERR_PNPM_SPEC_NOT_SUPPORTED_BY_ANY_RESOLVER` — the `run: $CMD` shell-operator trap (refs publish-{ts,py,rs}: run: $CMD breaks shell operators (&&, |, ;) in test/build-command inputs #9). Includes a "what does NOT work" list (`sh -c "..."`, `eval`) because the obvious workarounds also fail for the same reason.
  • Tag-predates-workflow trap — diagnostic command, fix procedure, prevention.
  • pnpm 11 `strictDepBuilds` — with the explicit note that `pnpm.ignoredBuiltDependencies` in package.json is deprecated and `allowBuilds:` in pnpm-workspace.yaml is the replacement.
  • PyPI OIDC `invalid-publisher` — covers both the common cause (workflow filename of the reusable instead of the caller) and the rare pending-publisher matching drift bug that hit us today.
  • PEP 440 version normalization (`0.2.0-alpha.1` → `0.2.0a1`).
  • Missing GitHub Environment.
  • release-please PR DIRTY after main moves.
  • Registry immutability and partial-retry semantics.

docs/browser-playbooks.md (NEW, 245 lines)

ibr-driveable walkthroughs for every web-side setup step. Each playbook:

  • URL
  • Literal form values (in a table)
  • An `ibr --cookies chrome "..."` prompt template that can be copy-pasted
  • Verification command(s)

Covers: PyPI pending trusted publisher, PyPI project-scoped publisher (post-first-publish migration), PyPI API token mint (account-wide for bootstrap + project-scoped after), Packagist submission, GitHub Environment creation (API preferred), crates.io email verification.

SKILL.md edits (surgical)

  • Common Pitfalls table: 6 new entries, each linked to detailed treatment in failure-modes.md.
  • Front-matter `description`: broadened to include the new troubleshooting + bootstrap surface.
  • See also: restructured to reference the three new docs.
  • All existing sections (Mental model, Pinning, Facade pattern, Secrets reference, PyPI auth modes, Install model, ecosystems reference) preserved as-is.

Sizes

```
406 SKILL.md
189 docs/architecture.md
171 docs/bootstrap-checklist.md
245 docs/browser-playbooks.md
218 docs/failure-modes.md
```

All under the 500-line soft cap from AGENTS.md conventions.

Why these specifically

Every entry has a corresponding session experience — none are speculative. The list was extracted from the actual sequence of failures during hop-top/poly-uri's release wiring; today's session needed 8 retries on PyPI alone before we identified the matching-drift bug and shipped the `pypi-auth: token` escape hatch (#10).

Test plan

  • Read-through review for accuracy (especially the workflow-log error strings — they need to be exact for users to grep against).
  • (Optional) Run one ibr playbook end-to-end against a fresh repo to verify the prompts actually do what they claim.

Source: the hop-top/poly-uri release session that exposed half a dozen
non-obvious failure modes (shell-operator bug, pnpm 11 strict-mode,
PyPI OIDC matching drift, tag-predates-workflow, PEP 440 normalization,
dirty release-please PRs after main moves) plus the gaps in greenfield
setup that current SKILL.md left implicit.

Adds three sibling docs under docs/:

- bootstrap-checklist.md — ordered greenfield setup. Covers org
  secrets (with explicit list of secrets that exist on hop-top but are
  NOT consumed by any workflow — PACKAGIST_*), mirror repo creation,
  per-registry registration (npm, crates.io, PyPI, Packagist, go
  proxy), release-please config seed values, first-release walkthrough,
  and per-registry verification commands.

- failure-modes.md — extended symptom→cause→fix for each painful
  lesson. Includes workflow-log excerpts (exact error strings to
  grep), root-cause analysis, the fix, and an explicit "what does NOT
  work" list for traps where multiple fixes look plausible. Covers
  shell-operator trap (#9), tag-predates-workflow, pnpm 11
  strictDepBuilds + allowBuilds replacement, PyPI invalid-publisher
  (both common cause and pending-publisher drift bug),
  PEP 440 version display mismatch, missing GitHub Environment, dirty
  release-please PRs, immutability after failed retries.

