[aetosdios27]

What changed

• replace implicit Changesets publication with a guarded tarball publisher that explicitly uses the alpha dist-tag
• skip already-published versions, publish the CLI last, and verify latest never moves
• pin npm 11.6.2 to avoid npm 12 rewriting the CLI bin manifest
• correct the release documentation and add behavioral regression coverage

Root cause

Changesets treats a prerelease with no prior stable version differently from the repository's documented assumption and would target latest. The old tests asserted command text instead of exercising tag behavior.

Verification

• bun run test — 252 tests passed
• bun run typecheck
• bun run build
• bun run docs:check
• bun run release:pack
• bun run release:inspect
• bun run release:packages against npm — all packages skipped at 0.1.0-alpha.8; alpha verified and latest unchanged
• npm 11.6.2 dry-packed the CLI with both scribe and scb binaries intact

Summary by CodeRabbit

• Release Process

  • Improved alpha package publishing with synchronized version checks and explicit alpha tagging.
  • Existing published versions are skipped automatically, and the CLI is published after supporting packages.
  • Added safeguards to prevent unintended changes to the latest release channel.

• Documentation

  • Updated release instructions for the revised alpha publishing workflow and validation steps.

• Tests

  • Expanded automated coverage for prerelease validation, package ordering, duplicate handling, and release-channel protection.

[coderabbitai]

📝 Walkthrough

Walkthrough

The release process replaces direct Changesets publishing with a guarded alpha-package publisher. It validates synchronized prerelease packages, publishes missing tarballs in order, protects the latest tag, and uses npm 11.6.2 for OIDC publishing.

Changes

Alpha publishing

Layer / File(s)	Summary
Publisher implementation scripts/publish-alpha-packages.*, tests/release/publish-packages.test.ts	Adds alpha-state and manifest validation, registry checks, ordered tarball publication, duplicate-version skipping, latest protection, direct execution, and test fixtures.
Release workflow integration package.json, .github/workflows/release.yml, RELEASING.md, tests/release/*	Routes releases through bun run release:packages, documents guarded alpha publication, updates npm to 11.6.2, and updates release-policy tests.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Publisher as publishAlphaPackages
  participant Packages as Package manifests and tarballs
  participant Registry as npm registry
  Publisher->>Packages: Read alpha configuration and synchronized versions
  Publisher->>Registry: Query existing versions and dist-tags
  Publisher->>Registry: Publish missing tarballs with --tag alpha
  Publisher->>Registry: Verify latest is unchanged and alpha points to the release

Loading

Possibly related PRs

• aetosdios27/scribe#12: Related release scripts, documentation, and release tests.
• aetosdios27/scribe#16: Related alpha release tooling and audit workflow.
• aetosdios27/scribe#19: Related release workflow, publishing script, and release documentation.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: making alpha publishing fail closed.
Description check	✅ Passed	The description explains the changes, root cause, verification, and documentation updates, but it does not use all template headings or checklist items.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/fail-closed-alpha-publishing

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

scripts/publish-alpha-packages.d.mts (1)

1-4: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Duplicated package list between declaration and implementation.

The PublicPackage["name"]/"directory" unions duplicate the publicPackages array defined in scripts/publish-alpha-packages.mjs. Adding a fifth public package requires updating both files. TypeScript will not catch a missed update to this file at compile time in the .mjs source itself, only in TypeScript consumers.

Consider deriving these types from the runtime array with typeof in a .ts companion, or add a comment in both files pointing to each other so future authors remember to update both.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/publish-alpha-packages.d.mts` around lines 1 - 4, Eliminate the
duplicated package unions in PublicPackage by deriving the name and directory
types from the runtime publicPackages array, or otherwise establish an explicit
cross-reference between this declaration and scripts/publish-alpha-packages.mjs.
Ensure adding a package requires updating both definitions consistently.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/publish-alpha-packages.mjs`:
- Around line 40-54: Update the pre-check flow in publishAlphaPackages around
registry.distTags and registry.versions so missing brand-new packages are
treated as having no published versions and no dist-tags, allowing the initial
alpha publication to proceed. Preserve existing registry data for packages that
already exist and continue using tagsBefore for later tag handling.

---

Nitpick comments:
In `@scripts/publish-alpha-packages.d.mts`:
- Around line 1-4: Eliminate the duplicated package unions in PublicPackage by
deriving the name and directory types from the runtime publicPackages array, or
otherwise establish an explicit cross-reference between this declaration and
scripts/publish-alpha-packages.mjs. Ensure adding a package requires updating
both definitions consistently.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fa88bf51-9e37-4963-b974-6e06ea6dabdd

📥 Commits

Reviewing files that changed from the base of the PR and between b530763 and 48e2398.

📒 Files selected for processing (9)

• .github/workflows/release.yml
• RELEASING.md
• package.json
• scripts/publish-alpha-packages.d.mts
• scripts/publish-alpha-packages.mjs
• tests/release/changesets.test.ts
• tests/release/ci.test.ts
• tests/release/package-manifests.test.ts
• tests/release/publish-packages.test.ts