ci: automate signed catalog releases - #314

How this fits together

The catalog release caller sends version, signing, CI, and validation requirements to the shared release workflow, which produces verified source archives and publishes GitHub Releases.

flowchart TD
  A[Signed tag or manual dispatch] --> B[Catalog release caller]
  B --> C[Protected source and CI validation]
  C --> D[Catalog checks and source archives]
  D --> E[Independent artifact verification]
  E --> F[GitHub Release publication]

Technical review

Best possible solution:

Retain the thin shared-workflow caller with accurate retry documentation and verified publication authorization.

Do we have a high-confidence way to reproduce the issue?

The retry documentation mismatch is source-reproducible: the selected publisher explicitly resumes matching drafts and accepts identical public releases; no target code was executed.

Is this the best way to solve the issue?

A thin caller is appropriate because the shared workflow already owns signing checks, artifact verification, and publication; duplicating those controls locally would create another release owner.

Full review comments:

• [P3] Document matching-release retries accurately — docs/RELEASING.md:12-13
  When a release attempt is retried against an existing draft or public release, the selected shared workflow resumes a compatible draft or accepts a public release whose notes and assets match exactly. This statement instead says any existing GitHub Release is rejected, giving operators the wrong recovery contract. Describe exact-match retries and rejection of differing existing bytes.
  Confidence: 0.99

Overall correctness: patch is correct
Overall confidence: 0.9

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 77b229e42b40.

Merge-risk options

Maintainer options:

1. Hold for authorization evidence (recommended)
   Keep this PR open until the release owner supplies allowed-signer and forbidden-signer proof, including tag invalidation before publication.
2. Separate rehearsal from publication
   Initially enable only no-publish dispatches and introduce release-write publication after the authorization boundary is demonstrated.

Provenance checked

• Manual catalog release publication changes intended behavior with a stated reason (711711b: chore(release): prepare initial 0.1.0 source release #266 established versioned GitHub source releases while keeping npm development tooling private.)

Testing

Proof path: none.

Security

Needs attention: The publication controls are present in source, but their final-effect authorization boundary remains unverified.

Evidence

What I checked:

• Introduced change and current-main boundary: The pinned introduction adds the release caller, signer policy, and version metadata, and replaces the manual publication instructions; these changes are absent from the fetched main revision. (.github/workflows/release.yml:30, dd4773d87c5f)
• Applicable repository policy: Read the complete root AGENTS.md; no changed path has an additional ancestor policy, and .agents/maintainer-notes is absent. The patch uses canonical source files and does not restore vendored autoreview implementations. (AGENTS.md:7, dd4773d87c5f)
• Executed dependency contract: The caller executes release-source.yml@v1 with release-write permission, affirmatively making this dependency's runtime and trust contract applicable. The inspected v1 tag resolves to this dependency commit; CONTRIBUTING.md requires failure-mode review for changed publication gates. (CONTRIBUTING.md:5, e24b91e43745)
• Publication authority controls: The shared workflow verifies an SSH-signed tag against the frozen source policy, separates caller tests from write credentials, binds both verifier attestations, and rechecks the exact tag object before making a draft public. (.github/workflows/release-source.yml:1015, e24b91e43745)
• Existing-release retry behavior: The publisher accepts an existing public release when notes and downloaded assets match exactly, and resumes a compatible draft without overwriting differing assets; it does not categorically reject existing releases. (.github/workflows/release-source.yml:995, e24b91e43745)
• Discussion and supplied validation: The complete PR body reports frontmatter validation, actionlint, whitespace checks, and an earlier review, and describes the no-publish dispatch as future work; the discussion contains only bot acknowledgements, with no release-path output or media. (dd4773d87c5f)

Labels

Label changes:

• add P2: This is a focused release-tooling improvement without an established urgent user-facing regression.
• add merge-risk: 🚨 security-boundary: The new caller delegates contents-write authority to a workflow that converts signed-tag authorization into public release publication.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Label justifications:

• P2: This is a focused release-tooling improvement without an established urgent user-facing regression.
• merge-risk: 🚨 security-boundary: The new caller delegates contents-write authority to a workflow that converts signed-tag authorization into public release publication.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Add final-effect proof for an unlisted signer and show deletion or replacement of the validated tag blocks queued or retried publication before release I/O.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.