ci: block premature release PR merges

.github/workflows/npm-publish.yml

@@ -116,11 +116,17 @@ jobs:
           DISPATCH_TAG: ${{ inputs.tag }}
           DISPATCH_SHA: ${{ inputs.sha }}
           RELEASE_PR_ACTORS: ${{ vars.RELEASE_PR_ACTORS || 'github-actions[bot]' }}
+          NPM_BOOTSTRAP_ENABLED: ${{ vars.NPM_BOOTSTRAP_ENABLED }}
+          NPM_TRUSTED_PUBLISHING_READY: ${{ vars.NPM_TRUSTED_PUBLISHING_READY }}
+          RELEASE_TAG_POLICY_READY: ${{ vars.RELEASE_TAG_POLICY_READY }}
           NPM_CONFIG_PROVENANCE: true
           NPM_CONFIG_USERCONFIG: /dev/null
         shell: bash
         run: |
           set -euo pipefail
+          [[ "$NPM_BOOTSTRAP_ENABLED" == false ]]
+          [[ "$NPM_TRUSTED_PUBLISHING_READY" == true ]]
+          [[ "$RELEASE_TAG_POLICY_READY" == true ]]
           TAG=${GITHUB_REF#refs/tags/}
           SHA=$GITHUB_SHA
           [[ "$GITHUB_REF" == "refs/tags/$TAG" ]]

.github/workflows/release-readiness.yml

@@ -0,0 +1,45 @@
+name: Release readiness
+
+on:
+  pull_request_target:
+    branches: [main]
+    types: [opened, synchronize, reopened, edited, labeled, unlabeled, ready_for_review]
+
+concurrency:
+  group: release-pr-readiness-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  release-pr-readiness:
+    name: Release PR readiness
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          package-manager-cache: false
+      - name: Evaluate only default-branch release policy against PR metadata
+        env:
+          RELEASE_PR_ACTORS: ${{ vars.RELEASE_PR_ACTORS || 'github-actions[bot]' }}
+          NPM_BOOTSTRAP_ENABLED: ${{ vars.NPM_BOOTSTRAP_ENABLED }}
+          NPM_TRUSTED_PUBLISHING_READY: ${{ vars.NPM_TRUSTED_PUBLISHING_READY }}
+          RELEASE_TAG_POLICY_READY: ${{ vars.RELEASE_TAG_POLICY_READY }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          node tools/release/release-pr-readiness.mjs \
+            --event "$GITHUB_EVENT_PATH" \
+            --contract docs/release/npm-integrity-contract.json \
+            --repository "$GITHUB_REPOSITORY" \
+            --release-pr-actors "$RELEASE_PR_ACTORS" \
+            --npm-bootstrap-enabled "$NPM_BOOTSTRAP_ENABLED" \
+            --npm-trusted-publishing-ready "$NPM_TRUSTED_PUBLISHING_READY" \
+            --release-tag-policy-ready "$RELEASE_TAG_POLICY_READY"

.github/workflows/release.yml

@@ -162,12 +162,14 @@ jobs:
           DISPATCH_TAG: ${{ inputs.tag }}
           NPM_BOOTSTRAP_ENABLED: ${{ vars.NPM_BOOTSTRAP_ENABLED }}
           NPM_TRUSTED_PUBLISHING_READY: ${{ vars.NPM_TRUSTED_PUBLISHING_READY }}
+          RELEASE_TAG_POLICY_READY: ${{ vars.RELEASE_TAG_POLICY_READY }}
           RELEASE_PR_ACTORS: ${{ vars.RELEASE_PR_ACTORS || 'github-actions[bot]' }}
         shell: bash
         run: |
           set -euo pipefail
-          [[ "$NPM_BOOTSTRAP_ENABLED" != true ]]
+          [[ "$NPM_BOOTSTRAP_ENABLED" == false ]]
           [[ "$NPM_TRUSTED_PUBLISHING_READY" == true ]]
+          [[ "$RELEASE_TAG_POLICY_READY" == true ]]
           if [[ "$EVENT_NAME" == workflow_run ]]; then
             CONCLUSION=$(jq -r '.workflow_run.conclusion' "$GITHUB_EVENT_PATH")
             RUN_EVENT=$(jq -r '.workflow_run.event' "$GITHUB_EVENT_PATH")
@@ -299,21 +301,12 @@ jobs:
 
           INTEGRITY_CONTRACT=docs/release/npm-integrity-contract.json
           test -f "$INTEGRITY_CONTRACT"
-          jq -e '
-            .schemaVersion == 1 and
-            .package == "scriptspect" and
-            (.bootstrapVersion | test("^0\\.0\\.0-bootstrap\\.[0-9]+$")) and
-            (.sourceCommit | test("^[0-9a-f]{40}$")) and
-            (.integrityMode == "exact-bytes" or .integrityMode == "canonical-tree-v1") and
-            .comparatorAlgorithm == "scriptspect-canonical-tree/v1" and
-            (.comparatorAlgorithmDigest | test("^[0-9a-f]{64}$")) and
-            .latestUnchanged == true and
-            (.reviewedAt | test("^[0-9]{4}-[0-9]{2}-[0-9]{2}T"))
-          ' "$INTEGRITY_CONTRACT" >/dev/null
-          INTEGRITY_MODE=$(jq -er '.integrityMode' "$INTEGRITY_CONTRACT")
+          node tools/release/verify-package-integrity.mjs \
+            --contract-only "$INTEGRITY_CONTRACT" \
+            > "$RUNNER_TEMP/verified-integrity-contract.json"
+          INTEGRITY_MODE=$(jq -er '.integrityMode' "$RUNNER_TEMP/verified-integrity-contract.json")
           INTEGRITY_CONTRACT_HASH=$(sha256sum "$INTEGRITY_CONTRACT" | cut -d' ' -f1)
-          COMPARATOR_ALGORITHM_DIGEST=$(jq -er '.comparatorAlgorithmDigest' "$INTEGRITY_CONTRACT")
-          [[ "$COMPARATOR_ALGORITHM_DIGEST" == "$(node tools/release/canonical-tree.mjs algorithm-digest | jq -er '.algorithmDigest')" ]]
+          COMPARATOR_ALGORITHM_DIGEST=$(jq -er '.comparatorAlgorithmDigest' "$RUNNER_TEMP/verified-integrity-contract.json")
 
           {
             echo "intent-id=$INTENT_ID"