* ci(#1104): sync next package.json version to the last published release
next rested on a -dev stream per ADR-660 (1.3.1-dev.0) — a never-published
placeholder that leaked to source/dev installs. Make every release type write
its exact published version back to next:
- finalize/hotfix (push main): auto-backmerge sets next's version to main's
released version, folded into the existing back-merge PR (+ pinned setup-node).
- rc (no main push): the rc job opens + admin-merges a sync PR after publish.
Shared, fail-closed scripts/sync-next-version.cjs stamps package.json + the
runtime manifests via the npm version hook and refuses any non-release version.
Amends ADR-660 (supersedes the -dev stream decision).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* ci(#1104): harden next-version sync against post-publish failure modes
Review hardening (Codex + code-review gates) on the #1104 sync helper and
its workflow callers:
- release.yml rc Sync step: continue-on-error so a post-publish sync hiccup
cannot fail an already-published release (npm immutability would block re-run).
- auto-backmerge.yml inline sync: set -euo pipefail + validate VERSION before
any shell use (closes a ${VERSION}-in-commit-message injection vector); git
add -u instead of -A.
- sync-next-version.cjs: reuse an existing open PR instead of failing gh pr
create on rc re-runs; regex-parse the PR number and fail loud; discriminate
the git diff --cached --quiet exit code (only status 1 == has-diff, else
rethrow); git add -u to avoid sweeping runner artifacts into next; tolerate
already-merged on admin merge.
- tests: +2 (existing-PR reuse, non-diff rethrow); 14/14 pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
