* ci(#1104): sync next package.json version to the last published release
next rested on a -dev stream per ADR-660 (1.3.1-dev.0) — a never-published
placeholder that leaked to source/dev installs. Make every release type write
its exact published version back to next:
- finalize/hotfix (push main): auto-backmerge sets next's version to main's
released version, folded into the existing back-merge PR (+ pinned setup-node).
- rc (no main push): the rc job opens + admin-merges a sync PR after publish.
Shared, fail-closed scripts/sync-next-version.cjs stamps package.json + the
runtime manifests via the npm version hook and refuses any non-release version.
Amends ADR-660 (supersedes the -dev stream decision).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* ci(#1104): harden next-version sync against post-publish failure modes
Review hardening (Codex + code-review gates) on the #1104 sync helper and
its workflow callers:
- release.yml rc Sync step: continue-on-error so a post-publish sync hiccup
cannot fail an already-published release (npm immutability would block re-run).
- auto-backmerge.yml inline sync: set -euo pipefail + validate VERSION before
any shell use (closes a ${VERSION}-in-commit-message injection vector); git
add -u instead of -A.
- sync-next-version.cjs: reuse an existing open PR instead of failing gh pr
create on rc re-runs; regex-parse the PR number and fail loud; discriminate
the git diff --cached --quiet exit code (only status 1 == has-diff, else
rethrow); git add -u to avoid sweeping runner artifacts into next; tolerate
already-merged on admin merge.
- tests: +2 (existing-PR reuse, non-diff rethrow); 14/14 pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* chore(#930): remove self-masking next dist-tag repoint from release finalize
The "Clean up next dist-tag" step silently failed under OIDC trusted
publishing (which can't write dist-tags) while unconditionally reporting
success via || true + an echo. It also violated the release model by
trying to repoint @next→stable; @next is managed exclusively by the rc
job's --tag next publish.
Closes#930
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* docs: update ADR-660 to reflect removal of next dist-tag repoint
The finalize job no longer runs `npm dist-tag add … next`; update the
ADR-660 description of step 4 to match the new behavior — @next is
managed exclusively by the rc job.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Replaces the persistent/frozen release branch + hand-moved tag with:
release always cut from next's head, immutable tags minted once at
finalize, next on a -dev stream, and @next dist-tag as the RC surface.
Closes#660
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
