Restore automatic releases on main push with version allocation

[loadchange]

Summary

Restores the ability to automatically publish releases on every push to main by implementing a version allocation system. Previously, releases only triggered on manual tag creation, causing old versions to miss updates. This change reintroduces automatic tagging while maintaining idempotency and supporting both direct tagging and snapshot-based releases.

Key Changes

• New script prepare-main-release.mjs: Implements the core release allocation logic

  • Allocates an annotated version tag for each main push
  • If root package version exceeds all existing tags, tags the main commit directly
  • Otherwise creates a version-only snapshot commit (parent is main, only changes version fields)
  • Reuses tags on reruns of the same main commit for idempotency
  • Validates release sources and enforces version consistency across package files

• Updated release.yml workflow:

  • Now triggers on both push.branches.main and tag pushes
  • verify job runs serialized (via concurrency group) to allocate versions atomically
  • Skips rebuild if a release is already public (via should_release output)
  • Uses new prepare-main-release.mjs --verify for release source validation
  • Pushes only the immutable annotated tag; main branch never moves

• New test suite prepare-main-release.test.mjs: Comprehensive tests covering

  • Version selection logic (keeping newer package versions, bumping patch on rereleases)
  • Version field bumping in package files
  • Main push with unreleased versions (direct tagging)
  • Main push with released versions (snapshot creation)
  • Snapshot validation and tampering detection
  • Tag annotation and version mismatch detection

• Updated documentation macos-release-workflow.md:

  • Clarifies that every main push publishes a release
  • Explains version allocation strategy (direct tag vs. snapshot)
  • Documents rerun idempotency and public release skipping
  • Updates workflow diagram to show main push → tag allocation → build sequence

Implementation Details

• Version allocation: Uses Release-Source-SHA trailer in commit messages to track the original main commit for snapshot releases
• Idempotency: Reruns detect existing tags by checking if a snapshot's parent matches the current main commit
• Validation: resolveReleaseSource() ensures release commits are either on main or valid snapshots with only version field changes
• Git isolation: Tests use isolated git config to avoid developer-specific settings (signing, hooks)
• Concurrency safety: Serialized verify job ensures only one version allocation per main push

https://claude.ai/code/session_01JysUCujZTRQGmKbMN6DW2s