[beejsbj]

What

• ci.yml: tsc --noEmit + bun test on every PR and push to main.
• release.yml: on a v* tag, reuse CI checks, build all assets once on Linux, smoke-test each binary on its native runner (linux-x64, linux-arm64, darwin-arm64, darwin-x64), then publish the GitHub release.
• scripts/release.ts: --build-only / --publish-only modes so CI and the local fallback share one implementation. Tags with a suffix (v0.5.0-rc1) publish as pre-releases, which install.sh's releases/latest skips.
• scripts/smoke-binary.sh: runs --help, unify, list against throwaway dirs (exercises bun:sqlite FTS5).

Why

There was no CI. Merges weren't gated, and three of four shipped binaries had never been executed before release.

Verification

• Local: tsc clean, release --build-only produced 5 assets, smoke script passes on linux-x64.
• This PR's own CI run verifies ci.yml.
• release.yml to be verified with a v0.4.4-rc1 pre-release tag on this branch.

Not done

• Branch protection (requiring CI to merge) is a repo setting; left for an explicit decision.
• Bun pinned to 1.3.14 to match local; bump deliberately.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-17T10:15:58.538320Z	70f0bbf	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[beejsbj]

Independent review: approve with nits

Reviewer: fresh-context Claude Opus 5.5 subagent at head 70f0bbf. Cross-provider reviewers were unavailable today (ChatGPT/Codex weekly limit, Fable limit, opencode 403), so this shares a model with the author. Findings were verified against the v0.4.4-rc1 Release run and the branch protection API.

Verified OK

• The required check context comes from the CI workflow job named check. The release's reusable call shows up as check / check and doesn't stand in for it.
• Permissions: the repo default is read. Only publish gets contents: write. No secrets, no pull_request_target.
• Ordering is check -> build -> smoke matrix -> publish. needs: smoke blocks publish if any leg fails. Artifact digests match between build and publish, and all 4 native smoke legs passed.
• The local fallback (build() then publish()) is intact on reading.

Low / nits (follow-ups, not blocking)

1. Publish is not idempotent. Re-running after a partial publish, or tagging after a local-fallback release, fails red with "already exists". Fix: gh release view first, then upload --clobber.
2. Any v* tag on any commit publishes. A stable tag pushed by mistake on a branch commit would become Latest. Fix: an ancestor-of-main guard for tags without a suffix, or a tag ruleset.
3. Add a top-level permissions: contents: read so the workflows don't depend on the repo setting.
4. The smoke test asserts exit codes only. One fixture session plus a search would prove that search works, not just that the schema builds.
5. actions/checkout@v4 and download-artifact@v4 give Node 20 deprecation warnings. Bump to v5.

Verdict: safe to merge as the CI and release gate.