fix(ci): merge prerelease.yml into publish-release.yml (single OIDC entry point) (CopilotKit#5071)

## Why

npm OIDC trusted publishers match on the **caller's** `workflow_ref`
claim, not the callee's `job_workflow_ref`. The PR-A / PR-B
reusable-workflow architecture was structurally incompatible with that
matching rule: any prerelease publish dispatched via a separate
`prerelease.yml` caller would present a `workflow_ref` that npm's
trusted-publisher records (registered against `publish-release.yml`)
would reject.

The canonical fix used by Storybook, Nx, and Vite is a single-workflow
pattern: one entry-point workflow that branches internally on a `mode`
input. That's what this PR implements.

## What

- **Deletes** `.github/workflows/prerelease.yml`.
- **Refactors** `.github/workflows/publish-release.yml` to handle both
`stable` and `prerelease` modes via `workflow_dispatch` inputs (`mode`,
`suffix`, `dry-run`).
- Adds a `Bump prerelease versions` step in the build job (gated on
`mode == 'prerelease'`) that validates the user-supplied suffix against
`[a-zA-Z0-9._-]+` and falls back to the script's timestamp default when
the suffix input is empty.
- Mode-aware publish script selection (`prerelease.ts` vs
`publish-release.ts`) via env var on the publish step.
- Mode-aware gating on tag creation, GitHub Release creation, Notion
notification, and the release-summary step — all skipped for
prereleases.
- Adds a `Verify publish step emitted version` step that aborts if the
publish script didn't emit a `version` output (would otherwise produce
blank-version summaries and malformed tags/releases).

## Evidence

A dry-run dispatched against this workflow file completed all build +
publish stages successfully (publish step skipped via `dry-run=true`,
summary rendered correctly). The verification canary run `26544606752`
failed against pre-PR-C `main`, confirming that the PR-A/PR-B
architecture cannot pass OIDC and that PR-C is required.

## Code Review

- **Round 1:** 7-agent CR returned 5 consensus Bucket B findings (suffix
validation, version-emission verification, mode-aware tag/release gating
wording, comment cleanups). All applied.
- **Round 2:** 7-agent CR confirmation returned **zero Bucket A
findings**. Two trivial additive nits applied in the final commit: `set
-euo pipefail` on the new verification step for consistency with every
other shell step in the file, and a leading comment on the `Bump
prerelease versions` step explaining the validation logic.

Author: jpr5

.github/workflows/prerelease.yml

@@ -1,55 +1,53 @@
+# release / publish
+#
+# Single npm OIDC entry point for both stable releases and prerelease canaries.
+# npm trusted publisher records for the 15 @copilotkit/* monorepo packages plus
+# @copilotkitnext/angular are registered against THIS workflow file. Matching
+# happens on the OIDC token's `workflow_ref` claim, which is always
+# publish-release.yml when this workflow is the entry point.
+#
+# Triggers:
+#   - pull_request: closed on a release/publish/<scope>/v<X.Y.Z> branch → stable
+#     release of <scope> at version <X.Y.Z> (the normal flow).
+#   - workflow_dispatch with mode=stable → manual retrigger of a failed stable
+#     release. Republishes from the latest commit on main. Only use this when
+#     the normal flow failed BEFORE npm publish succeeded.
+#   - workflow_dispatch with mode=prerelease → canary publish. Bumps versions
+#     in the build job to <X.Y.Z>-canary.<suffix>, publishes with --tag canary,
+#     skips tag push + GH Release + Notion notification.
 name: release / publish
 
 on:
   pull_request:
     types: [closed]
     branches: [main]
-  # Escape hatch for failed releases. Covers failures BEFORE the "Publish to
-  # npm" step succeeds (build errors, infra blips, git config bugs). Does
-  # NOT cover post-npm-publish failures: if npm publish already succeeded
-  # but a later step failed, the retry will fail at "Publish to npm" with
-  # an "already published" error, and the "Check for pre-existing tags"
-  # step will also block retries where the tag was pushed. For those cases,
-  # remediate by hand using release-notes.md from the merged release PR.
   workflow_dispatch:
     inputs:
       scope:
-        description: |
-          ⚠️ MANUAL RETRIGGER — republishes from the latest commit on main,
-          bypassing the normal release-PR flow. Only use this when the
-          normal flow failed BEFORE npm publish succeeded. If npm publish
-          already happened, finish the release by hand instead — dispatching
-          here will fail at "Publish to npm" with "already published".
+        description: "What to release"
         required: true
         type: choice
         options:
           - monorepo
           - angular
-      dry-run:
-        description: "Dry run (skip publish step)"
-        required: false
-        default: false
-        type: boolean
-  workflow_call:
-    inputs:
-      scope:
-        required: true
-        type: string
       mode:
+        description: "Release mode: stable (full release with tag + GH Release) or prerelease (canary, no tag/release)"
         required: false
-        type: string
         default: stable
-      dry-run:
-        required: false
-        type: boolean
-        default: false
-      publish-script:
+        type: choice
+        options:
+          - stable
+          - prerelease
+      suffix:
+        description: "Canary suffix (only used when mode=prerelease). Falls back to timestamp if empty. Allowed: [a-zA-Z0-9._-]+"
         required: false
         type: string
-        default: publish-release.ts
-    secrets:
-      NOTION_API_KEY:
+        default: ""
+      dry-run:
+        description: "Dry run (skip publish step)"
         required: false
+        default: false
+        type: boolean
 
