release: require manual registry publication

[flyingrobots]

Summary

• stop Release Autotag after final preflight and tag creation instead of dispatching release.yml as github-actions[bot]
• print the manual release.yml dispatch command in the autotag job summary
• update release runbook, PR preview text, and preflight output for the temporary manual registry-publication step
• bind release preview step outputs through environment variables before actions/github-script uses them

Issue

Refs #677

Test plan

• actionlint .github/workflows/release-autotag.yml .github/workflows/release-pr.yml
• bash -n scripts/release-preflight.sh
• git diff --check
• npm run lint:md -- .github/RELEASE.md
• npm run lint:md:code
• npm run lint:docs-topology
• npm run lint -- --no-warn-ignored scripts/release-preflight.sh
• pre-push IRONCLAD M9 gates: link check, static gates, stable unit-test shards
• GitHub PR checks: all passing on PR release: require manual registry publication #678
• CodeRabbit review thread: addressed in d16ce18 and resolved/outdated by CodeRabbit

ADR checks

• This PR does not implement ADR 2 without satisfying ADR 3
• This PR does not touch persisted op formats; no ADR 3 readiness issue is required
• This PR does not touch wire compatibility; canonical-only wire behavior is unchanged
• This PR does not touch schema constants; patch and checkpoint namespaces are unchanged

[coderabbitai]

📝 Walkthrough

Walkthrough

Release automation now separates tag creation from manual registry publication. The autotag workflow prints a manual Release dispatch command, and the PR, preflight, and runbook text now follow that flow.

Changes

Release publication flow

Layer / File(s)	Summary
Autotag workflow control .github/workflows/release-autotag.yml	The autotag workflow drops actions: write, writes outputs in a grouped block, replaces automatic release.yml dispatch with a step-summary command, and updates the existing-tag skip message.
PR and preflight prompts .github/workflows/release-pr.yml, scripts/release-preflight.sh	The release PR workflow keeps its predicted tag outputs in a grouped block, and the PR comment and preflight success text now instruct manual release dispatch after autotag creates the tag.
Release runbook publication .github/RELEASE.md	The release runbook now splits tag creation from manual registry publication, adds dispatch and verification commands for npm and JSR, and updates the fallback wording.

Sequence Diagram(s)

sequenceDiagram
  participant Maintainer
  participant ReleaseAutotag as Release Autotag
  participant ReleaseWorkflow as Release workflow
  participant Registries as npm and JSR registries
  Maintainer->>ReleaseAutotag: merge commit reaches release-autotag
  ReleaseAutotag->>Maintainer: print gh workflow run release.yml -f tag=vX.Y.Z
  Maintainer->>ReleaseWorkflow: dispatch Release with the existing tag
  ReleaseWorkflow->>Registries: publish the package
  Maintainer->>Registries: verify both registry releases

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• git-stunts/git-warp#675: Updates the same release-autotag, release-pr, preflight, and runbook flow around tag creation and manual publication.

Poem

🐇 I hopped to the tag, then paused to say,
“Dispatch Release manually—hooray!”
npm and JSR glimmer in sight,
With clover-green summaries tucked in tight.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: making registry publication manual.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The description includes the required Summary, Issue, Test plan, and ADR checks sections with sufficient detail.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release/manual-registry-publish

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Release Preflight

• package version: 18.1.1
• prerelease: false
• npm dist-tag on release: latest
• npm pack dry-run: passed
• jsr publish dry-run: passed

If this PR is from a release/* branch and merges to main, Release Autotag will run final preflight and create v18.1.1. A maintainer who is a JSR @git-stunts scope member must then dispatch the Release workflow manually.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release-pr.yml:
- Line 82: The release workflow’s actions/github-script step is interpolating
the untrusted steps.predict.outputs.version directly into inline JavaScript,
which creates a code-injection risk. Bind that output through env first and read
it from process.env inside the script, and apply the same pattern to any other
step outputs referenced in this github-script block so the script body never
embeds PR-derived values directly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 0812d748-73e7-4b56-8815-9921a29cf03a

📥 Commits

Reviewing files that changed from the base of the PR and between 2f42457 and 70728d7.

📒 Files selected for processing (4)

• .github/RELEASE.md
• .github/workflows/release-autotag.yml
• .github/workflows/release-pr.yml
• scripts/release-preflight.sh

[github-actions]

Release Preflight

• package version: 18.1.1
• prerelease: false
• npm dist-tag on release: latest
• npm pack dry-run: passed
• jsr publish dry-run: passed

If this PR is from a release/* branch and merges to main, Release Autotag will run final preflight and create v18.1.1. A maintainer who is a JSR @git-stunts scope member must then dispatch the Release workflow manually.

[flyingrobots]

Code Lawyer Activity Summary

Audit target: origin/main...HEAD on release/manual-registry-publish (d16ce186).

ID	Source	Severity	File / Lines	Outcome	Evidence
1	PR review	Major	.github/workflows/release-pr.yml original line 82	Resolved before this audit; thread is resolved and outdated	Fixed by d16ce18; GraphQL unresolved active thread count: 0
2	Self-audit	None	Branch diff	No new self-discovered issues	Diff reviewed across .github/RELEASE.md, release-autotag.yml, release-pr.yml, and scripts/release-preflight.sh
3	Local validation	N/A	Working tree	Clean	git status --porcelain empty after git fetch origin
4	Remote validation	N/A	PR #678	Green	gh pr checks 678 --watch=false: all checks pass, including CodeRabbit

Local gate evidence:

• actionlint .github/workflows/release-autotag.yml .github/workflows/release-pr.yml
• bash -n scripts/release-preflight.sh
• git diff --check origin/main...HEAD
• npm run lint:md -- .github/RELEASE.md
• npm run lint:md:code
• npm run lint:docs-topology
• npm run lint
• npm run typecheck
• npm run release:guard -- --stage prep-pr --tag v18.1.1
• npm run test:local passed in isolated rerun; the first attempt was blocked before test execution by the runner memory threshold and produced no test failures.

Merge gate judgment:

Gate	Status	Notes
CI green	Pass	All PR checks pass
Unresolved review threads	Pass	0 active unresolved threads
Changes Requested	Pass	0 latest Changes Requested reviews
CodeRabbit cooldown/status	Pass	CodeRabbit status is green
Local tests/linters	Pass	Local gates listed above are green
Two approvals	Fail	0/2 approvals present

Result: merge gate remains locked solely on the explicit two-approval requirement.