Promote v0.0.4 to production - #176

Merged

mrubens merged 18 commits into

mainfrom

Jul 11, 2026

mrubens commented Jul 11, 2026

Contributor

Promote v0.0.4

Frozen at 9d1c33ebd888baabe4c550c0465f964535c008c3 — the commit where 0.0.4 was versioned. Commits merged to develop after that point ship in the next release.

Merge this PR with a merge commit (do not squash or rebase).
If multiple promote PRs are open, merge them in version order (oldest first).
Merging publishes a GitHub Release for v0.0.4 and triggers the existing GHCR v* image publish (latest channel).
The release/v0.0.4 branch can be deleted after this PR merges.

Changelog

0.0.4 (2026-07-11)

Patch changes

Ship the post-0.0.3 develop backlog toward production, including Daytona environment/task snapshot resume with legacy env aliases, default-deny API authorization, R_* public env canonicalization, CI status in PR review feedback replies, sandbox provider UX fixes, and other already-merged fixes.

roomote-roomote Bot and others added 18 commits

July 10, 2026 21:01


          [Improve] Version PRs bump only the root version instead of touching …

58ba415

…30 files (#156)

* WIP: slim single-version release flow

* feat: version only the root package and generate the Version PR ourselves

Replace changesets/action and the fixed lockstep group with a small
in-repo version flow: apply-version.mjs bumps the root version, prepends
the CHANGELOG section, and deletes consumed changesets; the Release
workflow rebuilds the Version PR branch idempotently and closes it when
no changesets remain. Version PRs now touch package.json + CHANGELOG.md
instead of 30 files, and the 27 stub package changelogs are gone.

* fix: close stale Version PR when changesets stop being versionable; drop stale fixed-group docstring

* style: format lib.mjs

---------

Co-authored-by: Roomote <roomote@roomote.dev>


          fix: skip CI upgrade gate when no previous release exists and use rel…

…ease tags for main-based PRs (#155)

The Upgrade Compatibility job pulled the base channel's images as its
baseline, so promote PRs into main booted the ancient pre-release
main-channel image, which crashes under the current compose. Resolve the
baseline from the latest GitHub release for main-based PRs, skip cleanly
when no usable release exists yet, and let the script accept v* tags.

Co-authored-by: Roomote <roomote@roomote.dev>


          chore: add PR template and tighten contribution policy to discourage …

e423d44

…unsolicited PRs (#157)

Co-authored-by: Roomote <roomote@roomote.dev>


          Update PULL_REQUEST_TEMPLATE.md (#159)

56172b1


          [Fix] Make API authorization default-deny with declared route policies (

8f9abbc

#133)

Co-authored-by: Roomote <roomote@roocode.com>


          [Improve] Group the Users task filter into Users and Automations (#161)

2f4e7e2

Co-authored-by: Matt Rubens <2600+mrubens@users.noreply.github.com>


          [Chore] Bump js-yaml pin for Dependabot alerts #3 and #4 (#163)

Co-authored-by: Roomote <roomote@roomote.dev>


          [Fix] Mock setTrustedRunActingUser in Teams/Telegram handler tests (#164

4ca9cd7

)

Co-authored-by: Roomote <roomote@roocode.com>


          [Fix] Creating a GitHub App fails with merge_group permission error (#…

b9b93c0

…165)

Co-authored-by: Matt Rubens <2600+mrubens@users.noreply.github.com>


          [Feat] Include CI status in PR review feedback thread replies (#162)

bd6b578

Co-authored-by: Matt Rubens <2600+mrubens@users.noreply.github.com>


          [Refactor] Canonicalize public Roomote env vars as R_* (#78)

104cfdd

Co-authored-by: Matt Rubens <2600+mrubens@users.noreply.github.com>
Co-authored-by: Roomote <roomote@roocode.com>


          [Fix] Treat empty R_SLACK_SIGNING_SECRET as unset so Slack-less deplo…

a3f24a7

…yments boot (#168)