 permissions:
   contents: read
@@ -63,34 +61,36 @@ env:
 
 jobs:
   build:
-    # Run on a merged release PR (normal flow) or a manual workflow_dispatch (escape hatch).
-    # Skipped on workflow_call: the caller's build job uploads the "workspace" artifact, so
-    # the callee's publish job downloads it directly without re-building.
+    # Run on a merged release PR (normal flow) or a manual workflow_dispatch
+    # from main (escape hatch). The main-branch guard on workflow_dispatch
+    # prevents republishing from arbitrary branches.
     if: >
-      github.event_name != 'workflow_call' && (
-        github.event_name == 'workflow_dispatch' ||
-        (github.event.pull_request.merged == true &&
-          startsWith(github.event.pull_request.head.ref, 'release/publish/'))
-      )
+      (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') ||
+      (github.event.pull_request.merged == true &&
+        startsWith(github.event.pull_request.head.ref, 'release/publish/'))
     runs-on: ubuntu-latest
     timeout-minutes: 20
     permissions:
       contents: read
     steps:
-      - name: Determine scope
+      - name: Determine scope and mode
         id: meta
         env:
           PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
           INPUT_SCOPE: ${{ inputs.scope }}
+          INPUT_MODE: ${{ inputs.mode }}
         run: |
+          set -euo pipefail
           if [ -n "$INPUT_SCOPE" ]; then
             SCOPE="$INPUT_SCOPE"
           else
             # Branch format: release/publish/<scope>/v<version>
             SCOPE=$(echo "$PR_HEAD_REF" | sed 's|release/publish/\([^/]*\)/v.*|\1|')
           fi
-          echo "scope=$SCOPE" >> $GITHUB_OUTPUT
-          echo "Detected scope: $SCOPE"
+          MODE="${INPUT_MODE:-stable}"
+          echo "scope=$SCOPE" >> "$GITHUB_OUTPUT"
+          echo "mode=$MODE"   >> "$GITHUB_OUTPUT"
+          echo "Detected scope: $SCOPE, mode: $MODE"
 
       # No token/credential persistence: the publish job sets up its own
       # `git config insteadOf` with secrets.GITHUB_TOKEN before pushing tags,
@@ -117,6 +117,27 @@ jobs:
       - name: Install Dependencies
         run: pnpm install --frozen-lockfile
 
+      # Validate user-supplied suffix against npm-safe charset before passing
+      # to bump-prerelease.ts. Empty suffix → omit the --suffix flag entirely
+      # so the script applies its timestamp fallback (passing an empty string
+      # would produce a version like "X.Y.Z-canary." with a trailing dot).
+      - name: Bump prerelease versions
+        if: ${{ steps.meta.outputs.mode == 'prerelease' }}
+        env:
+          INPUT_SCOPE: ${{ inputs.scope }}
+          INPUT_SUFFIX: ${{ inputs.suffix }}
+        run: |
+          set -euo pipefail
+          if [ -n "$INPUT_SUFFIX" ]; then
+            if ! [[ "$INPUT_SUFFIX" =~ ^[a-zA-Z0-9._-]+$ ]]; then
+              echo "::error::Invalid suffix '$INPUT_SUFFIX'. Allowed: [a-zA-Z0-9._-]+"
+              exit 1
+            fi
+            pnpm tsx scripts/release/bump-prerelease.ts --scope "$INPUT_SCOPE" --suffix "$INPUT_SUFFIX"
+          else
+            pnpm tsx scripts/release/bump-prerelease.ts --scope "$INPUT_SCOPE"
+          fi
+
       - name: Build packages
         run: pnpm run build
 
