chore: ci fixes

Author: harbournick

.github/workflows/promote-stable.yml

@@ -68,19 +68,60 @@ jobs:
           if git merge --no-ff --no-edit "origin/${SOURCE_BRANCH}"; then
             MERGE_STATUS="clean"
           else
-            # Auto-resolve release artifact conflicts: keep stable's version.
+            normalize_json_without_keys() {
+              python3 -c 'import json, sys; data = json.load(sys.stdin); [data.pop(key, None) for key in sys.argv[1:]]; sys.stdout.write(json.dumps(data, sort_keys=True, separators=(",", ":")))' "$@"
+            }
+
+            release_artifact_only_conflict() {
+              local f="$1"
+              local tmpdir
+              local status
+              tmpdir="$(mktemp -d)"
+
+              case "$f" in
+                package.json|*/package.json)
+                  git show ":2:${f}" | normalize_json_without_keys version > "${tmpdir}/ours" || { rm -rf "${tmpdir}"; return 1; }
+                  git show ":3:${f}" | normalize_json_without_keys version > "${tmpdir}/theirs" || { rm -rf "${tmpdir}"; return 1; }
+                  ;;
+                pyproject.toml|*/pyproject.toml)
+                  git show ":2:${f}" | sed -E '/^[[:space:]]*version[[:space:]]*=/d' > "${tmpdir}/ours" || { rm -rf "${tmpdir}"; return 1; }
+                  git show ":3:${f}" | sed -E '/^[[:space:]]*version[[:space:]]*=/d' > "${tmpdir}/theirs" || { rm -rf "${tmpdir}"; return 1; }
+                  ;;
+                version.json|*/version.json)
+                  git show ":2:${f}" | normalize_json_without_keys version sdkVersion > "${tmpdir}/ours" || { rm -rf "${tmpdir}"; return 1; }
+                  git show ":3:${f}" | normalize_json_without_keys version sdkVersion > "${tmpdir}/theirs" || { rm -rf "${tmpdir}"; return 1; }
+                  ;;
+                *)
+                  rm -rf "${tmpdir}"
+                  return 1
+                  ;;
+              esac
+
+              cmp -s "${tmpdir}/ours" "${tmpdir}/theirs"
+              status=$?
+              rm -rf "${tmpdir}"
+              return "${status}"
+            }
+
+            # Auto-resolve release artifact conflicts only when the conflict is
+            # version-only: keep stable's version, but never drop dependency,
+            # script, export, or package metadata changes from main.
             # npm/PyPI already have stable's published version; downgrading to
             # main's track would break the next stable release. Mirrors the
             # auto-resolve in sync-patches.yml, biased the other direction.
-            git diff --name-only --diff-filter=U | while read -r f; do
+            while read -r f; do
               case "$f" in
                 package.json|*/package.json|pyproject.toml|*/pyproject.toml|version.json|*/version.json)
-                  echo "  Auto-resolving $f (keeping stable's version)"
-                  git checkout --ours "$f"
-                  git add "$f"
+                  if release_artifact_only_conflict "$f"; then
+                    echo "  Auto-resolving $f (version-only; keeping stable's version)"
+                    git checkout --ours "$f"
+                    git add "$f"
+                  else
+                    echo "  Leaving $f unresolved (contains non-version changes)"
+                  fi
                   ;;
               esac
-            done
+            done < <(git diff --name-only --diff-filter=U)
 
             if [ -z "$(git diff --name-only --diff-filter=U)" ]; then
               MERGE_STATUS="auto_resolved"
@@ -138,7 +179,7 @@ jobs:
 
           - creates \`${BRANCH_NAME}\` from \`${BASE_BRANCH}\`
           - merges \`${SOURCE_BRANCH}\` into the candidate branch
-          - release artifact conflicts (package.json, pyproject.toml, version.json) auto-resolved to keep stable's published version
+          - version-only release artifact conflicts (package.json, pyproject.toml, version.json) auto-resolved to keep stable's published version
 
           ---
           _Auto-created by promote-stable workflow._

.github/workflows/release-react.yml

@@ -36,6 +36,8 @@ concurrency:
 
 jobs:
   release:
+    # Stable publishes must go through release-stable.yml.
+    if: ${{ github.event_name != 'workflow_dispatch' || github.ref_name != 'stable' }}
     runs-on: ubuntu-24.04
     steps:
       - name: Generate token

.github/workflows/release-superdoc.yml

@@ -40,6 +40,8 @@ concurrency:
 
 jobs:
   release:
+    # Stable publishes must go through release-stable.yml; PR previews are still allowed.
+    if: ${{ github.event_name != 'workflow_dispatch' || github.ref_name != 'stable' || inputs.pr_number }}
     runs-on: ubuntu-24.04
     steps:
       - name: Generate token

.github/workflows/release-vscode-ext.yml

@@ -34,6 +34,8 @@ concurrency:
 
 jobs:
   release:
+    # Stable publishes must go through release-stable.yml.
+    if: ${{ github.event_name != 'workflow_dispatch' || github.ref_name != 'stable' }}
     runs-on: ubuntu-latest
     steps:
       - name: Generate token