fix(update): match Release Please component-prefixed tags in releases-API fallback

[maxmilian]

What does this PR do?

update-system.mjs check() has two version sources: the raw VERSION file URL and the GitHub releases API as fallback. The fallback parsed release.tag_name with /^v?(\d+\.\d+\.\d+)$/, but Release Please tags this repo's releases with the component prefix — career-ops-v1.9.0 — which never matches the ^v? anchor.

So when the raw VERSION host is unreachable but api.github.com is, check() reported no-remote-version instead of falling back: the releases-API version path was effectively dead code (changelog extraction from release.body already worked — only the version-from-tag path was dead).

Fix: relax the anchor to (?:^|-)v? so the component prefix is stripped (career-ops-v1.9.0 → 1.9.0), while plain v1.9.0 / 1.9.0 tags keep working and non-semver input is still rejected.

To cover this in test-all.mjs, SEMVER_RE is hoisted to module scope and exported, and an import.meta.url guard now wraps MAIN (mirroring followup-cadence.mjs) so importing the module for assertions doesn't trigger a live update check. No module currently imports update-system.mjs, and the existing CLI smoke test (update-system.mjs check, section 1) still passes.

Related issue

Fixes #923

Type of change

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have read the CONTRIBUTING guidelines
• My PR is linked to a related issue
• No personal data (real CV/email/phone/name) is included
• I ran node test-all.mjs locally (219 passed, 0 failed)
• My changes respect the Data Contract (only System Layer files: update-system.mjs, test-all.mjs)
• Changes align with the project roadmap/philosophy (minimal, surgical)

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Enhanced version parsing to support GitHub Release-Please tags with optional component prefixes (e.g., career-ops-v1.9.0), while maintaining backward compatibility with standard semver formats like v1.9.0.

• Tests

  • Introduced validation tests for semver regex parsing, covering component-prefixed release tags, standard version formats, and rejection of non-semver inputs.

[github-actions]

Welcome to career-ops, @maxmilian! Thanks for your first PR.

A few things to know:

• Tests will run automatically — check the status below
• Make sure you've linked a related issue (required for features)
• Read CONTRIBUTING.md if you haven't

We'll review your PR soon. Join our Discord if you have questions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: f8c3da23-d16f-4c0b-9293-23eb25800a2c

📥 Commits

Reviewing files that changed from the base of the PR and between a6ea02e and ad9989c.

📒 Files selected for processing (2)

• test-all.mjs
• update-system.mjs

---

📝 Walkthrough

Walkthrough

The PR fixes a dead-code path in update-system.mjs by exporting and expanding the SEMVER_RE regex to match GitHub Release-Please component-prefixed tags (e.g., career-ops-v1.9.0), wraps CLI execution behind a direct-execution guard, and adds test coverage validating the regex behavior.

Changes

Update system semver parsing and import safety

Layer / File(s)	Summary
SEMVER_RE regex expansion and export update-system.mjs	SEMVER_RE moves from a local constant in check() to an exported module-level regex. The pattern expands from /^v?(\d+\.\d+\.\d+)$/i to `/(?:^
Update check() to use exported SEMVER_RE update-system.mjs	The check() function no longer defines SEMVER_RE locally; it now relies on the module-level exported constant for parsing remote version tags from the GitHub releases API fallback.
Import safety mechanism via direct-execution guard update-system.mjs	Adds pathToFileURL import and wraps CLI dispatch (check|apply|rollback|dismiss) logic in a guard that compares import.meta.url against process.argv[1], allowing the module to be safely imported without triggering CLI side effects while preserving subcommand routing and error handling.
Test SEMVER_RE parsing with Release-Please tags test-all.mjs	Adds test section that imports SEMVER_RE from update-system.mjs (validating the import guard prevents CLI execution) and asserts the regex correctly parses component-prefixed Release-Please tags (e.g., career-ops-v1.9.0 → 1.9.0), plain semver formats, and rejects non-semver inputs.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• santifer/career-ops#317: Both PRs modify update-system.mjs's semver/version parsing inside check() (main broadens the semver regex for Release tag formats and exposes SEMVER_RE, while the other refactors how remote versions are derived by parsing semver from VERSION/release.tag_name), so the changes are directly related at the version-extraction code level.
• santifer/career-ops#547: Both PRs modify update-system.mjs's version parsing in the check()/version handling flow by changing how semver is extracted (main PR expands/exports SEMVER_RE for Release-Please component-prefixed tags, while the retrieved PR adds parseVersionFile() to normalize VERSION text before applying SEMVER_RE).

Suggested labels

🔧 scripts

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: updating the regex to match Release Please component-prefixed tags.
Linked Issues check	✅ Passed	The code changes fully address issue #923 requirements: SEMVER_RE regex relaxed, exported for testing, and comprehensive test coverage added.
Out of Scope Changes check	✅ Passed	All changes are directly in-scope: regex fix in update-system.mjs, import.meta.url guard, and test coverage in test-all.mjs.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}