* fix(release): sync web changelog entries from release please
* fix(release): provide sync push credentials
* fix(release): gate and finalize web release sync
* fix(release): make web release sync recoverable
* fix(release): target release PR commands explicitly
* fix(release): honor manifest release configuration
* fix(release): recover failed web sync retries
* ci(release): run full sync preflight
* fix(release): validate synchronized PR head
* fix(release): validate bot sync in release job
* fix(release): harden bot-owned web sync
* fix(release): validate exact bot PR head
* fix(release): isolate and bind PR synchronization
* fix(release): isolate validation from write credentials
* fix(release): reject non-regular generated inputs
* fix(release): require a valid forward version bump
* fix(release): scope sync artifacts to run attempts
* fix(release): reuse validated artifacts across retries
* fix(release): resume readiness after a completed push
* fix(release): bind retries to the validated commit
* fix(release): address synchronization review findings
* fix(release): support CRLF changelog recovery
* fix(release): keep validation transitions fail-closed
* fix(release): restore scoped web sync and marker ownership
Cut the multi-job finalize state machine back to a single draft-until-push
sync path, and fix consecutive releases leaving stacked automation markers
by stripping leftover draft ownership when inserting the next version.
* fix(release): keep web sync from blocking npm publish
Move pending Release Please web sync into its own job so a sync failure cannot skip install-verify, npm, or docker after a release tag is already created.
* fix(release): close web-sync trust and policy gaps
Remove hand-curation escape hatches, split read-only validation from
write-only push, discover bot PRs by branch identity, and run the full
local gate suite before marking the release PR ready.
* fix(release): validate gates against synchronized commit
Commit the synced releases.ts in the read-only validate job before
typecheck, security scan, and whitespace checks so those gates inspect
the content that will be marked ready, not the pre-sync HEAD.
* fix(release): harden web-sync trust boundary and draft gating
Run sync from trusted main with only changelog/manifest overlaid from
the bot PR, re-draft after release-please, serialize sync without
canceling in-flight pushes, and require an explicit sync base.
* fix(release): restore overlaid inputs before validate cleanliness gate
Fetching changelog/manifest from the bot PR dirtied tracked files on the
trusted main checkout and made the final git-diff gate fail on every
pending release. Restore those overlays after sync and fetch origin/main
for the security/whitespace checks.
* fix(release): reuse validated sync artifacts on retry
* fix(release): validate release sync inputs and retries
* fix(release): recover web sync state transitions
* fix(release): protect generated release ownership
* fix(release): repair web sync recovery gates
* fix(release): bind sync artifacts to validated base
* fix(release): verify synchronized file mode
* fix(release): paginate bot PR discovery
JATMNandGitHub
Kevin CodexandGitHub