ci: validate application release version metadata - #140

How this fits together

The application release workflow passes a requested version and checked-out source into preflight, then builds and publishes an archive only after validation succeeds.

flowchart TD
  A[Tag push or manual dispatch] --> B[Application release workflow]
  B --> C[Package version validation]
  C --> D[Source signature and CI checks]
  D --> E[Source archive and checksums]
  E --> F[GitHub release publication]

Technical review

Best possible solution:

Land the package-version guard in the existing application preflight while preserving the separate SDK release contract.

Do we have a high-confidence way to reproduce the issue?

Main never compares the requested application version with package.json, so mismatched metadata can pass when the existing release gates succeed; no target code was executed during this review.

Is this the best way to solve the issue?

The existing preflight is the correct owner for this check, and the patch rejects invalid metadata early without adding a parallel release path.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against b245202dec20.

Provenance checked

• Application release preflight keeps the original intent (b245202: Provide signed application source releases with immutable archives, changelog notes, protected-main ancestry, and exact-commit push CI.)

Testing

Proof path: unit tests only.

Security

None.

Evidence

What I checked:

• Exact introduced change: The pinned diff adds a two-line package-version comparison to the existing preflight, a regression-test workflow step, tests, documentation, and an Unreleased changelog entry. (scripts/release-preflight.py:39, 3bb6300f84b3)
• Current main still needs the guard: Main validates version syntax and then proceeds directly to Git and release checks without comparing package.json; GitHub main still points to the pinned base. (scripts/release-preflight.py:39, b245202dec20)
• Regression coverage: The mismatch fixture checks rejection before API access; the matching-version fixture proceeds to the existing exact-commit push-CI gate. Additional cases protect dated, unique, nonempty release notes. (scripts/test_release_preflight.py:13, 3bb6300f84b3)
• Original release intent and ownership: ci: validate signed releases and add no-publish rehearsals #139 introduced the application release owner and required protected-main history, signed immutable tags, and exact-commit push CI; this PR preserves those checks. (.github/workflows/release.yml:39, b245202dec20)
• Policy and owner direction: Root AGENTS.md was read in full; no scoped ancestor policies or maintainer-note entries were present for these paths. The supplied maintainer-authored classification and prior merged release work establish direction. The single-reviewer instruction overrides the repository helper requirement; no helper or second reviewer ran. (AGENTS.md, 3bb6300f84b3)
• Discussion and validation: The complete body reports three passing Python tests and actionlint; both comments contain review-status updates only. All ten current head checks completed successfully. No release-path execution evidence was supplied. (3bb6300f84b3)

Likely related people:

• Peter Steinberger: Raw commit b245202 adds scripts/release-preflight.py:31 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: b245202dec20; files: scripts/release-preflight.py)

Labels

Label changes:

• add P2: This prevents inconsistent application release metadata without evidence of a current user-facing outage.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: This prevents inconsistent application release metadata without evidence of a current user-facing outage.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.