@@ -140,17 +161,11 @@ jobs:
 
     outputs:
       scope: ${{ steps.meta.outputs.scope }}
+      mode: ${{ steps.meta.outputs.mode }}
 
   publish:
     needs: build
-    # Run when build succeeded (normal flow) OR was skipped specifically because this is a
-    # workflow_call invocation (the caller already built and uploaded the artifact). The
-    # workflow_call branch is the ONE intentional skip — other skipped paths (notably a
-    # `pull_request: closed` event where the PR was closed WITHOUT merging, which makes the
-    # build job's own merged-true guard fail and skip) must NOT trigger publish. The default
-    # `if: success()` would also skip publish on legitimate workflow_call invocations, hence
-    # the explicit allowlist below.
-    if: ${{ !cancelled() && (needs.build.result == 'success' || (needs.build.result == 'skipped' && github.event_name == 'workflow_call')) }}
+    if: ${{ !cancelled() && needs.build.result == 'success' }}
     runs-on: ubuntu-latest
     timeout-minutes: 20
     environment: npm
@@ -164,39 +179,33 @@ jobs:
           PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
           INPUT_SCOPE: ${{ inputs.scope }}
           INPUT_MODE: ${{ inputs.mode }}
-          EVENT_NAME: ${{ github.event_name }}
         run: |
           set -euo pipefail
-          # Scope: workflow_call and workflow_dispatch both populate inputs.scope;
-          # pull_request parses scope from the release branch name.
           if [ -n "$INPUT_SCOPE" ]; then
             SCOPE="$INPUT_SCOPE"
           else
             # Branch format: release/publish/<scope>/v<version>
             SCOPE=$(echo "$PR_HEAD_REF" | sed 's|release/publish/\([^/]*\)/v.*|\1|')
           fi
           if [ -z "$SCOPE" ]; then
-            echo "::error::Failed to resolve scope (event=$EVENT_NAME, input=$INPUT_SCOPE, ref=$PR_HEAD_REF)"
+            echo "::error::Failed to resolve scope (input=$INPUT_SCOPE, ref=$PR_HEAD_REF)"
             exit 1
           fi
-          # Mode: only workflow_call carries an explicit mode; everything else is stable.
-          if [ "$EVENT_NAME" = "workflow_call" ]; then
-            MODE="${INPUT_MODE:-stable}"
-          else
-            MODE="stable"
-          fi
+          MODE="${INPUT_MODE:-stable}"
           echo "scope=$SCOPE" >> "$GITHUB_OUTPUT"
-          echo "mode=$MODE" >> "$GITHUB_OUTPUT"
-          echo "Resolved scope=$SCOPE mode=$MODE (event=$EVENT_NAME)"
+          echo "mode=$MODE"   >> "$GITHUB_OUTPUT"
 
       - name: Download workspace
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: workspace
 
       - name: Configure git credentials
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          git config --local url."https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/".insteadOf "https://github.com/"
+          set -euo pipefail
+          git config --local url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "https://github.com/"
 
       - name: Setup pnpm
         # Omit `version:` so pnpm/action-setup inherits from the repo's
@@ -229,20 +238,26 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ""
           NOTION_API_KEY: ${{ steps.meta.outputs.mode == 'stable' && secrets.NOTION_API_KEY || '' }}
-          PUBLISH_SCRIPT: ${{ inputs.publish-script || 'publish-release.ts' }}
+          PUBLISH_SCRIPT: ${{ steps.meta.outputs.mode == 'prerelease' && 'prerelease.ts' || 'publish-release.ts' }}
           SCOPE: ${{ steps.meta.outputs.scope }}
         run: pnpm tsx "scripts/release/$PUBLISH_SCRIPT" --scope "$SCOPE"
 
       - name: Verify publish step emitted version
-        if: ${{ success() && inputs.dry-run != true && steps.meta.outputs.mode != 'prerelease' }}
+        if: ${{ success() && inputs.dry-run != true }}
         env:
+          MODE: ${{ steps.meta.outputs.mode }}
           VERSION: ${{ steps.publish.outputs.version }}
         run: |
+          set -euo pipefail
           if [ -z "$VERSION" ]; then
-            echo "::error::publish step did not emit 'version' output. This indicates the publish-release.ts script (or the configured publish-script input) did not write to GITHUB_OUTPUT. Tag/release creation would produce malformed artifacts; aborting."
+            if [ "$MODE" = "prerelease" ]; then
+              echo "::error::prerelease.ts did not emit 'version' output to GITHUB_OUTPUT. The Prerelease summary would render a blank Version field; aborting."
+            else
+              echo "::error::publish-release.ts did not emit 'version' output to GITHUB_OUTPUT. Tag/release creation would produce malformed artifacts; aborting."
+            fi
             exit 1
           fi
-          echo "VERSION=$VERSION confirmed"
+          echo "VERSION=$VERSION confirmed (mode=$MODE)"
 
       - name: Configure git user
         if: ${{ success() && inputs.dry-run != true && steps.meta.outputs.mode != 'prerelease' }}