[nissa-seru]

The release-hold check (#329) gets the fixes its connectome-host copy's review found, since the script is the same file there (anima-research/connectome-host#256).

The change

• Repository forms: a repository URL that goes on past owner/repo, with a path such as a monorepo's /tree/main/pkg, a query or a fragment, was read as naming no repository, or as owner/repo#readme, which asked the wrong endpoint. npm's shorthand with a ref after # did the same. Each now reads as owner/repo.
• A 410 (issues turned off for the repository) got the generic message. It now says issues are off there, and points at the setting that chose the repository.
• The 5,000-item limit stopped a complete list of exactly 5,000 labelled items. The check now reads the 51st page, and stops only if it holds something.
• How to go on: every stop message now ends with what to run again, for where the check ran: npm version under preversion, even inside Actions, since that runs before any tag; the workflow for the tag; or npm publish. Before, four messages said only "run this again".
• The hold message names the setting that chose the repository, so a copy whose package.json still names its upstream sees why that repository was asked.
• The release-notes job sets up Node 24 before its check, as the publish job does. It had run on the runner image's Node.
• The workflow's comments and CONTRIBUTING now say the following:
  • What stops both release jobs: a failed build, which both need; a tag with no changelog section; and an open hold.
  • Each job checks for holds when it runs, so a hold filed between the two checks can stop one and not the other.
  • When what must happen first is this package's own release of a fix, the hold closes once the fix is merged.
  • Publishing a tarball made earlier with npm pack skips the check, as --ignore-scripts does: npm 11.17.0 runs no prepublishOnly for npm publish <file>.tgz.

Tests

test/release-holds.test.ts grows from 22 cases to 26. New:

• 410 and 429 answers, with and without a token;
• an answer that isn't JSON;
• exactly 5,000 items read whole, and one more stopping the release;
• GH_TOKEN taking precedence over GITHUB_TOKEN;
• the URL forms above;
• GITHUB_REPOSITORY when the field is absent or blank, or package.json can't be read;
• preversion's advice inside Actions;
• npm publish going ahead when no hold is open.

Evidence

At c1372cb0, on #329's head cb2a3365, which main merged as f8956a4e:

• The full suite, each file run on its own: Node 24.21.0 unforced 2014/2014, and Node 20.20.2 with --test-force-exit 2014/2014. Node 24 with --test-force-exit, as CI runs npm test, counted 2008/2008: it cut three files short, which pass whole unforced (npm test's --test-force-exit can end a test file before its tests report, so a short run still passes #294). Typecheck and build are clean. release-holds passes 26/26 in each.
• The routes, run at 58311d40, whose script and npm hooks are the same as this head's, with one hold open, in a project wired with this repository's preversion and prepublishOnly (node scripts/release-holds.mjs && npm run build): npm version patch is held and the version stays as it was, and npm publish --dry-run is held. With --ignore-scripts, both go ahead without asking GitHub, and so does npm publish of a packed tarball. Bun's bun pm version patch and bun publish --dry-run are held too.
• The two commits after c1372cb0 change only CONTRIBUTING and a workflow comment: what stops both release jobs, and a rewrap.
• 9c5e4e39, after them, changes only the test's npm helper. Under npm test, it runs npm's own CLI script, named in npm_execpath, with process.execPath, since a bare npm is npm.cmd on Windows, which execFile can't start without a shell. Anything else there, such as bun's binary, falls back to npm on PATH. release-holds passes 26/26 without npm_execpath, with npm's npm-cli.js in it (on Node 24 and 20, none of its own npm calls going through PATH) and with bun's binary in it. Windows itself wasn't run.
• e925628c, last, changes only CONTRIBUTING: closing a hold is the way past it. npm's --ignore-scripts skips the check, but on npm version it skips the changelog fold too, so the tag would fail the publish workflow's changelog check.

Read by Naomi-2422 (Claude Opus 5.5), who ran each release route with a hold open, and which way each of the test's npm calls went. Greptile's review of chronicle's copy of this check found the Windows gap.

@antra-tess, @Anarchid: it changes how a release is made, not what ships. I'll merge it once its checks pass on its merge with the then-current main, and not before 2026-10-15 15:00 UTC, unless you'd like changes first.

— Ada-1017 (Claude Opus 5.5)

[greptile-apps]

Confidence Score: 5/5

[High impact] This PR appears safe to merge; no actionable regression was found.

Summary

Hardens the release-hold check by accepting repository URL suffixes, fixing the 5,000-item boundary, and improving stop messages. It also sets up Node 24 for release notes and expands the tests.

• The hold check reads GitHub repository links and gives specific stop instructions.
• The check allows exactly 5,000 labelled items when page 51 is empty.
• The release-notes job checks holds on Node 24.

_{Reviews (1) · Last reviewed commit: "docs(contributing): rewrap the Releases ..." · Reviewed by Greptile}

[nissa-seru]

Pushed 9c5e4e39, a fast-forward from c7841a1e that changes only the test. Its wiring tests started npm with execFile("npm"), which on Windows is npm.cmd and can't be started without a shell. Under npm test, they now run npm's own CLI script, named in npm_execpath, with the Node that runs them, and fall back to npm on PATH otherwise. Greptile found it in chronicle's copy of this check. The description's Evidence says what was run. Windows itself wasn't.

— Ada-1017

[nissa-seru]

Pushed e925628c, a fast-forward that changes only CONTRIBUTING's Releases bullet. It said npm's --ignore-scripts skips the hold check, which read as a way past a hold. On npm version it also skips the changelog fold, so the tag lands without its ## X.Y.Z section and fails the publish workflow's "Require changelog section" step after it's pushed. The bullet now says closing the hold is the way past it. Anarchid's review of chronicle's copy found it.

— Ada-1017