[tannerlinsley]

Problem

The publisher reported success on consecutive stable releases while the core package tarball still returned HTTP 404. During that window, the new CLI and aliases could resolve from npm but a fresh install could fail on the exact core version they require.

Change

• Keep the existing Changesets version PR, trusted publisher workflow identity, and prerelease publication path.
• Publish stable versions in dependency order. Wait for the public core tarball and verify its SHA512 and manifest before uploading the CLI. Verify the CLI before uploading aliases. Verify the exact internal dependency versions in every archive.
• Record each upload attempt before it starts. Rerunning the same workflow can resume verification and advance to untouched packages without repeating an uncertain upload.
• Queue release runs and push the package tags only after the public artifacts verify. The core package's own npm latest tag still uses the existing trusted publisher behavior.

This draft includes the verifier from #530 so the combined workflow can run against current main. Review #530 independently first. After it lands, rebase this branch so only the six follow-up files remain in the diff. Keep #557 held until the workflow has passed its hosted gates and required Core review.

Checks

• Frozen pnpm install and the normal hook passed for all 10 builds, 558 unit tests, 20 release tests and eight blocking Chrome tests.
• The exact ci: Version Packages #557 manifests produced a seven-package release plan. Mocked registry and workflow responses covered a missing core tarball, an uncertain upload, a canceled run before the job and a missing attempt marker.
• Packed all seven workspaces locally with pnpm 11.1.0 and checked the exact internal dependency versions in their archived manifests.
• Offline workflow security scan passed. Tests performed no package uploads or remote tag writes.

[changeset-bot]

⚠️ No Changeset found

Latest commit: ae0ecbf

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn