ci(release): unstick 17.0.0-rc.2 and stop an empty changeset from eating a release (#4898) (#4899)

17.0.0-rc.2 is versioned in main (3cfd9f0) and absent from npm. The Release run
that should have published it reported success:

  Create Release Pull Request or Publish to npm ... 0s
  All changesets are empty; not creating PR

changesets/action reaches its publish branch only when there are ZERO pending
changesets. An EMPTY changeset still counts as pending, so a main carrying only
empty ones takes neither path — no version PR, no publish, published=false, and
a green run. `docker` skipped with it, so no runtime image shipped either.

Two pending changesets were on main, both empty-frontmatter: #4893's and
#4896's. Either one alone is enough. This is not an exotic state — `Check
Changeset` sanctions the empty changeset as the "this PR releases nothing"
declaration, so any docs/ci PR landing during the version-PR window produces it.

Unstick: delete both. An empty-frontmatter changeset declares no releases, so it
contributes no entry to any package's CHANGELOG — deleting it discards nothing.
Its only job was to satisfy `Check Changeset` for PRs that merged hours ago.
With the pending set empty, the next push to main takes the action's normal
publish path, which ships the GitHub Releases and the ADR-0087 D4 spec-changes
attachment along with npm and Docker.

This PR therefore adds no changeset of its own — it carries the `skip-changeset`
label instead. Adding an empty one would re-create the exact condition being
removed and force the release down the degraded fallback path below.

Prevent the silent recurrence: a recovery step after the changesets action,
gated on the only fact that matters — the version in the repo is not on the
registry. `changeset publish` skips versions already published, so it is a
no-op on the normal path (main's version IS the last released one) and a repair
on this one. It never succeeds silently: if the version is still missing after
publishing, the job fails. The job's `published` / `cli-version` outputs now
accept either publish path, so a rescued release still ships its Docker image
instead of losing it to the same hole.

The fallback cannot create GitHub Releases or the spec-changes attachment —
those live inside the action's own publish path — so it says so in a warning
rather than leaving the gap to be discovered later.

Verified: YAML parses, both job outputs resolve on each path, the step's shell
passes `bash -n`, and all three branches were exercised against stubbed
npm/pnpm/git — already-published (no-op, exit 0), missing (publishes, sets
published/version), and missing-after-publish (::error::, exit 1).


Claude-Session: https://claude.ai/code/session_01BbNVKv6KgPzuQ5p76nMgnf

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang

.changeset/pm-skill-landing-and-ci-discipline.md

@@ -15,8 +15,11 @@ jobs:
       contents: write
       pull-requests: write
     outputs:
-      published: ${{ steps.changesets.outputs.published }}
-      cli-version: ${{ steps.cli-version.outputs.version }}
+      # Either publish path counts (see the recovery step below) — the Docker
+      # image must ship for a release the fallback rescued just as much as for
+      # one the Changesets action published itself.
+      published: ${{ steps.changesets.outputs.published == 'true' || steps.recover-publish.outputs.published == 'true' }}
+      cli-version: ${{ steps.cli-version.outputs.version || steps.recover-publish.outputs.version }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
@@ -159,6 +162,52 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 
+      - name: Publish a release the Changesets action left behind
+        id: recover-publish
+        if: steps.changesets.outputs.published != 'true'
+        # changesets/action reaches its publish branch ONLY when there are zero
+        # pending changesets. An EMPTY changeset still counts as pending, so a
+        # `main` carrying only empty ones lands in
+        #     All changesets are empty; not creating PR
+        # and returns: no version PR, no publish, `published=false`, and a GREEN
+        # run. The version bump is already committed by then, so the release
+        # simply evaporates — 17.0.0-rc.2 sat versioned-in-repo and absent from
+        # npm with Release reporting success, and `docker` skipped with it
+        # (#4898). This is not an exotic state: `Check Changeset` sanctions the
+        # empty changeset as the "this PR releases nothing" declaration, so any
+        # ordinary docs/ci PR landing during the version-PR window produces it.
+        #
+        # Detect it by the only fact that matters — the version in the repo is
+        # not on the registry — and repair it. `changeset publish` skips every
+        # version already published, so this is a no-op on the normal path
+        # (where main's version IS the last released one) and a repair on this
+        # one. Never a silent success: if the version is still missing after
+        # publishing, the job fails.
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          version=$(node -p "require('./packages/cli/package.json').version")
+          if npm view "@objectstack/cli@$version" version >/dev/null 2>&1; then
+            echo "@objectstack/cli@$version is already on npm — nothing left to publish."
+            exit 0
+          fi
+
+          echo "::warning::@objectstack/cli@$version is versioned in main but absent from npm and the Changesets action did not publish it (#4898) — publishing it now."
+          printf '//registry.npmjs.org/:_authToken=%s\n' "$NPM_TOKEN" >> "$HOME/.npmrc"
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          pnpm run release
+
+          if ! npm view "@objectstack/cli@$version" version >/dev/null 2>&1; then
+            echo "::error::publish ran but @objectstack/cli@$version is still not on npm"
+            exit 1
+          fi
+          {
+            echo "published=true"
+            echo "version=$version"
+          } >> "$GITHUB_OUTPUT"
+          echo "::warning::Recovered by the fallback path — npm packages and git tags are published, but the GitHub Releases and the ADR-0087 D4 spec-changes attachment were NOT created (those only exist on the Changesets action's own publish path). Create them by hand if this release needs them."
+
       - name: Attach spec-changes.json to the GitHub Release (ADR-0087 D4)
         # Rebuilds the change manifest with the api-surface diff against the
         # previously PUBLISHED spec (reusing the ADR-0059 §3 gate artifact) and