fix(release): restrict prereleases to -preview.N and release from main only

Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>

Author: OnlineChef

.github/workflows/release.yml

@@ -116,6 +116,14 @@ jobs:
           case "$GITHUB_REF" in
             refs/heads/main)
               if [[ "$RELEASE_VERSION" == *-* ]]; then
+                # The only supported prerelease shape is X.Y.Z-preview.N: the update
+                # client (src/update/notify.ts, bin/ocx.mjs) and the release-notes
+                # helper both key off that exact suffix, so an -alpha/-beta/-rc build
+                # would publish to preview and then never be seen as an update.
+                if [[ ! "$RELEASE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+-preview\.[0-9]+$ ]]; then
+                  echo "::error::Pre-release versions must be X.Y.Z-preview.N (got ${RELEASE_VERSION})"
+                  exit 1
+                fi
                 # Pre-release version — must use "preview" dist-tag
                 if [ "$NPM_DIST_TAG" != "preview" ]; then
                   echo "::error::Pre-release versions (${RELEASE_VERSION}) must use dist-tag 'preview', got '${NPM_DIST_TAG}'"

ROADMAP.md

@@ -12,12 +12,15 @@ no longer dependent on upstream decisions or timelines.
 - [x] **Independent versioning** — fully detached from upstream, own semver scheme
 - [x] **All closed PRs merged** — Dutch GUI, Claude Desktop, combo/alias, cursor fixes, etc.
 - [x] **Enhanced CI** — CodeQL, dependabot, security audit, workflow linting
-- [x] **Release process** — VERSIONING.md, RELEASE_PROCESS.md, CHANGELOG.md
+- [x] **Release process**: main-only publishing via `.github/workflows/release.yml`
+      and `scripts/release.ts`, with review and promotion policy in `MAINTAINERS.md`
 
 ## Near term (next)
 
 - [ ] **First fork release (`2.7.43`)**: publish from `main` on npm dist-tag `latest`
-      (any pre-release suffix ships on `preview` instead)
+      (prereleases use `X.Y.Z-preview.N` and ship on `preview`)
+- [ ] **Release documentation**: add `VERSIONING.md`, `RELEASE_PROCESS.md`, and
+      `CHANGELOG.md` for the fork's release model
 - [ ] **Update READMEs** — ensure all translated READMEs (ko, zh, ru, ja) reflect fork status
 - [ ] **Clean up old tags** — remove stale upstream tags that don't point to our commits
 - [ ] **Dependency audit** — review and update all dependencies (gui + root)

scripts/release.ts

@@ -224,24 +224,25 @@ if (!version || !/^\d+\.\d+\.\d+(-[\w.]+)?$/.test(version)) {
 }
 const dryRun = !args.includes("--publish");
 
-// 1. Preflight — must be on main or preview, and local verification must pass.
+// 1. Preflight — every release runs from main (release.yml rejects any other ref),
+// and local verification must pass. Stable versions publish to the `latest` dist-tag,
+// prereleases to `preview`; the only supported prerelease shape is X.Y.Z-preview.N,
+// which is what the update client and the release-notes helper recognize.
 const branch = (await $`git rev-parse --abbrev-ref HEAD`.text()).trim();
-const allowedBranches = ["main", "preview"];
-const expectedTag = branch === "preview" ? "preview" : "latest";
+const releaseBranch = "main";
+const isPrerelease = version.includes("-");
+const expectedTag = isPrerelease ? "preview" : "latest";
 const tag = args.includes("--tag") ? (args[args.indexOf("--tag") + 1] ?? expectedTag) : expectedTag;
 if (tag !== expectedTag) {
-  console.error(`Release tag mismatch: ${branch} releases must use npm dist-tag '${expectedTag}' (got '${tag}').`);
+  const kind = isPrerelease ? "Pre-release" : "Stable";
+  console.error(`Release tag mismatch: ${kind} versions must use npm dist-tag '${expectedTag}' (got '${tag}').`);
   process.exit(1);
 }
-if (branch === "preview" && !version.includes("-preview.")) {
-  console.error(`Preview releases must use a preview prerelease version (got ${version}).`);
+if (isPrerelease && !/^\d+\.\d+\.\d+-preview\.\d+$/.test(version)) {
+  console.error(`Pre-release versions must be X.Y.Z-preview.N (got ${version}).`);
   process.exit(1);
 }
-if (branch === "main" && version.includes("-")) {
-  console.error(`Main releases must use a stable semver version (got ${version}).`);
-  process.exit(1);
-}
-if (!allowedBranches.includes(branch)) { console.error(`✗ must be on ${allowedBranches.join(" or ")} (currently ${branch}).`); process.exit(1); }
+if (branch !== releaseBranch) { console.error(`✗ must be on ${releaseBranch} (currently ${branch}).`); process.exit(1); }
 if ((await $`git status --porcelain`.text()).trim()) { console.error("✗ working tree not clean — commit or stash first."); process.exit(1); }
 const packageName = await readPackageName();
 console.log(`→ release metadata preflight (${packageName}@${version})`);

tests/ci-workflows.test.ts

@@ -271,6 +271,15 @@ describe("GitHub Actions hardening", () => {
     expect(workflow).toContain("Pre-release versions (${RELEASE_VERSION}) must use dist-tag 'preview'");
     expect(workflow).toContain("Stable releases (${RELEASE_VERSION}) must use dist-tag 'latest'");
     expect(workflow).not.toContain("refs/heads/preview)");
+    // Prereleases are restricted to X.Y.Z-preview.N: the update client only parses
+    // that suffix, so an -alpha/-beta/-rc publish would never notify preview users.
+    expect(workflow).toContain("Pre-release versions must be X.Y.Z-preview.N");
+    expect(workflow).toContain("^[0-9]+\\.[0-9]+\\.[0-9]+-preview\\.[0-9]+$");
+    // The release helper must dispatch from the only ref the workflow accepts.
+    const releaseHelper = await readText("scripts/release.ts");
+    expect(releaseHelper).toContain('const releaseBranch = "main"');
+    expect(releaseHelper).toContain('const expectedTag = isPrerelease ? "preview" : "latest"');
+    expect(releaseHelper).not.toContain('["main", "preview"]');
 
     // Release notes must include PR categories and the full channel commit range
     // (branch merges + direct commits). Preflight forbids an existing release, so