Fix authoritative immutable release recovery selection

Merged
UN
3mo ago
+780-44

Summary

  • classify existing same-day tags before analyzer, dependency, and build work so issue-triggered cleanup cannot be rejected by a generated release commit
  • select authoritative exact-tag Release evidence across tag-push and guarded workflow-dispatch runs, preferring durable successful publication over stale failures
  • watch active recovery or dispatch the reviewed current release.yml from main; never rerun historical workflow code
  • make dispatch runs self-identifying, document operator behavior, and add executable same-day marker plus duplicate-refusal contracts

Project management

  • pm-db8onn
  • Production reproduction: Auto Release run 31874957449 reopened #1017 after v2026.8.15 was already published successfully

Verification

  • 42 focused unit/integration tests
  • full repository coverage: 100/100/100/100
  • pnpm build
  • pnpm typecheck
  • pnpm quality:docs-skills
  • pnpm quality:static
  • pnpm security:scan
  • YAML parse, Prettier, and diff checks
  • live read-only selection: v2026.8.15 tag-push success 31874087916
  • historical control: v2026.8.5 dispatch success 31001951195 wins over failed push 30994468126

Production control after merge

Close #1017 once from the reviewed main SHA. The issue-triggered Auto Release run must recognize immutable v2026.8.15 before analyzer/build work, record the existing successful Release run, leave the blocker closed, and create no second tag or npm version.

Summary by Sourcery

Strengthen auto-release blocker recovery to recognize existing same-day immutable tags, prefer authoritative successful Release runs, and avoid rerunning historical workflows or rebuilding when a published release already exists.

Enhancements:

  • Add preflight detection of immutable same-day release tags to short-circuit analyzer, dependency, and build steps during issue-triggered recovery.
  • Introduce a release-run selection utility to choose the authoritative Release workflow run across tag-push and guarded workflow-dispatch events, favoring durable successes over stale failures.
  • Update auto-release recovery logic to watch active exact-tag runs or dispatch the current main-based Release workflow with explicit tag input, rather than rerunning historical runs, and to treat published tag/sha as immutable.

CI:

  • Adjust Auto Release and Release GitHub workflows to surface self-identifying dispatch runs via run-name, to pass immutable tag and SHA through environment, and to remove rerun-based recovery in favor of current-workflow dispatch and run selection.

Documentation:

  • Document the updated blocker recovery policy, including same-day tag detection, authoritative Release evidence selection, and current-workflow dispatch behavior, and link the new project-management issue for this contract.

Tests:

  • Add unit tests for the release-run selection utility and integration tests that exercise guarded issue recovery, immutable tag recognition, retry markers, and CI workflow contracts for the new behavior.

Summary by cubic

Fixes authoritative selection of immutable Release recovery runs and hardens dispatch evidence to stop stale reruns from reopening blockers. Previously issue-closure retries reran failed tag-push workflows and ran analysis/install/build before classifying existing tags; now we detect same-day tags first, select the exact-tag run across push and reviewed dispatch, and dispatch the current release.yml from main only when evidence is missing or failed.

  • Detects existing tag and SHA before analyzer, dependency install, and build; skips those steps on recovery paths.
  • Adds scripts/release/release-run-selection.mjs to choose the authoritative run: completed success wins; otherwise newest active; otherwise latest terminal. Requires default-branch identity for dispatch candidates, limits archived-log fallback to five successful same-day/default-branch dispatches, and stops at the first exact tag match.
  • release.yml marks dispatch runs via run-name; auto-release no longer uses reruns of historical workflows.
  • Updates docs/RELEASING.md; adds focused unit/integration coverage for run selection, recovery ordering, and duplicate-refusal markers.