ci: allow product tag v0.1.0 without bumping core package (#44)

The product FlyBot cut tags v0.1.0 while core stays at its own
package version 0.1.5-flybot.1 (CHANGELOG [0.1.0] documents that pin),
so strict tag==core equality would reject the release. The gate now
passes the tag when it is on a product-tag allowlist (currently 0.1.0)
and CHANGELOG's section for it contains the current core version;
normal releases still require equality, and any other mismatch keeps
the existing "core/package.json is X, tag is vY" error. Packing still
uses each package's own package.json version via check-pack.mjs, and
notes still come from CHANGELOG's [VERSION] section.

Co-authored-by: OpenCode <opencode@users.noreply.github.com>
Co-authored-by: hs liu <hsliuustc0106@users.noreply.github.com>

Author: hsliuustc0106

.github/scripts/check-release-version.mjs

@@ -0,0 +1,26 @@
+// Checks that the release tag version is allowed to ship:
+// - core/package.json's version equals the tag (normal releases), or
+// - the tag is an allowlisted product tag and CHANGELOG.md's section for it
+//   documents the current core package version (the product cut pins core).
+// Usage: node .github/scripts/check-release-version.mjs <version>   (run from the repo root)
+import { readFileSync } from 'node:fs'
+
+const PRODUCT_TAGS = ['0.1.0']
+
+const version = process.argv[2]
+if (!version) { console.error('usage: check-release-version.mjs <version>'); process.exit(1) }
+
+const have = JSON.parse(readFileSync('core/package.json', 'utf8')).version
+const fail = () => { console.error(`core/package.json is ${have}, tag is v${version}`); process.exit(1) }
+
+if (have === version) process.exit(0)
+if (!PRODUCT_TAGS.includes(version)) fail()
+
+const lines = readFileSync('CHANGELOG.md', 'utf8').split('\n')
+const start = lines.findIndex((l) => l.startsWith(`## [${version}]`))
+if (start < 0) fail()
+const end = lines.findIndex((l, i) => i > start && l.startsWith('## ['))
+const section = lines.slice(start, end < 0 ? undefined : end).join('\n')
+if (!section.includes(have)) fail()
+
+console.log(`product tag v${version}: CHANGELOG documents core ${have}, core/package.json unchanged`)

.github/workflows/release.yml

@@ -1,8 +1,11 @@
 name: Release
 
-# Pushing a v* tag (matching ds-bot/package.json's version) publishes a GitHub Release with
-# the packed ds-bot, social and tree tarballs and that version's CHANGELOG.md section. It
-# waits for the Test run on the tagged commit to pass first. Only GITHUB_TOKEN is used.
+# Pushing a v* tag publishes a GitHub Release with the packed ds-bot, social and tree
+# tarballs and that version's CHANGELOG.md section. It waits for the Test run on the tagged
+# commit to pass first. Only GITHUB_TOKEN is used.
+# Normally the tag must match core/package.json's version; an allowlisted product tag may
+# differ when CHANGELOG.md documents the current core pin. Packing still uses each package's
+# own package.json version, and the release notes come from CHANGELOG's [VERSION] section.
 
 on:
   push:
@@ -49,12 +52,10 @@ jobs:
           node-version: 24
           # No cache in a job that publishes: nothing restored from a cache goes into a release.
           package-manager-cache: false
-      - name: Tag matches core/package.json
+      - name: Tag matches core/package.json (or is an allowlisted product tag)
         env:
           VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          have=$(node -p "require('./core/package.json').version")
-          [ "$have" = "$VERSION" ] || { echo "core/package.json is $have, tag is v$VERSION" >&2; exit 1; }
+        run: node .github/scripts/check-release-version.mjs "$VERSION"
       - name: Wait for a green Test run on this commit
         run: |
           sha=$(git rev-parse HEAD)