fix(lr-d4413a): stop beta release job from clobbering main's version basis

[clagentic-builder]

What

Fixes the beta release workflow silently no-op'ing after a stable cut (lr-d4413a).

Two changes to .github/workflows/release.yml, beta job only:

1. "Sync release tags into main" step no longer force-copies version files. The step still merges origin/release into main (--no-edit -X theirs) for tag reachability, but now explicitly restores main's own CHANGELOG.md / package.json / package-lock.json from the pre-merge HEAD afterward instead of taking release's copies. Previously this step unconditionally ran git checkout origin/release -- CHANGELOG.md package.json package-lock.json, which force-copied release's STABLE version snapshot onto main whenever release was ahead (i.e. right after a stable cut). That reset main's version basis below the feature commits meant to drive the next beta, so semantic-release's commit-analyzer saw no releasable commits and exited success with nothing published — a green no-op.
2. New step fails the job loud if a dispatched beta publishes nothing. Run semantic-release (beta) now records whether HEAD moved (semantic-release always commits+tags on a real publish); a following step fails with exit 1 and a diagnostic message if it didn't. An operator-dispatched type=beta with zero output is an error the operator must see, not a silent green run — this only applies to the workflow_dispatch-triggered beta job, no scheduled/passive trigger is affected.

Why

Root cause (confirmed via lr-d4413a investigation, GH Actions run 29445794624): stable v1.7.0 was cut on release (commit ae58f95), then a type=beta dispatch on main (7 feature PRs #340-#346 landed since) ran step 5 before semantic-release, merged release into main, and force-copied release's stable package.json/CHANGELOG.md onto main. semantic-release then computed the current version as 1.7.0 with the 7 feature commits sitting below that synced tag boundary — no release computed, all green, nothing published, and the operator's install:local-test loop got poisoned onto stable 1.7.0.

Trade-offs considered

• Kept the merge itself (tag-reachability purpose) rather than removing step 5 outright — dropping the merge entirely could regress whatever tag-visibility guarantee it exists for; only the destructive version-file overwrite is removed.
• Used HEAD-SHA-diff as the "did a release actually happen" signal rather than parsing npx semantic-release output — semantic-release doesn't expose a machine-readable no-op signal on stdout without additional plugin config, and a HEAD move is true for every successful publish (@semantic-release/git always commits package.json/CHANGELOG.md).
• Left promote/stable jobs untouched per scope — the stable job's own "sync stable version files back to main" step is the same operation but in the correct direction (release's clean stable version really should land on main after a real cut), so it was intentionally not touched.

Testing

• npm test: 978/982 pass, 4 pre-existing failures (lr-1f7e context-window-warn suite) reproduced identically on main before this change (verified via git stash + baseline re-run) — unrelated to this workflow-only diff, not introduced by it.
• No workflow-level dry run performed (requires a live Actions dispatch); change is scoped to shell logic already exercised by the existing bug report's run.

Task: lr-d4413a

[clagentic-reviewer]

PEACHES — clean (0 nits)

The PR correctly fixes the beta release workflow's silent no-op bug by (1) preventing the sync step from clobbering main's version basis and (2) adding a fail-loud check when a dispatched beta publishes nothing.

• .github/workflows/release.yml ("Sync release tags into main" step, lines 58–88): Version-basis preservation now works correctly. The step captures PRE_MERGE_HEAD, merges for tag-reachability, then restores main's own CHANGELOG.md, package.json, and package-lock.json from before the merge. This prevents semantic-release's version-computation baseline from being reset to the stable version. — amos.code-craft.1
• .github/workflows/release.yml ("Run semantic-release (beta)" and "Fail loud if the dispatched beta published nothing" steps, lines 98–124): Fail-loud on dispatched beta no-op now works correctly. HEAD-SHA comparison captures whether semantic-release published anything; if not, the workflow exits 1 with clear error message. Gated to dispatch-only. — amos.code-craft.1
• .github/workflows/release.yml (lines 59–70, 114–120): Comments clearly explain tag-reachability-only invariant and dispatch-only fail-loud principle. — amos.code-craft.1
• Brand rule satisfied: no bare "clagentic" in user-facing strings. — clagentic-console.brand-product-name
• Stable job unaffected: promote and stable jobs remain unchanged. — amos.code-craft.1

No blocking issues.

{"reviewer": "peaches", "review_status": "clean", "head_sha": "055d6c2d006559075e89201db1b5a4837a0dfa43", "pr_number": 347}

[clagentic-security]

BOBBIE security audit of PR #347 (fix/lr-d4413a-beta-release-no-op -> main).

Scope: .github/workflows/release.yml only (workflow-file diff, in-scope per lr-e41b injection/runner-label/token surface).

Review:

• permissions block (contents/issues/pull-requests/id-token write) unchanged by this diff.
• runs-on: ubuntu-latest unchanged; no self-hosted runner introduced.
• New/changed shell steps use only locally-computed values (git rev-parse HEAD before/after semantic-release, a captured PRE_MERGE_HEAD SHA) — no interpolation of github.event.* or other PR-controlled input into any run: block; no actions-injection vector introduced.
• APP_TOKEN usage unchanged from prior version: only used in push URL construction, never echoed or logged.
• New "Fail loud" step emits a static ::error:: string with no untrusted interpolation.
• Net effect of the diff: version-basis files (package.json/CHANGELOG.md/package-lock.json) are now restored from the pre-merge main HEAD instead of force-copied from release, and a dispatched beta that publishes nothing now fails the job instead of a silent green no-op. Matches the stated fix intent (lr-d4413a) with no scope creep into the promote/stable jobs.

Scanners: gitleaks findings are pre-existing files outside this diff (worktree cert fixtures), not introduced by this PR — excluded per diff-scoping. semgrep p/github-actions: 0 findings on release.yml. osv-scanner: pre-existing package-lock.json CVEs unrelated to this diff (PR touches only the workflow file) — excluded per diff-scoping.

No blocking or nit findings.

scanners_run: gitleaks(no diff-scope hits), semgrep p/github-actions(0 findings), osv-scanner(pre-existing, out of diff scope)

{"reviewer": "bobbie", "review_status": "clean", "head_sha": "055d6c2d006559075e89201db1b5a4837a0dfa43", "pr_number": 347}

[clagentic-merger]

Merged via clagentic-loadout v0.1.0

Field	Value
Gated HEAD SHA	055d6c2d006559075e89201db1b5a4837a0dfa43
Merged SHA	055d6c2d006559075e89201db1b5a4837a0dfa43
Reviews	clagentic-reviewer[bot], clagentic-security[bot]
CI status	no-runner-by-design (0 commit-status entries at HEAD)
task_id	lr-d4413a