ci: add verified source release pipeline

[steipete]

Add release-source.yml@v1 for ClawRouter's existing source distribution. Signed annotated v* tags require protected-main ancestry, consistent version metadata, dated changelog notes, and green push CI on the exact commit. The shared workflow produces independently verified source archives, inventory, and SHA-256 checksums before publishing the GitHub Release.

Manual dispatch defaults to a no-publish rehearsal of current protected main. The credential-free verification helper builds the Worker/admin, runs tests and local Worker smoke, and compiles a Wrangler dry-run bundle. Existing production/FakeCo dispatch workflows, expected-SHA guards, deployment scripts, and Docker distribution are unchanged. No npm package, binary, or container image publication is introduced.

Validation: actionlint and shellcheck passed; independent Codex autoreview is clean through P2. The AWS Crabbox proof passed 1,301 Worker tests, admin/script checks, local HTTP/WebSocket/content-cleanup smokes, and Wrangler dry-run packaging. The helper avoids repeating the Worker suite that the build already runs. PR CI provides the broader browser/native/self-host matrix. The no-publish release run on merged main is the final proof.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

This PR adds signed-tag source releases, a no-publish rehearsal, a verification script, and release instructions.

Example: Dispatch Release on main with version 0.4.0 and dry_run=true.

• Before: Main has no Release workflow for rehearsing source publication.
• After: The new caller requests verified source packaging, but release-name is unsupported by the called workflow and prevents execution.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	Useful and focused direction, but the caller cannot execute as written and its publication authority lacks inspectable final-effect proof.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🦪 silver shellfish (2/6)	Security review found an item that needs attention.

Product

Kind: Feature · Worth it: Yes · Fix scope: Complete
User problem: Release owners lack a repeatable source-publication path that checks the signed tag, exact source, CI, archives, and checksums.
Reason: The supplied maintainer-authored direction authorizes this focused source-release capability, and its boundary agrees with the existing private-workspace distribution.

Merge readiness

⛔ Blocked before merge - 4 items remain

Keep this PR open: the release pipeline is useful and absent from main, but an unsupported reusable-workflow input blocks both rehearsal and publication.

Priority: P2
Reviewed head: 1ca4b06da35fc60436a540b808d31719025bdc9f

Before merge

• Add real behavior proof - Authority-chain proof required: show the real release caller accepting an allowed SSH-signed tag and rejecting an unlisted signing key or a tag replaced after validation before making a GitHub Release public, including retry behavior. The body reports local helper success but supplies no inspectable output or linked artifact for this boundary and defers the caller rehearsal until merged main; provide redacted logs or a linked run, removing credentials and non-public endpoints. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Remove the undeclared release-name input (P1) - Both tag pushes and manual rehearsals call release-source.yml@v1 with release-name, but that workflow's workflow_call.inputs does not declare it. At dependency commit e24b91e43745823d1d86f78d0df7fcabdbb3218f, GitHub rejects this caller during workflow validation before any build or verification job runs. Remove this input; the shared publisher already names the release from its tag.
• Resolve security review attention item - The inspected permission and artifact boundaries are coherent, but final-effect rejection evidence is still required for the new publication authority.
• Resolve merge risk - Before merge, establish that the new publication boundary rejects a tag signed by an unlisted key and a tag changed after validation before release publication.

Findings

• [P1] Remove the undeclared release-name input — .github/workflows/release.yml:41

Tests

• Missing end-to-end proof: Supply a real caller rehearsal plus publication-boundary evidence showing an allowed signed tag succeeds and an unlisted signer or changed tag is rejected before publication.

Agent review details

How this fits together

GitHub tag pushes and manual dispatches enter a shared release workflow that validates source, runs credential-free checks, assembles archives, verifies their bytes, and publishes a GitHub Release.

flowchart TD
  A[Tag push or dispatch] --> B[ClawRouter release caller]
  B --> C[Protected source and tag validation]
  C --> D[Local build and smoke checks]
  D --> E[Source archives and inventory]
  E --> F[Independent verification]
  F --> G[GitHub Release publisher]

Loading

Technical review

Best possible solution:

Keep the thin shared-workflow caller, remove its unsupported input, and verify the authorized and forbidden publication paths.

Do we have a high-confidence way to reproduce the issue?

The blocker is source-verifiable: this caller passes release-name, while the exact v1 dependency declares no such workflow_call input; no release workflow was executed during review.

Is this the best way to solve the issue?

