fix: support exact npm release recovery

[jan-kubica]

Summary

• allow manual releases to resume one exact prior artifact run at its matching source SHA
• pin recovery pack checkouts and the independent-release state machine to the same source
• add a structural regression test for both recovery coordinates

Validation

• focused Bun test
• workflow YAML parse
• git diff --check

CC on behalf of @jan-kubica

Summary by CodeRabbit

• New Features

  • Added recovery options for manual publishing workflows.
  • Releases can now be rebuilt from a specified artifact run or source revision.
  • When recovery details are not provided, publishing continues using the default source and artifact behavior.

• Bug Fixes

  • Improved reliability when recovering interrupted or failed publishing runs.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 512b3fb3-9b6e-4db4-a622-ac0521b8227e

📥 Commits

Reviewing files that changed from the base of the PR and between 0e8cea0 and 24bff3f.

📒 Files selected for processing (2)

• .github/workflows/publish.yml
• scripts/bun-lock-workspace-versions.test.ts

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/npm-release-recovery

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 24bff3f6fd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Require a source ref when resuming an artifact run

When a dispatcher supplies artifact_run_id but leaves the independently optional source_ref blank, the release downloads tarballs from the prior run while the pack checkout falls back to the current github.sha and the reusable workflow receives no matching source coordinate. If main has advanced since that run, recovery verifies different manifests/source from the selected artifacts, so it can fail or operate on the wrong release state. Reject this input combination at the workflow boundary, or derive the source SHA from the selected run.

AGENTS.md reference: AGENTS.md:L56-L56

Useful? React with 👍 / 👎.