fix(ci): publish packages in dependency order, fail fast on failure

[felipefreitag]

Replace changeset publish (which publishes in arbitrary order and keeps going when one package fails) with an explicit pipeline in release.mts that:

• publishes packages in topological (dependency) order
• skips a package's dependents when it fails, so a broken dependency can never produce a broken dependent published against a version that isn't on npm
• derives each npm dist-tag from the version itself (x.y.z -> latest, a prerelease -> its own tag), so a prerelease can never overwrite latest - @gabrielmfern not sure if we should do that here? It's one more layer on top of the existing pre controls
• adds a --dry-run flag that prints the publish plan without publishing
• exits non-zero when any package fails

Adds unit tests (scripts/release.spec.mts) for the pure pipeline helpers and wires them into the tests workflow, since scripts/ isn't a workspace and turbo run test doesn't cover it.

Closes #3045

Run examples:

---

Summary by cubic

Publishes packages in dependency order and fails fast to avoid releasing broken dependents. Adds version-based npm dist-tags, --dry-run, provenance on publish, and CI unit tests.

• New Features

  • Replace changeset publish with an explicit pipeline in scripts/release.mts that publishes in topological order, skips dependents when a package fails, derives the dist-tag from the version (x.y.z -> latest, prereleases -> their own tag), supports --dry-run, and exits non-zero on any failure.
  • Publish with npm provenance via pnpm publish --provenance (replaces NPM_CONFIG_PROVENANCE).
  • Add unit tests for the release helpers and run them in CI; update the release script in package.json to build packages only.

• Bug Fixes

  • Prevent publishing a dependent when its dependency fails or isn’t on npm, fixing Packages should not be published if any of their dependencies fail to publish #3045.

^{Written for commit e8a3a5c. Summary will update on new commits. Review in cubic}

[changeset-bot]

⚠️ No Changeset found

Latest commit: e8a3a5c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
react-email	Ready	Preview, Comment	May 27, 2026 8:12pm
react-email-demo	Ready	Preview, Comment	May 27, 2026 8:12pm

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.2.6
	@​types/​react-dom@​19.1.2
	@​types/​react@​19.1.2
	@​types/​node@​20.17.30
	@​tailwindcss/​postcss@​4.1.4
	react@​19.2.6
	tailwindcss@​4.1.4
	typescript@​5.8.3
	react-dom@​19.2.6

View full report

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

<sub>Requires human review: This PR replaces the entire changeset publish pipeline with a custom publish orchestrator in scripts/release.mts, which is a critical path for production releases — any bug could result in incorrect package ordering, broken dependency chains on npm, or improper dist-tags, so it requires...

Re-trigger cubic</sub>

[cubic-dev-ai]

No issues found across 5 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Requires human review: This PR rewrites the CI release pipeline to publish packages in dependency order instead of using changeset publish, which is a critical infrastructure change where any undetected bug could cause broken releases, incorrect dist-tags, or partial publishes, so it requires a human to verify the logic.

Re-trigger cubic</sub>