chore: production deploy

.gitattributes

@@ -1,5 +1,35 @@
-# pnpm 12 parses patch files with a Rust patch parser that rejects a carriage
-# return in the `---`/`+++` header lines. Git for Windows checks text files out
-# with CRLF by default, which broke `pnpm install` on the Windows release
-# smoke-test. Keep patch files LF everywhere.
+# pnpm 12 briefly had a bug (pnpm/pnpm#14557) where it parsed patch files with a 
+# Rust patch parser that rejects a carriage return in the `---`/`+++` header lines.
+# Git for Windows checks text files out with CRLF by default, which broke
+# `pnpm install` on the Windows release smoke-test.
+# This guarantees that we keep patch files LF everywhere.
 patches/*.patch text eol=lf
+
+# error-tag-stability.unit.test.ts splits this fixture on newlines to diff it
+# against a live-scanned tag set. Pin it to LF so a CRLF checkout on Windows
+# can't leave a trailing `\r` on every entry and make every tag mismatch.
+apps/cli/src/shared/telemetry/__fixtures__/error-tags.txt text eol=lf
+
+# Generated artifacts. `linguist-generated` keeps these out of GitHub's language
+# statistics and collapses them in pull request diffs -- they are build output to
+# be regenerated, not code to review, and together they outweigh the hand-written
+# source. The attribute is GitHub-only: git, CI, and local diffs are unaffected.
+# Collapsed is not hidden. v1-openapi.yaml and the lockfiles do carry changes
+# worth reading -- an upstream API change, a dependency substitution -- and both
+# stay one click away in review.
+# Regeneration is owned by `go generate` in apps/cli-go and by the `generate`
+# turbo task, whose `outputs` in turbo.json are the source of truth for this list.
+# Only the generated files are listed, not their hand-written inputs
+# (pkg/api/*.cfg.yaml, api/overlay.yaml). apps/docs/content/docs/commands/ is
+# generated too but gitignored, so it needs no entry.
+apps/cli-go/api/v1-openapi.yaml linguist-generated=true
+apps/cli-go/pkg/api/*.gen.go linguist-generated=true
+packages/api/src/generated/* linguist-generated=true
+packages/api/scripts/openapi-source.json linguist-generated=true
+apps/docs/public/cli/config.schema.json linguist-generated=true
+apps/docs/public/cli/project-config.schema.json linguist-generated=true
+
+# Lockfiles. Collapsed rather than hidden -- a dependency change is still one
+# click away in review, which is the same treatment GitHub gives package-lock.json.
+pnpm-lock.yaml linguist-generated=true
+apps/cli-go/go.sum linguist-generated=true

.github/MAINTAINERS.md

@@ -51,26 +51,78 @@ issue directly (from the GitHub UI, or from the Linear-linked issue).
 ## `run-ci`: full develop CI on stacked or draft PRs
 
 Ready (non-draft) PRs targeting `develop` already get the default suite: Test
-(check / unit+integration / e2e), preview CLI packages, and PR-title lint.
+(check / unit+integration / e2e) and PR-title lint.
 
 Stacked PRs (base is another PR branch) and drafts do **not** get that suite
 unless they carry the **`run-ci`** label. [`run-ci.yml`](./workflows/run-ci.yml)
-then calls Test and preview-package publish as reusable workflows, including
-while the PR is still a draft.
+then calls Test as a reusable workflow, including while the PR is still a draft.
 
 - Add `run-ci` to start (or resume) the suite; remove it to cancel in-progress
   `run-ci` runs via that workflow's concurrency group.
-- Other labels do not start or cancel Test / preview. PR-title lint may
-  retrigger because that check is cheap.
+- Other labels do not start or cancel Test. PR-title lint may retrigger because
+  that check is cheap.
 - After a stacked PR is retargeted onto `develop`, push or reopen so the
   native required checks (`Check code quality`, etc.) populate. The opt-in
   suite uses different check names (`Test / Check code quality`).
-- This is independent of `run-live-e2e-ci`, which opts into the separate
-  supabox live e2e dispatch.
+- This is independent of `run-preview-packages` and `run-live-e2e-ci`.
 
 The `run-ci` label must exist as a repository label; create it from
 **Issues → Labels** if it is missing.
 
