Release commits never reach main: branch protection rejects the push and the release script swallows it

[aayambansal]

Every release leaves its release: vX.Y.Z commit orphaned. For v1.2.4:

$ git merge-base --is-ancestor v1.2.4 origin/main; echo $?
1        # tag is not an ancestor of main

The version fields on main are stale as a result: backend/cli says 1.2.3, tooling/sdk/js and tooling/plugin say 1.2.2, while npm latest is 1.2.4.

Cause: tooling/repo/publish.ts commits the version bumps and pushes with

await $`git push origin HEAD --tags --no-verify --force-with-lease`.nothrow()

Branch protection on main requires a PR, so the branch push is rejected. Tags are exempt, so the tag lands. .nothrow() swallows the rejection and the run stays green.

Consequences:

• the tagged tree that gets published to npm was never reviewed or CI-tested
• main permanently disagrees with every released tree
• the npm deployment record uses context.sha (publish.yml), which is the pre-release commit, not the tree that shipped

The pipeline only works at all because tooling/repo/version.ts computes the next version from the npm registry rather than from package.json.

Fix options: have the release job open a release PR instead of pushing to main, or add the workflow's identity as a branch-protection bypass actor. Either way, drop the .nothrow() on the push so a rejected push fails the release loudly.

[aayambansal]

Resolved by #64: the release script now pushes the tag explicitly and, when branch protection rejects the direct main push, opens a release/vX.Y.Z PR so the version bumps land through the normal checks instead of being silently orphaned. Optionally, adding the workflow identity as a branch-protection bypass actor would restore direct pushes; the PR fallback makes that a preference rather than a bug.