Skip to content

Use npx release-it to avoid mise shim failures#1040

Merged
justin808 merged 1 commit intomainfrom
jg/fix-mise-release-it
Apr 2, 2026
Merged

Use npx release-it to avoid mise shim failures#1040
justin808 merged 1 commit intomainfrom
jg/fix-mise-release-it

Conversation

@justin808
Copy link
Copy Markdown
Member

@justin808 justin808 commented Apr 2, 2026

Summary

  • Switch the release task to run release-it via npx --yes, removing reliance on a globally installed binary and preventing mise shim failures during npm publish.
  • Keep release commit behavior unchanged (--npm.publish --no-git.requireCleanWorkingDir) while documenting the rationale inline.
  • Update release docs to reflect npx usage for prerequisites and manual npm publishing.

Pull Request checklist

  • Add/update test to cover these changes
  • Update documentation
  • Update CHANGELOG file

Other Information

  • Validation run in this branch: ruby -c rakelib/release.rake, bundle exec rake -T | rg '\\brelease\\b', and npx --yes release-it --version.

Note

Medium Risk
Touches the automated release/publish path; while behavior should be equivalent, invoking release-it via npx can change which version runs and could impact npm publishing if environments differ.

Overview
Updates the release rake task to publish to npm by running release-it via npx --yes instead of requiring a globally installed release-it binary, with inline rationale to avoid shim-manager (e.g. mise) failures.

Refreshes docs/releasing.md prerequisites and manual release steps to match the new npx --yes release-it ... workflow and clarify that no global install is needed.

Written by Cursor Bugbot for commit d564446. This will update automatically on new commits. Configure here.

@justin808 justin808 merged commit 9be1636 into main Apr 2, 2026
2 of 3 checks passed
@justin808 justin808 deleted the jg/fix-mise-release-it branch April 2, 2026 09:20
@greptile-apps
Copy link
Copy Markdown
Contributor

greptile-apps Bot commented Apr 2, 2026

Greptile Summary

This PR replaces the bare release-it binary invocation in the release rake task with npx --yes release-it, removing the requirement for a globally installed binary and preventing failures caused by shim managers like mise. The documentation is updated to match, dropping the yarn global add release-it prerequisite in favour of a simple npm availability check.

Key changes:

  • rakelib/release.rake: release-it <version>npx --yes release-it <version> with an explanatory comment
  • docs/releasing.md: Prerequisites updated; manual release example updated to use npx --yes release-it

Issues found:

  • npx --yes release-it carries no version pin — the latest release-it will be fetched from npm at every release invocation. Since release-it is not a devDependency, there is no lock file to constrain it. A major version bump in release-it could silently change CLI flag behaviour and break the release flow. Pinning a major version (e.g. release-it@17) or adding it as a devDependency would make releases more reproducible.
  • The npm --version comment in the prerequisites code block could be rephrased for clarity so it reads as a verification step rather than a setup action.

Confidence Score: 4/5

  • Safe to merge — the change is small and correct; the only concern is an unpinned release-it version that could cause future surprises during releases.
  • The core logic is sound: npx --yes release-it is a well-understood idiom, all existing flags are preserved, and Shellwords.escape is retained. The one notable gap is no version constraint on release-it, meaning a future breaking release of that tool could silently disrupt the release workflow. This is a best-practice concern rather than a current bug, so the PR is still safe to merge as-is.
  • rakelib/release.rake — consider pinning the release-it version in the npx invocation.

Important Files Changed

Filename Overview
rakelib/release.rake Single-line change replaces bare release-it binary invocation with npx --yes release-it; no version pin is specified, so the latest release-it will be fetched at run time.
docs/releasing.md Prerequisites updated to drop yarn global add release-it in favour of an npm/npx availability check; manual release command updated to match the rake task's new npx --yes invocation.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["bundle exec rake release"] --> B["verify_npm_auth / verify_gh_auth"]
    B --> C["gem bump --no-commit"]
    C --> D["bundle install + lockfile updates"]
    D --> E["git add staged files"]
    E --> F{"Before PR"}
    E --> G{"After PR"}
    F --> F1["release-it &lt;npm_version&gt;\n(requires global binary)"]
    G --> G1["npx --yes release-it &lt;npm_version&gt;\n(downloads latest from npm)"]
    F1 --> H["npm publish + git tag + push"]
    G1 --> H
    H --> I["gem release"]
    I --> J["sync_github_release_after_publish"]
Loading

