chore: automate sdk release from stable

Author: harbournick

.github/workflows/release-cli.yml

@@ -29,8 +29,8 @@ permissions:
   packages: write
 
 concurrency:
-  group: release-cli-${{ github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.ref_name == 'stable' && 'release-stable-writeback' || format('{0}-{1}', github.workflow, github.ref) }}
+  cancel-in-progress: ${{ github.ref_name != 'stable' }}
 
 jobs:
   release:
@@ -48,6 +48,12 @@ jobs:
           fetch-depth: 0
           token: ${{ steps.generate_token.outputs.token }}
 
+      - name: Refresh stable branch head
+        if: github.ref_name == 'stable'
+        run: |
+          git fetch origin "${{ github.ref_name }}" --tags
+          git checkout -B "${{ github.ref_name }}" "origin/${{ github.ref_name }}"
+
       - uses: pnpm/action-setup@v4
 
       - uses: actions/setup-node@v6

.github/workflows/release-sdk.yml

@@ -1,12 +1,14 @@
-# Auto-releases SDK on push to main (@next channel).
-# Stable releases are local-only (pnpm run release:local).
+# Auto-releases SDK on push to:
+# - main (@next channel)
+# - stable (@latest channel)
 # Also supports manual dispatch as a fallback for one-off releases.
 name: "\U0001F4E6 Release SDK"
 
 on:
   push:
     branches:
       - main
+      - stable
     paths:
       # Keep in sync with packages/sdk/.releaserc.cjs includePaths (patch-commit-filter).
       - 'packages/sdk/**'
@@ -44,8 +46,8 @@ permissions:
   id-token: write # PyPI trusted publishing (OIDC)
 
 concurrency:
-  group: release-sdk-${{ github.ref }}
-  cancel-in-progress: false
+  group: ${{ github.ref_name == 'stable' && 'release-stable-writeback' || format('{0}-{1}', github.workflow, github.ref) }}
+  cancel-in-progress: ${{ github.ref_name != 'stable' }}
 
 jobs:
   # -------------------------------------------------------------------
@@ -71,6 +73,12 @@ jobs:
           fetch-depth: 0
           token: ${{ steps.generate_token.outputs.token }}
 
+      - name: Refresh stable branch head
+        if: github.ref_name == 'stable'
+        run: |
+          git fetch origin "${{ github.ref_name }}" --tags
+          git checkout -B "${{ github.ref_name }}" "origin/${{ github.ref_name }}"
+
       - uses: pnpm/action-setup@v4
 
       - uses: actions/setup-node@v6

.github/workflows/release-superdoc.yml

@@ -24,8 +24,8 @@ permissions:
   packages: write
 
 concurrency:
-  group: release-superdoc-${{ github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.ref_name == 'stable' && 'release-stable-writeback' || format('{0}-{1}', github.workflow, github.ref) }}
+  cancel-in-progress: ${{ github.ref_name != 'stable' }}
 
 jobs:
   release:
@@ -43,6 +43,12 @@ jobs:
           fetch-depth: 0
           token: ${{ steps.generate_token.outputs.token }}
 
+      - name: Refresh stable branch head
+        if: github.ref_name == 'stable'
+        run: |
+          git fetch origin "${{ github.ref_name }}" --tags
+          git checkout -B "${{ github.ref_name }}" "origin/${{ github.ref_name }}"
+
       - uses: pnpm/action-setup@v4
 
       - uses: actions/setup-node@v6

packages/sdk/.releaserc.cjs

@@ -20,6 +20,7 @@ require('../../scripts/semantic-release/patch-commit-filter.cjs')([
 ]);
 
 const branch = process.env.GITHUB_REF_NAME || process.env.CI_COMMIT_BRANCH;
+const isCiRelease = Boolean(process.env.CI);
 
 const branches = [
   { name: 'stable', channel: 'latest' },
@@ -62,12 +63,12 @@ const config = {
   ],
 };
 
-// On prerelease (main), PyPI is handled by GHA OIDC — keep --npm-only.
-// On stable (local release), sdk-release-publish.mjs uploads to PyPI via twine.
+// In CI (main/stable), PyPI is handled by the workflow via OIDC — keep --npm-only.
+// For local stable releases, sdk-release-publish.mjs uploads to PyPI via twine.
 const execPlugin = config.plugins.find(
   (p) => Array.isArray(p) && p[0] === '@semantic-release/exec',
 );
-if (isPrerelease) {
+if (isCiRelease || isPrerelease) {
   execPlugin[1].publishCmd =
     'node scripts/sdk-release-publish.mjs --tag ${nextRelease.channel || "latest"} --npm-only';
 } else {

packages/sdk/scripts/__tests__/release-order.test.mjs

@@ -94,6 +94,18 @@ test('release-sdk auto workflow resumes releases from sdk-v tags at HEAD', async
   );
 });
 
+test('release-sdk auto workflow runs on stable and main', async () => {
+  const content = await readRepoFile('.github/workflows/release-sdk.yml');
+  assert.ok(
+    content.includes('      - main'),
+    '.github/workflows/release-sdk.yml: auto-release must continue to run on main',
+  );
+  assert.ok(
+    content.includes('      - stable'),
+    '.github/workflows/release-sdk.yml: auto-release must run on stable',
+  );
+});
+
 test('sdk semantic-release prepareCmd builds Node SDK before validate', async () => {
   const content = await readRepoFile('packages/sdk/.releaserc.cjs');
   assertOrder(
@@ -120,6 +132,14 @@ test('sdk semantic-release matches CLI channel model (next/next on main, latest
     content.includes("{ name: 'main', prerelease: 'next', channel: 'next' }"),
     "packages/sdk/.releaserc.cjs: main branch must release next versions on next channel",
   );
+  assert.ok(
+    content.includes('const isCiRelease = Boolean(process.env.CI);'),
+    'packages/sdk/.releaserc.cjs: CI releases must be detected explicitly',
+  );
+  assert.ok(
+    content.includes('if (isCiRelease || isPrerelease) {'),
+    'packages/sdk/.releaserc.cjs: CI releases must keep Python publishing in the workflow',
+  );
 });
 
 test('sdk-release-publish validates local PyPI prerequisites before Node publish', async () => {