feat(ci): automate TypeScript SDK release

[fuller]

Summary

• Detect merged TypeScript SDK version bumps and create an annotated typescript-sdk-v<version> tag on the exact merge commit.
• Build, test, and publish the tagged artifact in dependent jobs in the same workflow.
• Keep release-control checks and npm environment approval in the release path.

Why

A version bump in packages/sdk-typescript/package.json is the release signal. A version-bump PR may include SDK source or dependency changes; the generated tag points to the exact merged commit, which is then built, tested, and published.

Release flow

1. A merged PR touching packages/sdk-typescript/package.json starts Tag and Publish TypeScript SDK.
2. The tag job reads package metadata from merge_commit_sha, validates the version bump and lockfile, and creates typescript-sdk-v<version>.
3. The dependent jobs verify the tag, build/test the exact merge commit, run release-control preflight, and publish the artifact after npm environment approval.

The tag remains the immutable release marker. Because it is created with GITHUB_TOKEN, it intentionally does not start a second workflow; publishing is a dependent job in this same workflow. No manual workflow trigger or downstream workflow dispatch is required.

Required repository configuration

• Allow the GitHub Actions actor/integration to bypass creation/update/deletion of the protected typescript-sdk-v* tag ruleset. The current ruleset has user bypass actors only, so this must be updated before the workflow can create the tag.
• Keep the npm environment configured with required reviewers and prevent self-review.
• Keep npm Trusted Publishing configured for repository gemini/developer-platform, workflow filename publish-typescript-sdk.yml, environment npm, and npm publish.

No GitHub App credentials or SDK_RELEASE_TAG_RULESET_READY variable are required.

Validation

• Parsed the workflow YAML with yq.
• Syntax-checked all embedded Node scripts and shell blocks.
• Verified the workflow has no stale tag-event, App-token, or explicit chaining references.
• Verified the current SDK package and lockfile metadata and the version-diff guard.
• No SDK runtime tests were run because this is workflow-only code.

[nostradamus-bot]

Nostradamus Risk Rating — Medium

This PR introduces a pull_request_target-triggered workflow that mints a GitHub App installation token with Contents: write access to auto-tag SDK releases, and requires adding the App as a bypass actor on the protected typescript-sdk-v* tag ruleset — a new privileged automation path controlling the npm publish pipeline for @gemini-markets/sdk. Risk is substantially mitigated by SHA-pinned actions, strict input validation on all PR event data (SHA format, numeric PR number, semver pattern), the merged == true guard preventing triggering on fork PRs, and publish workflow hardening that verifies commit alignment and rejects force-pushed or lightweight tags.

[sdlc-pr-bot]

Change Control Evidence Check

Authorization — ❌ Fail

Evidence:

• Linear ticket: ⚠️ No ticket linked
• Change owner: Andrew Fuller
• Type of change: Normal

Testing — ✅ Pass

Evidence:

• Tests from CI checks: ➖ No tests ran
• Security scans: ✅ Passed
• Testing summary: ✅ Found in PR description
  • Summary: Workflow YAML syntax and configuration were validated using yq, with embedded Node scripts and shell blocks checked and no stale references or version inconsistencies identified. SDK runtime tests were not performed as the code is workflow-only.
• Evidence link: View run

Approval — ✅ Pass

Evidence:

• Approver: Jimmy Huang
• Approval source: GitHub PR Review
• Approval timestamp: 2026-09-09 00:16 UTC

Segregation of Duties — ✅ Pass

Validated:

• PR author: Andrew Fuller
• Commit author(s): dgame84
• Approver: Jimmy Huang
• Result: Implementer and approver are different people ✅

---

Last checked: 2026-09-09 00:17 UTC

↩ Re-run Clarissa if tickets, CI, or approvals have changed.

[ximt]

I found five important issues in the TypeScript release path:

1. The new pull_request_target execution context does not match the live npm environment's tag-only deployment policy, so publish is currently blocked before approval.
2. Removing the SDK source CODEOWNERS catch-all leaves source changes in a release PR without a required source owner.
3. The accepted prerelease versions are not publishable with npm 11.5.1 without an explicit dist-tag, leaving an immutable tag behind on failure.
4. The hand-written version regex accepts invalid SemVer with leading-zero numeric prerelease identifiers, also creating a tag before npm rejects it.
5. Provenance is generated from GITHUB_SHA/GITHUB_REF, while the artifact is checked out from the explicit merge SHA; those can diverge under this trigger.

I validated the workflow with actionlint and git diff --check. I also checked the live npm dist-tags and GitHub release controls. The PR description already calls out the separate requirement to grant the Actions integration a bypass on the protected release-tag ruleset; the current ruleset still has no such bypass, so that configuration is required before the first release can create its tag. I am leaving this as a comment review rather than approving.

[hubenforcer-gemini]

Please enable commit signing by following the commit signing setup guide. If you have additional questions, reach out to #git-commit-signing.

Reveal/hide commits without valid signatures

{"commit_hash": "286edb22995879fa62707a40b15f88bc995c5b96", "has_valid_signature": false, "author": {"name": "Dmitry Gimzelberg", "email": "dgame84@gmail.com", "github_username": "dgame84"}, "committer": {"name": "Dmitry Gimzelberg", "email": "dgame84@gmail.com", "github_username": "dgame84"}}

[ximt]

Re-review of head 286edb2: the previously reported findings are addressed (stable-only version validation, restored TypeScript source ownership, and tag-based publishing for environment policy and provenance). One important release-orchestration issue remains; see the inline comment.

Validation completed: actionlint, git diff --check, and syntax checks for both embedded Node.js scripts pass. The live tag ruleset still needs the Actions bypass documented in the PR body before the first release.

[ximt]

Re-review of head 52f56d5: the five previously reported issues are fixed and their review threads are resolved. The existing P1 concurrency finding remains open: the pull_request_target orchestrator and workflow_dispatch publisher still share a single static concurrency group, so a later release can replace an earlier pending publish run. I am not approving until that race is addressed.\n\nValidation: actionlint, git diff --check, and syntax checks for all embedded Node.js scripts pass. The live tag ruleset still requires the Actions bypass documented in the PR body, and ssdlc/validation is currently failing.

[ximt]

Re-review of head 4777554: the six previously reported issues are addressed and their review threads are resolved. The latest concurrency change correctly separates per-tag publishing from parent tag jobs, but one related release-queue race remains; see the inline comment.

Validation: actionlint, git diff --check, and syntax checks for all embedded Node.js scripts pass. ssdlc/validation is currently failing, and the live tag ruleset still requires the Actions bypass documented in the PR body.

[ximt]

Re-review of head 834eba5: no actionable TypeScript or release-workflow findings remain. All prior review threads are resolved, including the per-PR tag concurrency fix. actionlint, embedded Node syntax checks, and git diff --check pass. Approving.