[gavinsharp]

Summary

sdk-release-finalize now behaves as an idempotent reconciliation workflow for SDK release metadata after package publishing succeeds.

Changes & impact

SDK release jobs can now depend on a single finalized output after the workflow verifies the SDK version release/tag, originGitCommit tag, and Fern replay generation tag where applicable.

Details

• Existing GitHub releases are validated against their tagName and tag target before being accepted.
• create-origin-tag and preserve-fern-generation allow narrower repair paths while preserving current defaults.
• README wording now describes the workflow as release metadata reconciliation.

Testing

• actionlint .github/workflows/sdk-release-finalize.yml

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes post-publish git tagging and GitHub release validation used across SDK repos; misconfiguration could block or incorrectly accept releases, though defaults preserve prior behavior.

Overview
sdk-release-finalize is reframed as an idempotent reconciliation workflow safe to rerun after a successful publish, a prior finalize failure, or when only some tags need repair.

Callers get a new finalized output set only after a Verify finalized release state step confirms the SDK version tag (and GitHub release when enabled), origin tag, and Fern replay generation tag (when applicable) exist and point at the expected commits. Existing GitHub releases are no longer accepted on name alone—the step checks tagName matches the version tag and that the git tag exists at the release target.

create-origin-tag and preserve-fern-generation (default true) gate origin and Fern tag work so callers can run narrower repair paths. origin-commit / origin-tag are optional at the workflow boundary (empty default) and are required only when create-origin-tag is true. Step names and README text now describe “ensure” / reconcile behavior instead of one-shot creation.

^{Reviewed by Cursor Bugbot for commit ea00027. Bugbot is set up for automated code reviews on this repo. Configure here.}