1.0.3, one version everywhere; CI and tag-driven release; bump script

[echarles]

• Versions: datalayer_decks/__version__.py is the one source (hatch reads it; the CLI and extension manifests import it), the three package.json files are copies, and dev/bump_version.py (make bump-patch|minor|major, like jupyter-mcp-server's) moves all four or none. Aligned on 1.0.3, above every published number (npm @datalayer/decks 1.0.2, @datalayer/decks-plugin-ai-agents 1.0.1; PyPI has no datalayer-decks yet).
• ci.yaml builds and tests both halves on push and pull request. release.yaml publishes on a v* tag through trusted publishing (environments pypi and npm): the wheel and sdist of datalayer-decks, @datalayer/decks and @datalayer/decks-plugin-ai-agents. Both check the reactor out beside the repository at REACTOR_REF (v1.0.4), the layout the TypeScript configuration resolves @datalayer/reactor from. RELEASE.md documents the flow and the trusted-publisher settings.
• What a plain checkout lacked (found by building from clean exports, which now pass end to end, wheel included): @types/node; a process shim, stream, assert and prettier 3's estree plugin reachable from the plugin's own node_modules (absolute aliases in app/rsbuild.config.ts; the primer-addons checkout alias is now conditional on the checkout being there); the federation entry named remoteEntry.js as extension.py expects (@module-federation/rsbuild-plugin 2.x hashes it by default); the built share/ halves declared as hatch artifacts, without which the git-ignored files were left out of the wheel. repository and publishConfig on the two published package.json files, for npm provenance.

Packages to register for trusted publishing (owner datalayer, repository decks, workflow release.yaml):

Package	Registry	Environment
datalayer-decks (new project: pending publisher)	PyPI	pypi
@datalayer/decks	npm	npm
@datalayer/decks-plugin-ai-agents	npm	npm

Tag v1.0.3 after merge.

[Copilot]

Copilot review overview

🟡 Changes recommended

Critical and moderate unresolved findings affect clean builds, release safety, and version consistency.

Review effort: Lite
Findings: 1 · 1

Open (2)

• Clean wheel builds omit app dependencies required by the build hook · New
• Cancelled publishing jobs can incorrectly trigger the release · New

What changed in this PR

This PR centralizes versioning at 1.0.3, improves frontend packaging, and adds CI plus trusted publishing workflows.

Changes:

• Adds synchronized Python/npm version metadata and bump tooling.
• Adds CI and tag-driven PyPI/npm releases.
• Fixes federation builds and wheel artifact inclusion.
• Documents the release process.

File	Reviewed change	Final review finding
RELEASE.md	Documents release and trusted publishing.	No finding.
pyproject.toml	Enables dynamic versioning and packaged assets.	No finding.
plugins/​ai-agents/​package.json	Updates plugin metadata and version.	No finding.
package.json	Updates npm metadata and dependencies.	Moderate: Runtime plugin manifest still hard-codes version 1.0.0 (1 vote).
Makefile	Adds version bump commands.	No finding.
extension/​rsbuild.config.ts	Names the federation entry file.	No finding.
dev/​bump_version.py	Synchronizes version files.	Moderate: Writes are not atomic or all-or-none (1 vote); runtime manifests are omitted (1 vote).
datalayer_decks/​extension.py	Uses the centralized extension version.	No finding.
datalayer_decks/​cli.py	Uses the centralized CLI version.	No finding.
datalayer_decks/​__version__.py	Defines the canonical version.	No finding.
datalayer_decks/​__init__.py	Exports the version.	No finding.
app/​rsbuild.config.ts	Adds build aliases and conditional paths.	No finding.
app/​package.json	Adds browser shims and dependencies.	Critical: Clean wheel builds do not install app dependencies before invoking the app build (1 vote).
.gitignore	Ignores release outputs.	No finding.
.github/​workflows/​release.yaml	Publishes tagged packages.	Moderate: Cancelled publishing jobs can still permit the release job to run (4 votes).
.github/​workflows/​ci.yaml	Adds CI for Python and TypeScript components.	No finding.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.