+## `run-preview-packages`: on-demand pkg.pr.new preview
+
+CLI preview packages are large, so they are **not** published on every PR.
+Add the **`run-preview-packages`** label to publish via
+[`publish-preview-cli-packages.yml`](./workflows/publish-preview-cli-packages.yml)
+(any base branch, including drafts). While the label stays on, each subsequent
+push re-publishes; remove it to cancel in-progress runs.
+
+The workflow posts (or updates) a PR comment with an `npx` install command for
+the preview. This is independent of `run-ci` and `run-live-e2e-ci`.
+
+The `run-preview-packages` label must exist as a repository label; create it
+from **Issues → Labels** if it is missing.
+
+## Live e2e coverage and stable releases
+
+[`Live E2E`](./workflows/live-e2e.yml) exercises managed staging after every push
+to `develop`, daily at 06:23 UTC, and on manual dispatch. New `develop` pushes
+cancel superseded push runs; nightly and manual runs execute independently.
+Nightly runs do not depend on a new beta version: they also detect staging
+changes between CLI releases.
+
+Stable publishing requires a passing live suite for the exact release commit.
+The release workflow reuses a verified successful staging run on `develop` for
+that commit when available; otherwise it runs the suite before publishing.
+Normal promotion fast-forwards that commit from `develop` to `main`. The gate
+deliberately queries `develop` runs of `live-e2e.yml`; renaming the workflow
+requires updating that selector. Actions API lookup errors and live-test
+failures block publication. This also applies to
+manual stable releases. Beta publication keeps its existing build and smoke-test
+gates.
+
+Live-test failures and recoveries are sent to the channel configured by
+`SLACK_RELEASE_WEBHOOK`, with commit and workflow links. Routine successful runs
+stay quiet. GitHub Actions logs contain the test failures; notification delivery
+does not determine whether the suite passed.
+
+PR live coverage remains opt-in through `run-live-e2e-ci`. That label dispatches
+the PR commit to the separate Supabox harness, which also has its own nightly
+schedule against pinned submodules. A Supabox result does not replace the
+managed-staging gate for stable publication.
+
+The gate and notifier identify the reusable suite by the `Live e2e` job name (or
+the exact ` / Live e2e` suffix). The gate also checks the `Run live e2e` step
+name. Keep these names aligned with their consumers. Push, scheduled, manual, and stable-gate runs
+use separate concurrency groups because they own independent temporary project
+sets; this is intentional and does not imply a global concurrency quota.
+Notification history inspects at most 25 recent runs of the same workflow and
+branch. It suppresses repeated outcomes and results superseded by a newer run
+or attempt. Recovery requires a known prior failure. History lookup errors
+produce warnings; a confirmed current failure can still be reported if its
+prior outcome is unknown. Release failures use the existing release notification
+to avoid a second failure alert from the live notifier.
+
 ## Deferred: automatic Linear → GitHub label sync
 
 We considered auto-applying `open-for-contribution` when a Linear issue moves out of

.github/actions/setup/action.yml

@@ -75,6 +75,11 @@ runs:
       shell: bash
       env:
         DEPENDENCY_FIREWALL_TOKEN: ${{ inputs.dependency-firewall-token }}
+        # Skip husky's hook install: the commit-msg hook is a local dev
+        # convenience, not a gate for bot-authored commits (e.g.
+        # propose-release-notes.ts), and CI already enforces scopes on the
+        # PR title separately.
+        HUSKY: "0"
       run: |
         if [ -z "$DEPENDENCY_FIREWALL_TOKEN" ]; then
           echo "Dependency Firewall token unavailable; using default npm registry."

.github/dependabot.yml

@@ -11,10 +11,30 @@ updates:
       actions-major:
         patterns:
           - "*"
+        exclude-patterns:
+          - "openai/codex-action"
     ignore:
       - dependency-name: "supabase/setup-cli"
         update-types:
           - "version-update:semver-major"
+      - dependency-name: "openai/codex-action"
+        # NOTE: this ecosystem's `versions` strings are parsed as Ruby
+        # Gem::Requirement (RubyGems comparator syntax), NOT npm-style semver
+        # ranges — "1.12.x" is not a wildcard here, it parses as a literal
+        # (and never-matching) version string, which is why the prior attempt
+        # at this silently failed to block v1.12 (PR #6541, 2026-09-09). Use
+        # real comparators instead.
+        versions:
+          - ">= 1.12, < 1.13"
+        # Deliberately pinned to v1.11 in ai-review.yml — v1.12 has two
+        # confirmed, still-open upstream regressions: a wrapper-level hang
+        # (openai/codex-action#151) and a runner-killing failure
+        # (openai/codex-action#160). A grouped Dependabot bump already
+        # silently reintroduced v1.12 once (PR #6484, 2026-09-07). Scoped to
+        # the 1.12 line (not a blanket ignore) so Dependabot still proposes
+        # v1.13+ once a fix ships; evaluate any such proposal in its own
+        # deliberate PR, checking the upstream changelog/issue tracker first
+        # — never bundle it into the actions-major group.
     cooldown:
       default-days: 7
   - package-ecosystem: "gomod"
@@ -24,6 +44,8 @@ updates:
     schedule:
       interval: "cron"
       cronjob: "0 0 * * *"
+    commit-message:
+      prefix: "chore(cli-go): "
     groups:
       go-minor:
         update-types:
@@ -43,9 +65,8 @@ updates:
       interval: "cron"
       cronjob: "0 0 * * *"
     commit-message:
-      prefix: "fix"
-      prefix-development: "chore"
-      include: "scope"
+      prefix: "fix(misc): "
+      prefix-development: "chore(misc): "
     groups:
       npm-major:
         patterns:
@@ -58,7 +79,7 @@ updates:
       interval: "cron"
       cronjob: "0 0 * * *"
     commit-message:
-      prefix: "fix(docker): "
+      prefix: "fix(misc): "
     groups:
       docker-minor:
         update-types: