ci(publish): real-publish-equivalent preflight (no more half-releases)

[rickylabs]

Real-publish-equivalent preflight — never half-release again

deno publish --dry-run is a confirmed blind spot: it can pass while the real publish module-graph build rejects a module. That is exactly how alpha.5 half-published — the text-import graph-build rejection surfaced only at real publish (after dry-run was green), so a partial member set uploaded before the run errored.

This adds a preflight that exercises the real publish code path but cannot upload.

How it works

A new preflight mode in publish-workspace.ts runs the actual deno publish (not --dry-run) with a deliberately invalid token (--token … --no-provenance). deno publish builds the full combined module graph for every workspace member first, then hits auth — so an invalid token lets the graph build run for real and stops at the auth boundary before any upload.

Classification:

Outcome	Meaning	Verdict
Reached auth boundary (invalidBearerToken)	full graph built for every member	PASS
Exit 0 (all already published, registry skip)	nothing to build	PASS (no-op)
Any other nonzero (graph/check error)	a real publish would also fail	FAIL (would half-publish)

CI wiring

publish.yml gains a Publish preflight (real graph build, no upload) step between Publish dry-run and Publish. A real graph/check failure now reds the job before the real Publish step runs, so a release can never half-publish. The step never uploads (the token is invalid by design); it adds no secret dependency.

Validation (local, Deno 2.9.0)

All three classification branches exercised end-to-end:

• Already-published (alpha.5 current) → PASS no-op, exit 0.
• Unpublished version (forced real graph build) → real graph built for all 31 members incl. @netscript/fresh-ui, stopped at the auth boundary → PASS, exit 0.
• Injected missing-module graph error → FAILED, exit 1 (throws before the auth boundary, nothing uploaded).

deno check ✓ · deno fmt --check ✓ · deno lint ✓ (tools clean).

Closes the deno publish --dry-run blind spot recorded in the JSR publish dry-run blind-spots note.

🤖 Generated with Claude Code