build(cli): gate release approval on publish job only

[Michael Price (michael-pr)]

Description drafted with AI, edited and reviewed by me.

Overview of Changes

The release environment's required-reviewer gate previously applied to every push to main, blocking even docs-only merges with nothing to publish. release.yml now splits into mode, version, publish, and binaries jobs, with environment: release moved onto publish alone — so approval is requested only when merging the Version Packages PR actually triggers a publish. Per-job concurrency groups replace the single workflow-level group, and a needs_publish check (no pending changesets and the current version not yet tagged) lets docs/CI-only merges skip both version and publish entirely.

Testing

1. Merge a docs-only change to main and confirm the mode job reports needs_publish=false, with neither version nor publish running — no approval requested.
2. Merge a PR with a changeset and confirm the version job opens/updates the Version Packages PR without requesting approval.
3. Merge the Version Packages PR and confirm only the publish job pauses for release environment approval; once approved, it publishes and binaries runs off its outputs.

No GitHub environment settings change is needed — the release environment's required reviewers remain the single approval gate. Cancel any release runs currently stuck awaiting approval from before this change.

Checklist

• Changes follow the code style of this project
• Self-review completed
• Tests added/updated (or not applicable)
• No breaking changes (or described below)

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 770acfb9-5b8b-4df1-97c5-d0ecd26c8bc4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

The release workflow now detects pending changesets and existing version tags, then conditionally runs separate version and publish jobs. Publishing uses Changesets only for npm publication, and the binaries workflow consumes publish outputs. The release documentation now describes the revised versioning, approval, publishing, skipped-run, and retry flows.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseWorkflow
  participant ModeJob
  participant VersionJob
  participant PublishJob
  participant ChangesetsAction
  participant BinariesWorkflow
  ReleaseWorkflow->>ModeJob: inspect changesets and version tag
  ModeJob->>VersionJob: enable when changesets exist
  ModeJob->>PublishJob: enable when publishing is needed
  PublishJob->>ChangesetsAction: run bunx changeset publish
  PublishJob->>BinariesWorkflow: pass published tag on success

Loading

Suggested reviewers: smonn

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	Uses a valid Conventional Commit format and accurately summarizes the release-approval workflow change.
Description check	✅ Passed	Covers the overview, testing steps, and checklist, with only optional template items left out.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch wiz-11060-simplify-release-approvals-to-only-version-packages-merge

---

_{Comment @coderabbitai help to get the list of available commands.}

[Michael Price (michael-pr)]

CodeRabbit (@coderabbitai) review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Michael Price (michael-pr)]

CodeRabbit (@coderabbitai) review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Line 17: Add with.persist-credentials: false to the checkout step in the mode
job at .github/workflows/release.yml lines 17-17. Also add persist-credentials:
false alongside fetch-depth: 0 in the version job checkout at
.github/workflows/release.yml lines 55-57.
- Around line 51-53: Add concise rationale comments to each permissions block in
the release workflow, including the version job’s pull-request write access, the
publish job’s id-token write access for npm provenance, and the binaries
reusable-workflow call’s contents write access. Keep the existing permission
scopes unchanged.
- Around line 68-73: Scope the GitHub App tokens in
.github/workflows/release.yml at lines 68-73 by adding contents: write and
pull-requests: write permissions for the Version Packages step; also update
lines 113-118 to add contents: write for the release creation token. Apply these
permission fields within each corresponding actions/create-github-app-token
step.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ff5c2196-e28f-43b3-944a-96a42ef2701f

📥 Commits

Reviewing files that changed from the base of the PR and between 9f3875d and ec2291b.

📒 Files selected for processing (2)

• .github/workflows/release.yml
• docs/releasing.md