Reviews (1): Last reviewed commit: "Use npx release-it in release task" | Re-trigger Greptile

Comment thread rakelib/release.rake
release_it_command = +"release-it #{Shellwords.escape(npm_version)}"
# Use npx so maintainers don't need a globally installed `release-it` binary.
# This avoids failures from shim managers (e.g. mise) when `release-it` isn't configured.
release_it_command = +"npx --yes release-it #{Shellwords.escape(npm_version)}"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 No release-it version pinned — latest will be fetched on every run

npx --yes release-it without an explicit version specifier will always download and execute whatever version is current on npm at run time. Since release-it is not listed as a devDependency in package.json, there is no lock file to constrain it either. A future major release-it release (e.g. v18) could change the CLI interface, prompt behaviour, or the handling of --npm.publish / --no-git.requireCleanWorkingDir, silently breaking the release process.

Consider one of these alternatives:

Option A — pin via npx (minimal change)

Suggested change
release_it_command = +"npx --yes release-it #{Shellwords.escape(npm_version)}"
release_it_command = +"npx --yes release-it@17 #{Shellwords.escape(npm_version)}"

Option B — add to devDependencies in package.json so the local version in node_modules is used and the exact version is captured in package-lock.json / yarn.lock:

"release-it": "^17.0.0"

Then npx will resolve it from node_modules without downloading anything.

Comment thread docs/releasing.md
bundle install
gem install gem-release # Provides `gem bump` and `gem release`
yarn global add release-it # Installs release-it for npm publishing
npm --version # Required because release task uses `npx release-it`
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Verification command comment is slightly misleading

npm --version just prints the installed npm version — it doesn't actually install or configure anything. The inline comment # Required because release task uses \npx release-it`reads as if runningnpm --version*causes* something to be set up, when it's really just a sanity check that npm (and thereforenpx) is available on PATH`.

A clearer phrasing would align it with the gh --version pattern below:

Suggested change
npm --version # Required because release task uses `npx release-it`
npm --version # Verify npm (and npx) is available for `npx release-it`

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Apr 2, 2026

Warning

Rate limit exceeded

@justin808 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 2 minutes and 47 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 2 minutes and 47 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 09289c33-8705-491b-8aa6-fa8b8e97d6d7

📥 Commits

Reviewing files that changed from the base of the PR and between 4405ebb and d564446.

📒 Files selected for processing (2)
  • docs/releasing.md
  • rakelib/release.rake
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch jg/fix-mise-release-it

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

justin808 added a commit that referenced this pull request Apr 30, 2026
* origin/main: (22 commits)
  docs: add Dependabot configuration guide (#1094)
  Sync address-review prompt with upstream PR #16 (#1098)
  Supersede #910: entry shape test with lint unblock (#919)
  fix: align rspack v2 peer deps and installer defaults (#1091)
  docs: update README and guides for Shakapacker v10 (#1092)
  Release 10.0.0
  Update CHANGELOG.md for v10.0.0 (#1089)
  Release 10.0.0-rc.1
  Update CHANGELOG.md for v10.0.0-rc.1 (#1087)
  Supersede #961 by using pack-config-diff (#973)
  Add final summary output to rake release (#1041)
  Add bin/setup to install development deps (#1039)
  Release 10.0.0-rc.0
  Use npx release-it to avoid mise shim failures (#1040)
  Fix Nokogiri build failure on Ruby 3.4.6 (#1038)
  Update CHANGELOG.md for v10.0.0-rc.0 (#1037)
  Update rspack dev deps to 2.0.0-rc.0 (#1036)
  Fix stale and broken documentation across Shakapacker guides (#1023)
  Allow webpack-cli v7 in peer dependencies (#1021)
  refactor: simplify resolving js peer versions when installing (#1034)
  ...

# Conflicts:
#	package.json
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant