fix(release): preserve PATH in stable suppression

[kattsushi]

Closes #261

Type

• Bug fix
• New feature
• Documentation only
• Code refactoring
• Maintenance/tooling
• Breaking change

Summary

Preserve executable lookup while classifying the exact seven-package stable merge in the beta workflow. Rename the stable-suppression record field from reserved shell PATH to MANIFEST_PATH and lock it with mutation-resistant contracts.

Root cause

Post-stable-merge beta run 33271234826 failed before publication because the resolver used:

while IFS='|' read -r TRANSITION PATH

That replaced shell executable lookup before invoking git and jq. Every beta build/test/PREPARE/auth/FINALIZE step was skipped; no artifact was published.

Changes

• Rename the stable-suppression manifest field and all references to MANIFEST_PATH.
• Preserve exact transitions, eight-path classification, malformed-shape rejection, and suppression output.
• Require manifest reads to use MANIFEST_PATH.
• Reject reserved PATH loop bindings and an exact regression mutation.

Verification

• Release-policy contract: 19/19 passed.
• Both release workflows parse with Ruby Psych.
• Nx affected test/typecheck/lint/build passed.
• Repository format and diff checks passed.
• Exactly two files changed: +13/−9.

Safety

• No Nx release lifecycle command ran locally.
• No workflow dispatch, tag, Release, npm publication, or dist-tag mutation occurred.
• Stable FINALIZE remains separately authorized after this fix merges and post-merge checks pass.

Summary by CodeRabbit

• Bug Fixes
  • Improved release validation reliability by preventing conflicts with reserved environment variables.
  • Strengthened checks for manifest names and versions during beta-to-stable transitions.
• Tests
  • Added coverage to detect invalid variable usage and verify manifest metadata validation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: f02ef4dc-c78d-4c45-bd12-0c095d5ee656

📥 Commits

Reviewing files that changed from the base of the PR and between bc0b1d8 and 9b5969f.

📒 Files selected for processing (2)

• .github/workflows/cd.yml
• scripts/release-policy-contract.test.mjs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The release workflow now uses MANIFEST_PATH instead of PATH in the stable-transition shape check. Release-policy contract tests reject PATH shadowing and validate manifest metadata references.

Changes

Stable suppression PATH fix

Layer / File(s)	Summary
Stable manifest binding .github/workflows/cd.yml	The stable-transition loop uses MANIFEST_PATH for git show and jq reads.
Contract and mutation validation scripts/release-policy-contract.test.mjs	Tests reject PATH shadowing, require manifest name and version checks, and mutate MANIFEST_PATH references.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 9b596

This fix preserves executable lookup during stable suppression while retaining the existing classification and suppression behavior. No actionable merge-blocking risk remains after normal checks and review.

Poem

A rabbit checks the release trail,
MANIFEST_PATH keeps commands hale.
No PATH gets tied in loops anew,
The contracts guard the workflow too.
Seven hops land clean and true.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the release fix and the preserved PATH behavior. It matches the primary change.
Linked Issues check	✅ Passed	The workflow now uses MANIFEST_PATH for stable suppression records and references. The contract updates reject PATH shadowing and protect manifest metadata and mutation behavior. The changes align wit…
Out of Scope Changes check	✅ Passed	The changes are limited to the stable suppression workflow loop and its release-policy contract tests. They directly support issue #261 and do not introduce unrelated code or release operations.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…

Full details: Linked Issues check

Explanation

The workflow now uses MANIFEST_PATH for stable suppression records and references. The contract updates reject PATH shadowing and protect manifest metadata and mutation behavior. The changes align with issue #261 objectives and acceptance criteria.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/beta-stable-suppression-path

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}