fix(release): survive the version-bump race that wedged publishing

[gjtorikian]

Summary

Hardens release.yml against the race documented in #114: run #99 published 0.62.0 to npm, then lost a push race committing the bump back to main (PR #100 merged mid-run). package.json stayed at 0.61.0, so every publish run since re-derived 0.62.0 and died on npm error You cannot publish over the previously published versions.

Two guards, either of which alone would have prevented the 13-run failure streak:

1. Self-healing version base — the bump step now takes max(package.json version, registry version) as its base (npm view + sort -V), so a stale manifest can no longer wedge publishing. npm view failure falls back to 0.0.0, i.e. plain manifest-based behavior for a never-published package.
2. Rebase-and-retry on the bump-commit push — up to 3 attempts of git push / git pull --rebase origin main. The bump commit only touches package.json/package-lock.json, which the trigger paths deliberately exclude, so the rebase is conflict-free against spec merges and the push can't re-trigger the workflow.

Test plan

• YAML parses (js-yaml); bump-step shell passes bash -n.
• Base derivation simulated locally for both drift directions: manifest 0.61.0 / registry 0.62.0 → base 0.62.0; manifest ahead → manifest wins.
• After this and chore: resync version to the published 0.62.0 #114 merge: trigger release.yml via workflow_dispatch (bump: minor) → should publish 0.63.0, commit the bump, tag v0.63.0, and create the release.

Companion to #114 (state resync); this PR prevents recurrence.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

The release workflow now reconciles manifest and npm registry versions, commits the selected version before building, and retries non-fast-forward pushes so interrupted releases can recover safely.

• Fails closed when npm registry lookup fails unexpectedly.
• Reuses a committed-but-unpublished manifest version instead of skipping it.
• Builds and publishes from the post-rebase tree, then tags the pushed version commit.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Reworks version reconciliation and release ordering; the four previously reported release-state and artifact-identity failures are resolved at current HEAD.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Read manifest version] --> B[Read npm registry version]
  B --> C{Manifest ahead?}
  C -->|Yes| D[Reuse committed version]
  C -->|No| E[Bump from published version]
  D --> F[Commit and push version]
  E --> F
  F --> G{Push accepted?}
  G -->|No| H[Rebase onto main and retry]
  H --> G
  G -->|Yes| I[Build policy and types]
  I --> J[Publish to npm]
  J --> K[Tag pushed version commit]
  K --> L[Create GitHub Release]

Loading

_{Reviews (4): Last reviewed commit: "fix(release): resume an interrupted rele..." | Re-trigger Greptile}