fix(release): finalize v4.1.0 through protected main

[kjgbot]

What changed

• records the verified 4.1.0 version, changelog, and refreshed lockfile generated by publish run 35523276633
• pushes immutable release tags separately from the generated release commit
• sends future generated release metadata through a release PR instead of writing directly to protected main
• keeps release-PR creation non-blocking after registry publication

Why

The 4.1.0 recovery successfully verified all npm artifacts, waited for registry propagation, refreshed the lockfile, and passed pnpm install --frozen-lockfile. Its last step still failed because git push origin HEAD --follow-tags attempted a direct update to protected main. The tags were pushed, but the release job was marked failed.

Validation

• workflow YAML parses
• actionlint passes (existing SC2086 baseline ignored)
• git diff --check passes
• publish run 35523276633 passed package comparison, registry propagation, refreshed lockfile, and frozen-lockfile verification before the protected-branch rejection

---

Note

High Risk
Changes the publish pipeline’s git finalization path and ships full 4.1.0 version metadata; mistakes could block merges to main or confuse release recovery, though tag immutability checks reduce retag risk.

Overview
Fixes publish failures when main is branch-protected by no longer pushing the version/changelog/lockfile commit directly. The workflow now finalizes immutable release tags and a release/v<version> branch in one atomic push, then opens (or reuses) a PR into main for release metadata. Recovery runs reuse existing tags/branches only when the release tree matches, and PR creation is continue-on-error so a failed PR does not undo a successful registry publish.

This PR also records the verified 4.1.0 release: lockstep bumps across Rust/npm packages, promoted changelog entries, and pnpm-lock.yaml pins for published optional platform deps. Workflow pull-requests: write was added for gh pr create.

^{Reviewed by Cursor Bugbot for commit dd48b09. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: a5b2930f-3c4d-4e95-afd3-3b78edda44cb

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit dd48b09. Configure here.}

[cursor]

Recovery tree check blocks tag reuse

Medium Severity

Finalize release refs reuses existing tags and release/v* only when the entire HEAD tree matches. Recovery already allows publish.yml to change so a workflow repair can resume, and that delta makes the trees differ, so already-pushed immutable tags are treated as conflicts. The job then fails after registry publish and never opens the metadata PR from the tagged release commit.

Additional Locations (1)

• .github/workflows/publish.yml#L1494-L1497

 

^{Reviewed by Cursor Bugbot for commit dd48b09. Configure here.}