Author	SHA1	Message	Date
Meta Vens	7a36848b98	Release guard: the checks run in a clean env, and every per-tag check runs in the guard ... release-after-suite.mjs now takes the run's git ref and, from one process, checks the tag against the declared prefix and manifest version, runs the release-checks suite, the semver policy check and the package's own tests, then releases. The checks run without NODE_OPTIONS, NODE_TEST_*, or NODE_AUTH_TOKEN; only the release action gets the token. The workflow's separate tag, semver and test steps are gone, and so is the pin's continue-on-error/shell/defaults ban, which no release check needs any more. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 14:05:28 +02:00
Meta Vens	bc4af4fa58	Release gate: publish-packages.yml releases through one entrypoint that runs the suite first; the if: pin is gone ... scripts/release-after-suite.mjs runs the release-checks suite and then the release action (npm publish, or the Python sdist and wheel build that the PyPI step uploads) from one process, and releases only if the suite passed. No step condition can release what the suite did not pass, so the pin that read if: conditions (status functions, multi-line if:, the leading-conjunct rule) is deleted with its tests and docs. What remains compares each job's release steps with their expected text exactly, less their if: line, and refuses continue-on-error, shell and defaults in the workflow. Ruling asura:ruling:suite-gate-structural-not-parsed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 13:43:47 +02:00