Using the shared source-release workflow fits the existing distribution boundary and avoids duplicating publication logic, provided the caller matches its declared interface.

Full review comments:

• [P1] Remove the undeclared release-name input — .github/workflows/release.yml:41
  Both tag pushes and manual rehearsals call release-source.yml@v1 with release-name, but that workflow's workflow_call.inputs does not declare it. At dependency commit e24b91e43745823d1d86f78d0df7fcabdbb3218f, GitHub rejects this caller during workflow validation before any build or verification job runs. Remove this input; the shared publisher already names the release from its tag.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.97

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 3e31abb4f33d.

Merge-risk options

Maintainer options:

1. Hold until the publication boundary is demonstrated (recommended)
   Keep this PR open while release owners provide authorized-path and forbidden-tag evidence before enabling publication.
2. Provide final-effect failure-mode evidence
   Exercise the real publication owners with an allowed signing key, an unlisted signing key, and a tag replaced after validation; show that forbidden cases never make a release public.

Provenance checked

• README release guidance keeps the original intent (docs: rewrite README to house standard #108: Keep README a concise front door with deeper operating guidance in focused documents.)
• Changelog release structure keeps the original intent (0808315: Finalize source-release notes while preserving contributor credit and an Unreleased section.)

Testing

Proof path: none.

Security

Needs attention: The inspected permission and artifact boundaries are coherent, but final-effect rejection evidence is still required for the new publication authority.

Evidence

What I checked:

• Verified introduction and main boundary: The pinned diff adds the release caller, signer policy, verification helper, and documentation; main has no .github/workflows/release.yml. (.github/workflows/release.yml:30, 1ca4b06da35f)
• Authoritative dependency contract: The PR executes this reusable workflow at v1, which resolves to this commit. Its complete workflow_call input list has no release-name; publication uses the tag as the release name. This execution relationship makes its contract and contribution policy applicable. (.github/workflows/release-source.yml:5, e24b91e43745)
• Publication authority inspection: Source validation checks protected ancestry and SSH signatures; build and verifier jobs lack contents-write permission; the publisher binds both attestations and rechecks the frozen tag object before making the release public. CONTRIBUTING.md requires explicit failure-mode review for publication gates. (.github/workflows/release-source.yml:965, e24b91e43745)
• Supplied proof and discussion: The full body reports local build, test, smoke, and packaging success but supplies no logs or linked artifact for the new release caller; it explicitly leaves the no-publish run for merged main. Both discussion comments are bot status messages. (1ca4b06da35f)
• Existing release and deployment boundaries: chore(release): prepare v0.4.0 #158 established source-only GitHub publication without npm publication or deployment; fix(ci): require reviewed deployment source #256 established explicit reviewed-source deployment guards. This PR preserves those deployment workflows. (.github/workflows/deploy-cloudflare.yml:116, c15677ca6636)
• Repository policy and inspection limits: Read the full root AGENTS.md; no nested AGENTS.md or maintainer-note entries were present. Review remained read-only and no autoreview helper or tests ran. Some historical blobs were unavailable locally; REST commit patches independently verified the cited owner contributions. Final git status was clean. (AGENTS.md:1, 1ca4b06da35f)

Likely related people:

• Peter Steinberger: Raw commit 0808315 adds CHANGELOG.md:5 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 080831563e0a; files: CHANGELOG.md)

Review metrics

Metric	Value	Why it matters
Introduced scope	+60 workflow, signer-policy, and shell lines; +62 documentation lines; no deletions	Growth is focused on the new release entry point and its operating instructions; Worker and deployment production code are unchanged.

Labels

Label changes:

• add P2: The defect blocks a new release automation path while existing runtime and deployment workflows remain available.
• add merge-risk: 🚨 security-boundary: The PR introduces contents-write publication authority whose forbidden-tag and changed-tag rejection has not been demonstrated through the final effect.
• add merge-risk: 🚨 automation: The new reusable-workflow call passes an undeclared input, preventing release jobs from starting.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦪 silver shellfish.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Label justifications:

• P2: The defect blocks a new release automation path while existing runtime and deployment workflows remain available.
• merge-risk: 🚨 automation: The new reusable-workflow call passes an undeclared input, preventing release jobs from starting.
• merge-risk: 🚨 security-boundary: The PR introduces contents-write publication authority whose forbidden-tag and changed-tag rejection has not been demonstrated through the final effect.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦪 silver shellfish.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 12, 2026, 2:28 AM ET / 06:28 UTC.