fix: improve cherry-pick handling and version sync process to avoid conflicts

[frontegg-david]

Summary by CodeRabbit

• Chores

  • Improved release publishing with secure npm trusted publishing and provenance verification.
  • Release notes now generate package links dynamically.
  • Version synchronization is more reliable and keeps lockfiles up to date.
  • Release workflows now recover more cleanly from cherry-pick conflicts.

• Bug Fixes

  • Added clearer errors when package files contain merge-conflict markers or invalid JSON.

• Documentation

  • Updated release guidance for npm publishing requirements, configuration, and required tooling.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 24870dbc-f9e2-4299-a9b0-817d46430d17

📥 Commits

Reviewing files that changed from the base of the PR and between d5e1fb0 and 557fc39.

📒 Files selected for processing (1)

• .github/workflows/publish-release.yml

---

📝 Walkthrough

Walkthrough

The release workflow now uses npm trusted publishing, validates the npm CLI version, generates package links dynamically, synchronizes versions directly, and regenerates the lockfile. The version-sync script reports merge conflicts and invalid JSON. Conflict cleanup resets the working tree after dismissing the cherry-pick sequencer.

Changes

Release automation

Layer / File(s)	Summary
npm publishing and release metadata .github/RELEASE_WORKFLOW.md, .github/workflows/publish-release.yml	The workflow documents and uses npm trusted publishing through OIDC. It requires npm 11.5.1 or later and derives release links from non-private package metadata.
Version synchronization and conflict recovery .github/workflows/publish-release.yml, scripts/sync-versions.mjs, .github/workflows/cherry-pick-prompt.yml	The release workflow synchronizes package versions directly, regenerates and stages the lockfile, and updates the synchronization commit message. The sync script detects conflict markers and invalid JSON. Conflict cleanup dismisses the sequencer and resets HEAD.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseJob as GitHub Actions release job
  participant NpmCli as npm CLI
  participant NpmRegistry as npm registry
  ReleaseJob->>NpmCli: install and validate npm >= 11.5.1
  ReleaseJob->>NpmRegistry: publish packages with OIDC credentials
  ReleaseJob->>ReleaseJob: scan libs/*/package.json for release links

Loading

Possibly related PRs

• agentfront/enclave#70: Also changes lockfile synchronization during release publishing.
• agentfront/enclave#53: Also changes release-branch version synchronization and cherry-pick handling.
• agentfront/enclave#6: Also changes release workflow package-version and release-body generation logic.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes to cherry-pick handling and version synchronization.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-version-cherrypick

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/publish-release.yml:
- Around line 101-102: Update the npm installation command in the release
workflow to use the approved exact npm CLI version compatible with .nvmrc
instead of npm@latest, while preserving the existing fallback warning and
minimum-version validation.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 63128eb1-fb5a-43fa-8675-8c1bab7a00e2

📥 Commits

Reviewing files that changed from the base of the PR and between 4aee666 and d5e1fb0.

📒 Files selected for processing (4)

• .github/RELEASE_WORKFLOW.md
• .github/workflows/cherry-pick-prompt.yml
• .github/workflows/publish-release.yml
• scripts/sync-versions.mjs

[github-actions]

Cherry-pick Created

A cherry-pick PR to main has been automatically created.

Please review and merge if this change should also be in main.

If the cherry-pick is not needed, close the PR.