Co-authored-by: Roomote <roomote@roocode.com>


          [Feat] Enable environment and task snapshot resume on Daytona (#167)

d1ca66f

Co-authored-by: Matt Rubens <2600+mrubens@users.noreply.github.com>


          [Fix] Inject legacy ROOMOTE_APP_URL alias so pre-rename snapshots res…

bd853d4

…ume (#170)

Co-authored-by: Roomote <roomote@roocode.com>


          [Improve] Mark Daytona recommended and clarify API key scopes (#172)

a331b79

Co-authored-by: Matt Rubens <2600+mrubens@users.noreply.github.com>


          [Fix] Home sandbox dropdown shows unconfigured providers (#171)

fcc6806

Co-authored-by: Matt Rubens <2600+mrubens@users.noreply.github.com>


          [Fix] Mirror resolved model env to legacy ROOMOTE_* aliases for pre-r…

d2f752b

…ename snapshots (#173)

Co-authored-by: Roomote <roomote@roocode.com>


          [Chore] Version Roomote 0.0.4 (#174)

9d1c33e

Co-authored-by: Matt Rubens <2600+mrubens@users.noreply.github.com>

mrubens requested review from brunobergher and daniel-lxs as code owners

July 11, 2026 06:31

roomote-roomote Bot commented Jul 11, 2026 •

edited

Loading

Contributor

Reviewed the v0.0.4 promotion (18 already-reviewed commits, base main). Release mechanics are correct; 1 behavior change worth confirming before it reaches production. See task

packages/types/src/teams-bot-credentials.ts:88 — resolveTeamsBotRuntimeCredentialsFromEnv dropped the microsoft_auth runtime fallback (part of the R_* rename in [Refactor] Canonicalize public Roomote env vars as R_* #78). Deployments configured through the setup UI are unaffected because getSetupSubmitValues copies R_MICROSOFT_* into R_TEAMS_BOT_* at save time. But a deployment that sets only the Microsoft app env vars directly (no R_TEAMS_BOT_APP_ID/R_TEAMS_BOT_APP_PASSWORD) now resolves to null credentials and the Teams bot goes silent — the old code derived them from the Microsoft values. Confirm this env-only single-app path is intentionally dropped, or restore the fallback.

Review notes

This is a release-promotion PR bundling the post-0.0.3 develop backlog (18 commits) into main. Each commit already went through its own review before merging to develop, so this review focused on promotion-specific correctness plus a targeted scan of the highest-risk shipped changes.

Version bump / changelog ([Chore] Version Roomote 0.0.4 #174): Correct — root package.json 0.0.3 → 0.0.4, CHANGELOG.md section prepended, no stray workspace-package version changes (matches the single-root-version model from [Improve] Version PRs bump only the root version instead of touching 30 files #156).
Release script refactor ([Improve] Version PRs bump only the root version instead of touching 30 files #156): The consolidation into scripts/release/apply-version.mjs / applyProductVersion is clean, idempotent, and covered by scripts/release/__tests__/lib.test.mjs.
Default-deny API authorization ([Fix] Make API authorization default-deny with declared route policies #133): Guarded by route-policy-inventory.test.ts, which fails if any registered route is unclassified or any rule is dead — a solid safety net against a production lockout.
R_ env canonicalization ([Refactor] Canonicalize public Roomote env vars as R_* #78), Daytona snapshot resume + legacy aliases ([Feat] Enable environment and task snapshot resume on Daytona #167/[Fix] Inject legacy ROOMOTE_APP_URL alias so pre-rename snapshots resume #170/[Fix] Mirror resolved model env to legacy ROOMOTE_* aliases for pre-rename snapshots #173), PR-review CI status ([Feat] Include CI status in PR review feedback thread replies #162):* Spot-checked; internally consistent. The only concrete follow-up is the Teams credential item above.

mrubens merged commit c3fe167 into main

1 check passed

mrubens deleted the release/v0.0.4 branch

July 12, 2026 04:19

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet