chore(release): harden packaging workflows

Author: pallyoung

.github/workflows/changesets.yml

@@ -5,6 +5,14 @@ on:
     branches:
       - main
 
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: changesets-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   version:
     runs-on: ubuntu-latest

.github/workflows/ci.yml

@@ -6,10 +6,31 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
+  version-consistency:
+    name: Version Consistency
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm version:check
+
   cli-cross-platform:
     name: CLI Unit (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
+    needs: version-consistency
     strategy:
       fail-fast: false
       matrix:
@@ -30,6 +51,7 @@ jobs:
   verify-linux:
     name: Verify Linux Runtime
     runs-on: ubuntu-latest
+    needs: version-consistency
     steps:
       - uses: actions/checkout@v4
       - name: Install Linux runtime dependencies
@@ -48,18 +70,26 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: src-tauri -> target
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
           node-version: 22
           cache: pnpm
       - run: pnpm install --frozen-lockfile
+      - run: pnpm test:cli
       - run: cargo fmt --manifest-path src-tauri/Cargo.toml --all --check
       - run: cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings
       - run: cargo check --manifest-path src-tauri/Cargo.toml
-      - run: pnpm build:web
-      - run: pnpm build:runtime
-      - run: pnpm build:packages
+      - run: cargo test --manifest-path src-tauri/Cargo.toml
+      - run: pnpm pack:local
       - run: pnpm test:smoke
       - run: npx playwright install --with-deps chromium
       - run: pnpm test:e2e:release
+      - uses: actions/upload-artifact@v4
+        if: success()
+        with:
+          name: release-artifacts-linux
+          path: .artifacts/*

.github/workflows/release.yml

@@ -7,10 +7,35 @@ on:
 
 permissions:
   contents: write
+  id-token: write
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
+  preflight:
+    name: Release Preflight
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - name: Verify tag matches package version
+        run: |
+          VERSION=$(node -e "console.log(require('./packages/coder-studio/package.json').version)")
+          test "v$VERSION" = "$GITHUB_REF_NAME"
+      - run: pnpm version:check
+
   publish-platform:
     name: Publish ${{ matrix.package_slug }}
+    needs: preflight
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -41,21 +66,18 @@ jobs:
             patchelf \
             wget
       - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: src-tauri -> target
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
           node-version: 22
           cache: pnpm
           registry-url: 'https://registry.npmjs.org'
-      - name: Verify tag matches package version
-        shell: bash
-        run: |
-          VERSION=$(node -e "console.log(require('./packages/coder-studio/package.json').version)")
-          test "v$VERSION" = "$GITHUB_REF_NAME"
       - run: pnpm install --frozen-lockfile
-      - run: pnpm build:web
-      - run: pnpm build:runtime
-      - run: pnpm build:packages
+      - run: pnpm release:check
+      - run: node -e "require('fs').mkdirSync('.artifacts', { recursive: true })"
       - run: pnpm --dir packages/${{ matrix.package_slug }} pack --pack-destination ../../.artifacts
       - run: npm publish packages/${{ matrix.package_slug }} --access public
         env:
@@ -67,7 +89,9 @@ jobs:
 
   publish-main:
     name: Publish @spencer-kit/coder-studio
-    needs: publish-platform
+    needs:
+      - preflight
+      - publish-platform
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -77,14 +101,17 @@ jobs:
           node-version: 22
           cache: pnpm
           registry-url: 'https://registry.npmjs.org'
-      - name: Verify tag matches package version
-        run: |
-          VERSION=$(node -e "console.log(require('./packages/coder-studio/package.json').version)")
-          test "v$VERSION" = "$GITHUB_REF_NAME"
       - run: pnpm install --frozen-lockfile
+      - run: pnpm version:check
+      - run: node -e "require('fs').mkdirSync('.artifacts', { recursive: true })"
+      - run: pnpm --dir packages/coder-studio pack --pack-destination ../../.artifacts
       - run: npm publish packages/coder-studio --access public
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - uses: actions/upload-artifact@v4
+        with:
+          name: coder-studio-main
+          path: .artifacts/*.tgz
 
   github-release:
     name: Create GitHub Release
@@ -93,9 +120,19 @@ jobs:
       - publish-main
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
       - uses: actions/download-artifact@v4
         with:
           path: .release-artifacts
+          merge-multiple: true
+      - run: node scripts/release/write-release-manifest.mjs .release-artifacts
       - uses: softprops/action-gh-release@v2
         with:
-          files: .release-artifacts/**/*.tgz
+          files: |
+            .release-artifacts/*.tgz
+            .release-artifacts/release-manifest.json
+            .release-artifacts/SHA256SUMS.txt

docs/development/npm-release.en.md

@@ -60,18 +60,24 @@ Use `CODER_STUDIO_HOME` to override the state directory for tests or isolated en
 ## Build Commands
 
 ```bash
+pnpm version:check
 pnpm build:web
 pnpm build:runtime
 pnpm build:packages
 pnpm pack:local
+pnpm release:verify
+pnpm release:verify:full
 ```
 
 What they do:
 
+- `version:check`: verifies the root package, main package, platform packages, `Cargo.toml`, and `tauri.conf.json` all share the same version
 - `build:web`: builds the frontend into `dist/`
 - `build:runtime`: builds the Rust/Tauri release binary
 - `build:packages`: assembles the current platform runtime package
-- `pack:local`: emits local tarballs into `.artifacts/`
+- `pack:local`: runs the release build and emits local tarballs into `.artifacts/`
+- `release:verify`: runs version checks, CLI tests, Rust tests, local packaging, and smoke validation
+- `release:verify:full`: adds release E2E on top of `release:verify`
 
 ## Versioning
 
@@ -84,20 +90,97 @@ pnpm changeset
 pnpm changeset:version
 ```
 
+A recommended local flow:
+
+```bash
+pnpm changeset
+pnpm changeset:version
+git add .
+git commit -m "chore(release): version packages"
+```
+
 The version sync step updates:
 
 - `packages/*/package.json`
 - `src-tauri/Cargo.toml`
 - `src-tauri/tauri.conf.json`
 - the root `package.json`
 
+`changeset:version` now runs `pnpm version:check` after syncing so version drift fails immediately.
+
+## Local Pre-Release Validation
+
+Minimum validation:
+
+```bash
+pnpm release:verify
+```
+
+Full validation:
+
+```bash
+pnpm release:verify:full
+```
+
+Local artifacts:
+
+```bash
+pnpm pack:local
+ls .artifacts
+```
+
+`.artifacts/` now includes:
+
+- the main package tarball
+- the current platform tarball
+- `release-manifest.json`
+- `SHA256SUMS.txt`
+
 ## GitHub Actions
 
 The automation is split into three workflows:
 
-- `ci.yml`: PR/main validation for CLI tests, Rust verification, builds, smoke tests, and release E2E
-- `changesets.yml`: creates version PRs from pending changesets on `main`
-- `release.yml`: publishes platform packages, publishes the main package, and creates a GitHub Release from `v*` tags
+- `ci.yml`
+  - adds a `version-consistency` gate
+  - runs cross-platform CLI unit tests
+  - runs Rust fmt/clippy/check/test on Linux
+  - runs `pnpm pack:local`
+  - runs smoke and release E2E
+  - uploads Linux release artifacts
+- `changesets.yml`
+  - runs only on `main`
+  - creates or updates the version PR
+  - now has explicit `contents` / `pull-requests` write permissions
+- `release.yml`
+  - starts with a `preflight` job that validates the tag and runs `pnpm version:check`
+  - publishes the 4 platform runtime packages
+  - publishes the main `@spencer-kit/coder-studio` package
+  - aggregates tarballs and attaches `release-manifest.json` plus `SHA256SUMS.txt` to the GitHub Release
+
+## Release Trigger
+
+After the version PR is merged, push a tag that matches the package version:
+
+```bash
+git tag v0.1.0
+git push origin v0.1.0
+```
+
+The workflow then:
+
+1. checks that the tag matches `packages/coder-studio/package.json`
+2. publishes platform packages
+3. publishes the main package
+4. creates the GitHub Release assets
+
+## GitHub / npm Requirements
+
+The current release workflow expects:
+
+- the default GitHub `GITHUB_TOKEN`
+- a repository secret named `NPM_TOKEN`
+
+`NPM_TOKEN` must be allowed to publish the `@spencer-kit/*` packages on npm.
 
 ## Local Test Matrix
 
@@ -111,6 +194,7 @@ pnpm test:e2e:release
 Coverage:
 
 - `test:cli`: configuration, platform resolution, and state handling
+- `test:cli` now also covers release version consistency and release manifest generation
 - `test:smoke`: installs local tarballs and runs `start/status/restart/stop`
 - `test:e2e`: development-mode frontend/backend integration
 - `test:e2e:release`: browser E2E against the built release runtime