fix(release): pin exact stable targets

[kattsushi]

Closes #257

Type

• Bug fix
• New feature
• Documentation only
• Code refactoring
• Maintenance/tooling
• Breaking change

Summary

Version each protected stable package through Nx with its exact authorized target instead of applying one history-dependent global patch specifier.

Root cause

Run 33264803174 proved Nx resolves relative bumps per package from historical stable tags when available:

• React Router used stable 0.5.10 and calculated 0.5.11, not authorized 0.6.0.
• Solid Query used stable 0.5.11 and calculated already-published 0.5.12, not authorized 0.5.13.
• Other packages happened to match through compatible tags or prerelease-manifest fallback.

The run failed before branch creation and published nothing.

Changes

• Iterate the exact seven NAME|MANIFEST_PATH|OLD|NEW records sequentially.
• Invoke pnpm nx release version "$NEW" "--projects=$NAME" once per package.
• Disable commit, tag, push, and staging on every invocation.
• Reject the global patch form, global project selection, direct manifest editing, wrong/missing/duplicate records, and weakened ordering.
• Add no-network harnesses for historical Router 0.5.10, stale Solid 0.5.12, exact target collision, no delegation after failure, cumulative seven-entry changelog idempotency, and dry-run no-write behavior.
• Preserve the exact path allowlist, target validation, protected commit/push, and FINALIZE semantics.

Verification

• Release policy + version action: 46/46 tests passed.
• Ruby Psych parsed the workflow.
• Nx affected test/typecheck/lint/build passed.
• Repository format and git diff --check passed.
• Exactly three files changed: +92/−3.

Safety

• No Nx release lifecycle command ran locally.
• No workflow dispatch, release branch, protected ref, tag, GitHub Release, npm version, or dist-tag was created or changed.
• This PR does not authorize retrying stable PREPARE; retry remains a separate exact-SHA decision after merge verification.

Summary by CodeRabbit

• Bug Fixes

  • Stable releases now apply each package’s specified version independently, supporting projects with different version numbers.
  • Improved handling of prerelease histories and prevention of exact stable-version conflicts.
  • Release preparation now validates the complete package release matrix and rejects unsupported manifest changes.

• Tests

  • Added coverage for multi-package releases, repeated execution, dry runs, and cumulative changelog updates.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 07554726-1a6f-46d8-aa7b-833cf8b6e354

📥 Commits

Reviewing files that changed from the base of the PR and between 2c3d2d0 and f44c2fb.

📒 Files selected for processing (3)

• .github/workflows/release-stable.yml
• scripts/release-policy-contract.test.mjs
• tools/release-version-actions.test.cjs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

PREPARE now versions each stable package with its explicit target version. Contract tests enforce the seven-package matrix and command shape. Regression tests cover collisions, delegated calculations, changelog idempotence, and dry-run behavior.

Changes

Stable release target versioning

Layer / File(s)	Summary
Per-package stable versioning .github/workflows/release-stable.yml, scripts/release-policy-contract.test.mjs	PREPARE invokes Nx once per release record with the exact target and project name. Contract tests validate the command, seven-package matrix, and manifest protections.
Release action regression coverage tools/release-version-actions.test.cjs	Tests cover heterogeneous targets, published-version collisions, per-package calculations, cumulative changelog updates, idempotence, and dry runs.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to f44c2

This change makes stable package releases use explicitly authorized versions while preserving validation and protected commit and push behavior. No actionable merge-blocking risk remains after normal checks and review.

Poem

A rabbit checks each target bright
Seven packages line up right
Nx hops from name to name
Changelogs merge without duplicate fame
Dry runs leave the files pristine

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: stable release targets are pinned to exact versions.
Linked Issues check	✅ Passed	The changes satisfy issue #257. PREPARE now versions each of the seven protected packages sequentially with its exact target and project, while the contract and regression tests cover forbidden global…
Out of Scope Changes check	✅ Passed	The changes are limited to the stable release workflow and related policy and version-action tests. All changes support the exact-target release objectives in issue #257.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…

Full details: Linked Issues check

Explanation

The changes satisfy issue #257. PREPARE now versions each of the seven protected packages sequentially with its exact target and project, while the contract and regression tests cover forbidden global patching, direct manifest edits, validation, collisions, changelog behavior, and dry-run behavior.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/stable-exact-targets

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}