ci: bind release writeback to verified source

[altaywtf]

Problem

Release preparation could combine a verified run's package manifest with newer main-branch source, then tag whichever commit main pointed to after writeback.

Solution

Check out the verified event commit and create the signed version commit with an atomic expected-head check. Fetch the returned immutable commit and verify its parent, source tree, and exact prepared manifest before tagging. Preserve the publishing identity and package contract.

Proof

Real temporary Git fixtures cover branch movement before and after writeback, invalid prepared/returned trees, and failed readback after an accepted commit. Simulating the previous moving-main reset fails the regression. The full uncached gate passed 75 source tests and the installed-consumer test; the subsequent added readback-failure case passed with all 13 release tests and the final check gate. Native Node plugin import, actionlint, zizmor and Astra/medium slopguard passed.

No new release was forced; live signed preparation and publication remain unexercised by this change. The runbook describes reconciliation after partial writeback.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T17:56:55.986927Z	c590416	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🔵 Needs a closer look

It changes the release workflow’s source-of-truth commit and introduces new release writeback logic, which is operationally high-impact and warrants final human verification.

Pull request overview

This PR hardens the release pipeline so the version writeback commit is created and validated against the verified workflow event SHA, preventing race conditions where tagging/publishing could drift to newer main source after writeback.

Changes:

• Replace the prior semantic-release GitHub commit plugin with a custom createCommitOnBranch-based prepare step that enforces an expected-head check and verifies the immutable returned commit before tagging.
• Bind the release job checkout to ${{ github.sha }} (the verified event commit) rather than main.
• Add focused fixture-based tests for branch movement and returned-commit validation, and wire scripts/** into typecheck/lint/test inputs.

File summaries

File	Description
vite.config.ts	Expands graph inputs and test selection to include the new scripts/ release plugin and its tests.
tsconfig.json	Includes scripts/ in typechecking scope.
test/release-commit.test.ts	Adds fixture-based tests covering expected-head enforcement and returned-commit validation.
scripts/release-commit.ts	Introduces a custom semantic-release prepare hook that creates a signed writeback commit via GitHub API and validates the immutable result before resetting/tagging.
docs/releasing.md	Updates the release documentation to reflect the new signed writeback and recovery guidance.
.releaserc.json	Switches from @jno21/semantic-release-github-commit to the local ./scripts/release-commit.ts plugin.
.github/workflows/release.yml	Checks out the verified event SHA instead of main and removes the old extra plugin.

Review details

• Files reviewed: 6/7 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.