ci(release): make stable releases composable

[benjaminshafii]

Summary

• prepare one signed release PR containing version bumps, an immutable 18-stage artifact index, and AUR checksums from the exact staged Linux bytes
• continue automatically after the single reviewed squash merge with idempotent tag, desktop, server, Daytona, and AUR stages
• make publication stages independently retryable and reject changed/mixed artifacts instead of rebuilding or clobbering them
• replace mutable PR metadata with committed validated release metadata and pin AUR SSH host fingerprints

Validation

• pnpm release:test (21 passed)
• pnpm release:review (passed)
• pnpm release:prepare -- patch --dry-run (passed)
• focused Actionlint via rhysd/actionlint Docker image (passed; known custom Blacksmith label suppressed)
• ShellCheck via koalaman/shellcheck Docker image (passed)
• git diff --check (passed)

Required setup before first release

• create/install a dedicated least-privilege Release GitHub App
• configure RELEASE_APP_ID, RELEASE_APP_PRIVATE_KEY, and exact RELEASE_APP_LOGIN
• add only that App as a bypass actor for the v* tag-creation ruleset; do not grant a dev branch bypass

Runtime evidence

Incomplete until the dedicated Release App and tag ruleset are configured. Unit and workflow-contract assertions cover planning, signed metadata, exact-attempt 18-stage artifacts, immutable publication, npm idempotency, and AUR consistency; no deterministic testkit witness can execute GitHub protected-branch/App installation semantics or external publishers locally.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-app	Ready	Preview	Aug 3, 2026 5:45pm
openwork-den	Ready	Preview	Aug 3, 2026 5:45pm
openwork-den-worker-proxy	Ready	Preview	Aug 3, 2026 5:45pm
openwork-diagnostics	Ready	Preview	Aug 3, 2026 5:45pm
openwork-landing	Ready	Preview, v0	Aug 3, 2026 5:45pm

[github-actions]

Pin the release App token action to an immutable commit

The newly added privileged token-minting action uses the mutable @v2 tag, allowing a future action-tag compromise to execute code with the release App private key and contents-write token.

Evidence

• The continuation workflow executes actions/create-github-app-token@v2 with RELEASE_APP_PRIVATE_KEY at lines 200-203.
• The resulting token is used to push the release tag with contents write permission at lines 211 and 237.
• Because @v2 is mutable remote code, a compromised tag could exfiltrate the private key or mint/use the release token to modify repository contents.
• Pin the action to a reviewed full commit SHA, optionally retaining the version in a comment.

Also found at 1 additional location

• .github/workflows/release-prepare.yml:65-65

_{Identified by Warden · diff-security-review · UUE-7YX}