feat(release): prepare ASF npm candidates

[M4n5ter]

English

Summary

• add a credential-free, upstream-only workflow that prepares one unsigned npm convenience candidate from the exact ASF source RC reference;
• reuse the immutable CLI validation matrix and carry the same tarball through Linux, macOS, Windows, and Eval checks;
• generate the ASF-specific SHA-512 sidecar only at handoff, then write a closed record binding the tarball bytes to the source reference, commit, repository, workflow run, and attempt;
• reject fork provenance and partial job re-runs, and revalidate the live tag target and main ancestry immediately before upload;
• document the Release Manager handoff and the boundary around tag-signature authentication, voting, credentials, and publication.

Trust boundary

The Release Manager and source-release process remain the sole authority for deciding that a source RC tag is signed by a key in the trusted ASF KEYS material. This workflow pins the selected annotated tag, commit, and validated npm bytes; it does not authenticate the tag signature or establish source-release approval.

A partial job re-run is intentionally rejected because it could combine authorization and artifact facts from different workflow attempts. Use Re-run all jobs instead.

Scope and dependency

This is the first, non-publishing slice of G8. It depends on #3222 for unified product identity, npm package construction, and the reusable validation workflow.

The workflow does not sign artifacts, call npm staging or publication, modify dist-tags, or claim that the source release has passed either required vote. Those requirements remain tracked in #3275.

Refs #3275.

Verification

• node --test scripts/asf-npm-candidate.test.mjs scripts/asf-npm-workflow-policy.test.mjs
• mise exec go -- go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github/workflows/asf-npm-candidate.yml .github/workflows/cli-package-validation.yml
• npm run build
• npm run format:check
• npm run lint
• npm run check:release
• real npm tarball creation, confirmation that the generic pack emits no SHA-512, ASF record creation, and independent verification
• npm run release:cli:smoke

简体中文

概述

• 新增无凭据、仅允许上游仓库运行的工作流，从精确的 ASF 源码 RC reference 准备唯一的未签名 npm convenience candidate；
• 复用不可变 CLI 验证矩阵，让同一份 tarball 通过 Linux、macOS、Windows 和 Eval 检查；
• 只在 ASF handoff 边界生成 SHA-512，并写入闭合记录，将 tarball 字节绑定到源码 reference、commit、仓库、workflow run 和 attempt；
• 拒绝 fork provenance 和部分 job 重跑，并在上传前重新验证 live tag target 与 main ancestry；
• 记录 Release Manager 交接流程，明确 tag 签名认证、投票、凭据和发布的职责边界。

信任边界

只有 Release Manager 和 source-release 流程有权判断 source RC tag 是否由可信 ASF KEYS 中的密钥签名。该工作流只固定所选 annotated tag、commit 和已经验证的 npm 字节；它不会认证 tag 签名，也不会建立源码 release 已获批准的事实。

部分 job 重跑会混合不同 workflow attempt 的 authority 与 artifact 事实，因此被刻意拒绝；应使用 Re-run all jobs。

范围与依赖

这是 G8 的第一个非发布阶段。它依赖 #3222 提供统一产品身份、npm 包构建和可复用验证工作流。

该工作流不签名、不调用 npm staging 或发布、不修改 dist-tag，也不声称源码 release 已通过任一必要投票。其余要求继续由 #3275 跟踪。

Refs #3275。

验证

• node --test scripts/asf-npm-candidate.test.mjs scripts/asf-npm-workflow-policy.test.mjs
• mise exec go -- go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github/workflows/asf-npm-candidate.yml .github/workflows/cli-package-validation.yml
• npm run build
• npm run format:check
• npm run lint
• npm run check:release
• 实际 npm tarball 构建、确认通用 pack 不生成 SHA-512、ASF record 生成以及独立验证
• npm run release:cli:smoke

[Astro-Han]

Thanks for making the npm candidate handoff reproducible and for simplifying the CI planner so the contract actually runs on this head. The hosted test, audit, and package checks are all green. I found one non-blocking product-identity seam that should be consolidated before this release path becomes authority, noted inline.

AI-assisted review disclosure: OpenAI Codex coordinated independent release-contract and packaging reviews, including an adversarial exact-head recheck. I verified the retained finding, rejected the unsupported provenance concern, and checked the live CI and review state before making the final decision.

[Astro-Han]

Thanks @M4n5ter — reviewed at exact head efe48ad65a966058a9a2fb40aa0c7917137564f1. No P0–P2 findings; approving.

What was checked

The release contract chain is closed end to end: tag ref → annotated tag object → tag commit equals GITHUB_SHA → that commit is an ancestor of main → the reusable workflow builds one tarball from that same commit → all four platform jobs and Eval consume that single artifact → the handoff record binds SHA-256/SHA-512, source tag and commit, run ID and attempt, and re-validates the live tag before upload.

• Version authority is single-sourced. Root, Desktop and CLI manifests resolve through one path; the CLI surface is restricted to the public maka command. Tarball naming, version and record consistency are all validated rather than assumed.
• No publish capability is introduced. asf-npm-candidate.yml declares permissions: contents: read at both workflow and job level, with no id-token, no registry auth, no npm publish and no dist-tag mutation. Signing and the release vote stay outside candidate preparation and are documented as human gates in the runbook — the right boundary for an ASF release candidate.
• Failure, rerun and concurrency paths hold. Runs serialize on the same ref; the handoff requires the validation run attempt to match the current attempt; the job fails closed if the tag is moved, is no longer an annotated tag, or no longer resolves to a commit reachable from main.
• No parallel CI authority. check:asf-npm runs unconditionally, and the CLI validation workflow keeps using the existing tarball builder rather than introducing a second build path. The ci-test-plan changes only assign ownership for the new files.
• Existing pack tooling continues to own staging, third-party notices, production-dependency audit, file manifest and artifact metrics; the candidate script recomputes SHA-256/SHA-512 and refuses to overwrite an existing sidecar or record.

Verification

34 focused tests green in a read-only worktree at the exact head (ASF npm candidate, workflow policy, CI test plan); actionlint clean; git diff --check clean. Required checks at this head: audit, package and test all SUCCESS.

mergeStateStatus=BLOCKED / reviewDecision=REVIEW_REQUIRED at the time of writing reflects the independent-approval gate, not a code finding.

---

This review was AI-assisted. It is not a substitute for independent human review by a committer.