fix: centralize hardened release publishing

[jan-kubica]

Summary

• Centralizes independent npm package publishing after repository-local read-only verification and packing.
• Pins the shared release implementation to immutable commit eabb8b7de6cc69e1bbd3468ee80ddaf99cbddc33.
• Adds the shared release-policy check for release workflow changes.

Verification

• Exact-ref shared policy validation
• actionlint and whitespace checks
• Repository-specific release contract tests
• Package or publish dry-run checks where applicable

CC on behalf of jan-kubica

Summary by CodeRabbit

• CI/CD
  • Added pre-release verification checks for lockfiles, types, tests, linting, and package quality.
  • Updated packaging to use explicit tool versions and require successful verification first.
  • Added automated release-policy validation for pull requests, pushes to main, and manual runs.
• Tests
  • Strengthened coverage for release workflow trigger conditions.

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-29T13:58:44.912858Z	ccf34e7	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[jan-kubica]

@codex review

Please review the exact current head, focusing on release privilege boundaries, immutable shared references, artifact identity, and preserved caller-specific release behavior.

CC on behalf of jan-kubica

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 799d62d3-6da5-4b64-8f2b-44b8220d11a1

📥 Commits

Reviewing files that changed from the base of the PR and between bf64a87 and ccf34e7.

📒 Files selected for processing (3)

• .github/workflows/publish.yml
• .github/workflows/release-policy.yml
• scripts/bun-lock-workspace-versions.test.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The publish workflow now runs read-only verification before packaging. A new workflow enforces release-policy boundaries. Tests assert the release job condition.

Changes

Release workflow controls

Layer / File(s)	Summary
Publish verification and packaging controls .github/workflows/publish.yml, scripts/bun-lock-workspace-versions.test.ts	The publish workflow adds dependency, typecheck, test, lint, publint, and lockfile checks before packaging. Packaging now depends on verification and uses explicit runtime versions. The reusable release reference and release-condition assertion were updated.
Release policy enforcement .github/workflows/release-policy.yml	A path-filtered workflow runs on relevant pull requests, pushes to main, and manual dispatches. It invokes a pinned reusable release-policy workflow with read-only contents permissions.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to ccf34

The PR centralizes release publishing, adds read-only verification and policy checks, and pins the shared implementation to an immutable commit; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: centralizing and hardening release publishing through local verification, immutable workflow pinning, and release-policy enforcement.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/use-shared-release-publishers

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: ccf34e7aac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".