#351 ci: show a release summary and supersede unapproved release runs

Adds a Release summary job to Publish to npm and Release Binaries that runs after the version check and before the environment-gated job, so whoever approves the release sees on the run page what approving ships. It runs under the same condition as the gated job. Publish to npm gains a version output on the build job for this.

The job uses the default GITHUB_TOKEN with contents, actions and pull-requests read only. Every step is continue-on-error and the summary step has a 3 minute timeout, so a failed or slow summary never holds up a release. No environments, secrets or protection rules change.

The summary comes from a local composite action, .github/actions/release-summary. It shows:

• the version or image tag the gated job publishes
• the commit being released, the previously released commit (the newest earlier run of the same workflow on the same branch whose gated job succeeded) and a compare link
• merged pull requests in that range with title, author and approvers, plus commits that landed without a pull request (newest 100 commits)

Supersede release runs still waiting for approval

A run held at the environment approval used to sit there until someone approved or cancelled it. In firecrawl-mcp-service it also blocked every newer run behind a workflow-level concurrency group. Elsewhere it stayed approvable after newer releases went out, so approving it would publish an older build.

• A Supersede unapproved runs job runs under the same condition as the gated job. It cancels earlier runs of the same workflow on the same branch, but only when the earlier run's status is waiting, meaning held at the approval, and the compare API shows this run's commit includes it. The status is read again just before cancelling, so a run that has been approved and started publishing is left alone.
• The gated job gets job-level concurrency (${{ github.workflow }}-release-${{ github.ref }}, cancel-in-progress: false). Two publishes never overlap, a publish already running is never cancelled, and a newer pending job replaces an older pending one.

This job holds actions: write (for cancelling) and contents: read, and every step is continue-on-error, so it can never block a release. No environments or protection rules change.

actionlint passes on the changed workflows. The job only runs on pushes to the release branch, so it first shows on a real run with the next release. The render below is the script run locally against live run history and the current main.

Release Binaries, from current main

Release summary

Approving Create release and upload assets publishes the version below from this commit.

Version	v1.26.23
Commit	39783b7a4d chore(release): bump version to 1.26.23 (#350)
Previously released	1b8a04f1c5 (tag v1.26.22), released in run 39831272831
Compare	1b8a04f1c5...39783b7a4d

Merged pull requests (5)

PR	Title	Author	Approved by
#350	chore(release): bump version to 1.26.23	PhantomInTheWire	none
#349	fix: plain output when the CLI is not attached to a terminal	PhantomInTheWire	rakshith48
#332	feat: stamp the coding agent in the request origin	erikengervall	none
#347	chore: remove unused dependencies	dtaivpp	none
#346	ci: separate build and publish jobs and pin release actions	dtaivpp	none

Publish to npm, from current main

Release summary

Approving publish publishes the version below from this commit.

Version	firecrawl-cli@1.26.23 (npm tag latest)
Commit	39783b7a4d chore(release): bump version to 1.26.23 (#350)
Previously released	1b8a04f1c5 (tag v1.26.22), released in run 39831272837
Compare	1b8a04f1c5...39783b7a4d

Merged pull requests (5)

PR	Title	Author	Approved by
#350	chore(release): bump version to 1.26.23	PhantomInTheWire	none
#349	fix: plain output when the CLI is not attached to a terminal	PhantomInTheWire	rakshith48
#332	feat: stamp the coding agent in the request origin	erikengervall	none
#347	chore: remove unused dependencies	dtaivpp	none
#346	ci: separate build and publish jobs and pin release actions	dtaivpp	none