refactor(ci): validate releases once and reuse artifacts on retry

[sunib]

Release currently validates the push and then runs the entire CI pipeline again for the selected tag. This changes it to three stages: prepare → CI → publish. Resolve the release commit first and validate it once; the existing Go consumer test checks the public tag during releases, replacing the separate Go release job.

If publishing fails, use Re-run failed jobs (gh run rerun RUN_ID --failed). The successful preparation and CI jobs are reused, and npm downloads the original tested tarball. Keep the artifact for 30 days to match GitHub's retry window. An upload already accepted by npm becomes a no-op on retry. An explicit recovery run remains available if the artifact expires or is deleted.

Remove the second CI call, alternate artifact names, and custom commit/digest metadata. Keep immutable tag resolution, package/version checks, constant registry URLs, and protection against downgrading npm latest. Tags now precede release CI; npm still waits for every check to pass. A source failure requires a corrected release, not moving existing public tags.

Validation: seven release regression tests; actionlint; git diff --check; workflow graph checks for one CI invocation, matching artifact names, retention, and selected-commit checkouts. The updated Go consumer step is also exercised locally against the existing v0.3.0 tag. PR CI and CodeQL validate the follow-up; this PR does not publish a new release.

Summary by CodeRabbit

• Release Process

  • Release validation now uses the selected release version and public Go release tag.
  • Release preparation, CI validation, and npm publishing now run in a coordinated sequence.
  • Failed releases can be retried using the same tested package for up to 30 days.

• Documentation

  • Updated release guidance explains the new publishing flow, retry process, closely spaced releases, and trusted publisher setup.
  • Clarified that tags may exist even when npm publishing does not complete.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 9fb2e610-29c0-4b1d-9645-4bd8da03d853

📥 Commits

Reviewing files that changed from the base of the PR and between 2154f9d and acf79e2.

📒 Files selected for processing (5)

• .github/scripts/release.mjs
• .github/scripts/release.test.mjs
• .github/workflows/ci.yml
• .github/workflows/release.yml
• docs/releasing.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The release process now validates package name and version, prepares release tags before CI, tests the selected immutable commit, uploads a reusable npm artifact, and publishes it after CI succeeds. The workflows and release documentation now describe the updated retry and recovery behavior.

Changes

Release flow

Layer / File(s)	Summary
Package validation contract .github/scripts/release.mjs, .github/scripts/release.test.mjs	Replaces artifact hash and integrity checks with package name and version validation. Updates tests for matching and mismatched package metadata.
Release-aware CI validation .github/workflows/ci.yml	Accepts a release version, resolves public Go tags for release runs, fails when required tags are missing, warms Go module versions, and uploads the fixed-name npm-packages artifact with 30-day retention.
Prepared release orchestration .github/workflows/release.yml	Adds a preparation job for release metadata, runs CI against the selected commit, and publishes the CI artifact when a release is needed. Removes the separate consumable-release job.
Release operation documentation docs/releasing.md	Documents the prepared release flow, package publication, retry behavior, artifact retention, recovery runs, and closely spaced merges.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Refactor

Sequence Diagram(s)

sequenceDiagram
  participant ReleasePlease
  participant ReleaseWorkflow
  participant CIWorkflow
  participant NpmRegistry
  ReleasePlease->>ReleaseWorkflow: prepare release target and version
  ReleaseWorkflow->>CIWorkflow: run selected commit with release version
  CIWorkflow-->>ReleaseWorkflow: upload npm-packages artifact
  ReleaseWorkflow->>NpmRegistry: publish downloaded npm packages

Loading

Merge Risk: ⚪ Minimal · up to acf79

No concrete merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (3 skipped: 3 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: release validation occurs once and successful artifacts are reused during retries.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (3 skipped: 3 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/release-once

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}