- browser-playbooks.md — ibr-driveable verbal walkthroughs for each
  web-side setup step. Each playbook gives the URL, the literal form
  values, an ibr prompt template, and a verification command. Covers:
  PyPI pending trusted publisher (with the workflow_ref-is-the-caller
  trap called out), PyPI project-scoped publisher migration (post-
  first-publish), PyPI API token mint (account-wide for bootstrap,
  project-scoped after), Packagist package submission (must use mirror
  URL not source), GitHub Environment creation (API preferred over
  browser), crates.io email verification.

SKILL.md gets surgical edits:

- Common Pitfalls table expanded with the six new traps, each linking
  to the detailed treatment in failure-modes.md.
- Front-matter description broadened to cover the new troubleshooting
  + bootstrap surface area.
- See also section restructured to reference the three new docs.

Existing SKILL.md sections (Mental model, Pinning, Facade pattern,
Secrets reference, PyPI auth modes, Install model, ecosystems
reference) preserved as-is. Total: 406 lines in SKILL.md, 218+171+245
lines in the three new docs. All under the 500-line soft cap.
Copilot AI review requested due to automatic review settings May 16, 2026 05:52
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR expands the consumer-facing hop-top/.github skill documentation with bootstrap sequencing, browser-driven registry setup playbooks, and troubleshooting guidance from recent polyglot release wiring.

Changes:

  • Adds greenfield setup checklist for polyglot repos.
  • Adds failure-mode documentation for tag/workflow, PyPI, pnpm, and registry retry issues.
  • Adds browser playbooks for PyPI, Packagist, GitHub Environments, and crates.io setup, plus SKILL.md cross-links.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 7 comments.

File Description
SKILL.md Updates skill description, Common Pitfalls, and See also links.
docs/bootstrap-checklist.md Adds ordered setup checklist for new polyglot repos.
docs/browser-playbooks.md Adds web-side setup walkthroughs and verification steps.
docs/failure-modes.md Adds troubleshooting entries and escape hatches for known release failures.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread docs/browser-playbooks.md
@@ -0,0 +1,245 @@
# Browser playbooks

Verbal step-by-step walkthroughs for each web-side setup. Each playbook is structured so an AI assistant with browser access (e.g. via [`ibr`](https://github.com/...) with cookies from a logged-in chrome session) can drive the flow.
Comment thread docs/browser-playbooks.md
Comment on lines +123 to +126
After extraction, set the org-level secret on GitHub:

```bash
gh secret set PYPI_REGISTRY_TOKEN --org <org> --visibility all --body "pypi-AgEI..."
Comment thread docs/failure-modes.md
Comment on lines +207 to +208
- npm: check `npm view <pkg> versions --json` before retrying. If version landed, the publish step will fail; the rest of the pipeline (test, build, mirror) is the only thing being re-exercised — that's fine.
- PyPI: same shape. Once `hop_top_uri-0.2.0a1.tar.gz` is uploaded, re-running publish step errors. Mirror still updates.
Comment thread docs/failure-modes.md
Comment on lines +47 to +48
- Adding a wrapper script you commit to the repo and exec via path — works, but the script approach is cleaner.

Comment on lines +103 to +104
"packages": {
".": { "release-type": "go", "component": "my-pkg", "exclude-paths": ["ts","py","rs","php","go"], "prerelease": true, "prerelease-type": "alpha.0", "versioning": "prerelease" },
Comment thread SKILL.md

## Common pitfalls

Detailed treatment of each entry — including symptoms you'll see in workflow logs and verification commands — in [docs/failure-modes.md](docs/failure-modes.md).
Comment thread docs/browser-playbooks.md
Comment on lines +123 to +126
After extraction, set the org-level secret on GitHub:

```bash
gh secret set PYPI_REGISTRY_TOKEN --org <org> --visibility all --body "pypi-AgEI..."
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants