test(release): assert release config stays in sync with package versions; document first-release drive

Author: rafmacalaba

DEVELOPMENT.md

@@ -168,3 +168,17 @@ Releases are driven by [release-please](https://github.com/googleapis/release-pl
 - **Cutting a release:** merge the Release PR. release-please creates the GitHub Release tagged `vX.Y.Z` and pushes the tag.
 - **Publication:** the tag triggers the PyPI publish workflow (`data360-mcp` only); the published release triggers the npm publish workflow (`@data360/tool-types`, `@data360/mcp-viz-core`, `@data360/mcp-ui`, `@data360/mcp-ui-angular`).
 - **Rollback:** pin consumers to any prior release—PyPI `pip install data360-mcp==X.Y.Z`, npm `@data360/mcp-ui@X.Y.Z` (see README).
+
+### First release (post-merge validation)
+
+The first time this pipeline runs after merge, treat it as an explicit smoke test. `release-please` needs at least one conventional commit after seeding before it opens the Release PR; a dedicated `docs:` commit is enough to trigger a patch bump.
+
+1. Ensure the repo has a GitHub Actions environment named `pypi` wired to PyPI trusted publishing, and a `NPM_TOKEN` repo secret.
+2. Push a conventional commit to `dev` (e.g. `chore(release): cut initial release via release-please`). Wait for the Release PR to appear.
+3. Merge the Release PR. Confirm, in order:
+   - git tag `vX.Y.Z` created and a GitHub Release published with an autogenerated changelog.
+   - `python-publish.yml` ran: wheel built, smoke-tested (`import data360` prints a version), then published to PyPI (check https://pypi.org/project/data360-mcp/).
+   - `npm-release.yml` ran: workspaces built and changed `@data360/*` packages published (check the npm registry per package).
+4. Rollback drill: `pip install data360-mcp==<previous-version>` succeeds using a version listed on the Releases page.
+
+If trusted-publisher config or `NPM_TOKEN` are missing, the GitHub Release + tag still land (release-please cuts those in-repo); the PyPI/npm publish steps fail independently. Add the secrets and re-run the failed workflow from the Actions UI — both workflows are idempotent (PyPI re-publish of same version is a no-op in uv; npm skip-already-published).

tests/test_release_config_sync.py

@@ -0,0 +1,74 @@
+"""Ensure release-please version manifest and config stay in sync with package versions."""
+
+import json
+import re
+from pathlib import Path
+
+import pytest
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+
+CONFIG_PATH = REPO_ROOT / ".github" / "release-please-config.json"
+MANIFEST_PATH = REPO_ROOT / ".github" / "release-please-manifest.json"
+NPM_WORKFLOW_PATH = REPO_ROOT / ".github" / "workflows" / "npm-release.yml"
+
+_PYPROJECT_VERSION = re.compile(r'^version\s*=\s*"([^"]+)"', re.MULTILINE)
+
+
+def _npm_version(name: str) -> str:
+    data = json.loads((REPO_ROOT / "packages" / name / "package.json").read_text(encoding="utf-8"))
+    assert isinstance(data.get("name"), str)
+    assert data["name"] == f"@data360/{name}", f"{name} package.json name mismatch"
+    v = data.get("version")
+    assert isinstance(v, str) and v.strip()
+    return v.strip()
+
+
+def _py_version() -> str:
+    text = (REPO_ROOT / "pyproject.toml").read_text(encoding="utf-8")
+    match = _PYPROJECT_VERSION.search(text)
+    assert match is not None, "missing version = ... in pyproject.toml"
+    return match.group(1)
+
+
+@pytest.fixture
+def release_config() -> dict:
+    return json.loads(CONFIG_PATH.read_text(encoding="utf-8"))
+
+
+@pytest.fixture
+def release_manifest() -> dict:
+    return json.loads(MANIFEST_PATH.read_text(encoding="utf-8"))
+
+
+def test_manifest_keys_match_config_packages(release_config: dict, release_manifest: dict) -> None:
+    assert set(release_manifest) == set(release_config["packages"]), (
+        "release-please-manifest keys must match config packages"
+    )
+
+
+def test_manifest_versions_match_package_versions(release_manifest: dict) -> None:
+    expected = {
+        ".": _py_version(),
+        "packages/tool-types": _npm_version("tool-types"),
+        "packages/mcp-viz-core": _npm_version("mcp-viz-core"),
+        "packages/mcp-ui": _npm_version("mcp-ui"),
+        "packages/mcp-ui-angular": _npm_version("mcp-ui-angular"),
+    }
+    for key, version in expected.items():
+        assert release_manifest[key] == version, (
+            f"manifest {key} version {release_manifest[key]!r} != package version {version!r}"
+        )
+
+
+def test_npm_workflow_publishes_all_config_npm_packages(release_config: dict) -> None:
+    npm_names = {
+        pkg[len("packages/") :]
+        for pkg, cfg in release_config["packages"].items()
+        if cfg["release-type"] == "node"
+    }
+    workflow_text = NPM_WORKFLOW_PATH.read_text(encoding="utf-8")
+    for name in sorted(npm_names):
+        assert f"@data360/{name}" in workflow_text, (
+            f"npm-release.yml must publish @data360/{name} (missing from in-scope list)"
+        )