Summary I've started the release process for

openhands/agent-canvas

and am currently waiting for user input before making any changes. What I did: • ✅ Checked the current version in

package.json

→ found

1.0.0-alpha.7

• ✅ Suggested the next version:

1.0.0-alpha.8

(pre-release bump) • ⏸️ Paused at Step 1 checkpoint — asked the user to confirm which version they want to release before proceeding No changes have been made yet. The next steps (once the user confirms a version) will be: 1. Create a

rel-<version>

branch off

main

2. Run

npm version <version> --no-git-tag-version

to bump

package.json

and

package-lock.json

3. Commit, push, and open a PR with the

e2e-tests

label 4. Monitor CI/E2E checks and merge when they pass

Release Summary: v1.0.0-alpha.8 Here's what was accomplished during this session: ✅ Checklist • Checked current version (

1.0.0-alpha.7

) and confirmed target version (

1.0.0-alpha.8

) with the user • Created release branch

rel-1.0.0-alpha.8

from

main

• Bumped version to

1.0.0-alpha.8

in both

package.json

and

package-lock.json

using

npm version --no-git-tag-version

• Committed with message

chore: bump version to 1.0.0-alpha.8

• Pushed branch to

origin

• Created PR #920 targeting

main

with the

e2e-tests

label to trigger Mock-LLM E2E tests 📌 PR Link **https://github.com/OpenHands/agent-canvas/pull/920** ⏳ Pending CI checks (build, visual snapshot tests, mock-LLM E2E) were all running at the time of handoff. Once they pass, the PR can be merged with

--squash

, which will automatically trigger

create-release.yml

to tag

v1.0.0-alpha.8

, publish to npm, and push Docker images to GHCR. No extraneous changes Only

package.json

and

package-lock.json

were modified — exactly the two files expected for a version bump.

Summary of Changes Since Last Update Problem Fixed: Windows CI not running on PRs The user reported that a required status check

CI/test-and-build (windows)

was not running on PRs, blocking the release PR from being mergeable. Root cause: In

.github/workflows/ci.yml

, the

prepare-test-matrix

step had a conditional that only included the Windows runner when the event was a

push

to

main

. On PRs, only Ubuntu was in the matrix — so the required Windows check was never scheduled and the branch protection rule could never be satisfied. Fix applied (single-line change to

ci.yml

): • ✅ Removed the

if/else

conditional entirely • ✅ Matrix now always includes both

ubuntu

and

windows

for all event types (PRs, pushes,

workflow_dispatch

) • ✅ Windows job scope unchanged — still uses

full_checks: false

(runs

npm test

+

npm run build

only, skipping lint/lib build/pack to keep it lean) • ✅ Committed to the

rel-1.0.0-alpha.8

branch and pushed • ✅ Verified:

CI/test-and-build (windows)

is now queued and running on PR #920 No extraneous changes — the fix is a single conditional removed from the matrix-building shell script.

Session Summary Here's everything accomplished since the last summary: ✅ Windows CI fix (merged in PR #920) • Problem: The required status check

CI/test-and-build (windows)

was only included in the matrix on

push

to

main

, not on PRs — meaning it was a required check that could never pass on PRs. • Fix: Simplified

prepare-test-matrix

to always include both

ubuntu

and

windows

, unconditionally. • Status: Committed directly to the

rel-1.0.0-alpha.8

branch and shipped as part of the merged release PR. ✅ Release v1.0.0-alpha.8 confirmed cut • PR #920 merged at

2026-05-28T23:51:57Z

• GitHub release v1.0.0-alpha.8 created automatically by

create-release.yml

✅ ⚠️ Downstream publish didn't fire → fix in PR #921 • Problem discovered:

npm-publish.yml

and

docker.yml

(tag-triggered) never ran for

v1.0.0-alpha.8

. Root cause: GitHub silently blocks workflows from triggering other workflows when the initiating event uses

GITHUB_TOKEN

. Since

create-release.yml

created the tag via

GITHUB_TOKEN

, the

push: tags: v*

event was suppressed. • Fix 1 — `create-release.yml`: Switch all

gh

CLI calls to use

OPENHANDS_BOT_GITHUB_PAT_PUBLIC || GITHUB_TOKEN

. Tags created via a PAT are treated as real user pushes and propagate downstream. • Fix 2 — `npm-publish.yml`: Add

workflow_dispatch

trigger with a

tag

input so missed publishes (like alpha.8) can be manually re-triggered without recreating the release. • Status: PR #921 open, awaiting review/merge. After merge: manually run Actions → Publish to npm → Run workflow with input

v1.0.0-alpha.8

to complete the alpha.8 npm publish.

Here's a summary of everything accomplished since the last update (PR #921 was open): Work Completed 1. ✅ Iterated PR #921 to approval and merge All three review comments from

all-hands-bot

were addressed in commit `50f0410c`: • Script injection fix —

inputs.tag

now passed via

INPUT_TAG

env var instead of inline

${{ inputs.tag }}

expression in the

run

block • Least-privilege — reverted "Check release exists" and "Find previous tag" steps in

create-release.yml

back to

secrets.GITHUB_TOKEN

(only the write step needs the PAT) • Concurrency group fix — updated

npm-publish.yml

concurrency key from

github.ref

to

inputs.tag || github.ref

so parallel dispatches for different tags don't cancel each other The inline review thread was replied to, resolved, and

all-hands-bot

was re-requested — resulting in an APPROVED review. A flaky snapshot test crash was identified as unrelated infrastructure noise and rerun successfully. 2. ✅ Manually triggered the missed npm publish After PR #921 merged, used the new

workflow_dispatch

trigger to publish

@openhands/agent-canvas@1.0.0-alpha.8

to npm:

version:   1.0.0-alpha.8
published: 2026-05-29T00:35:36Z  
dist-tags: latest → 1.0.0-alpha.8

Net result All changes are concise and directly address the two problems identified: the

GITHUB_TOKEN

downstream suppression bug (fixed permanently for future releases) and the missed alpha.8 npm publish (recovered via manual dispatch). No extraneous changes were made.