fix(ci): create the pack destination before npm pack in the release workflow

[PrzemekGalarowicz]

What this changes

publish.yml's build job ran npm pack --pack-destination "$RUNNER_TEMP/pkg" without creating pkg/. npm does not create the destination directory: this fails with ENOENT on npm 10.9.7 and 11.20.0 (reproduced locally). So every Release run would have failed at Pack, and the publish job would never have run.

The bug came in with the build/publish split (#201). PR CI never caught it because publish.yml only runs on a published Release.

• .github/workflows/publish.yml: the Pack step now runs mkdir -p "$RUNNER_TEMP/pkg" before npm pack.
• .dev/floor/check-run-pins.test.mjs: new live test. It checks that every npm pack --pack-destination directory in every workflow is either the runner temp root or created by a mkdir -p earlier in the same job. A mkdir in another job runs on a different runner, so it doesn't count. The test also folds together the different spellings of the runner temp dir ($RUNNER_TEMP, ${RUNNER_TEMP}, ${{ runner.temp }}) and ignores quoting. A positive control deletes the mkdir line from the live publish.yml text and checks that the test flags it. floor.yml runs this file on every PR.
• CHANGELOG.md: [Unreleased] → Fixed.
• .dev/features/publish-pack-destination/: the pharn-dev-ship artifacts (plan, grill, regression and verify reports, review, ship roll-up).

This is the first of four fixes from the review of the last 18 commits on main. The next three will come as separate PRs.

Type of change

• feat — new stack option, wizard step, or command capability
• fix — bug fix
• docs — docs-only change
• chore / refactor — tooling or internal restructure, no behavior change

Area(s) touched

repo tooling (release workflow + floor test), CHANGELOG

Checklist

• Read the existing file(s) before editing; followed the ESM .js-extension import convention.
• Updated the matching tests (the new pin lives beside PHARN-07's other live publish.yml pins).
• Updated the relevant docs: no docs/ change needed. docs/RELEASING.md already describes the pack → smoke → upload flow this change makes work.
• Security invariants untouched: no remote-input handling changed.

Quality gates

• npm run check passes locally (format:check + lint + typecheck + test).
• npm run build succeeds.
• npm run test:coverage passes (coverage thresholds met).

Floor workflow tests: 754/754 passed. validate.mjs: GREEN. Pharn-dev verdicts: regress no-regressions, verify PASS, review GREEN (3 minor advisory findings).

The sandbox runs as root, so I ran the gates as root with the permission-override capabilities (CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH, CAP_FOWNER) dropped, and with the proxy variables unset. That matches CI. Under plain root, 4 existing chmod-based tests in update.test.ts fail; they fail the same way on main.

Notes for the reviewer

• Before the change, the new test fails against the base publish.yml; after the change it passes. I checked both.
• The first real Release is still the only end-to-end test of publish.yml. The upload-artifact/download-artifact SHAs pinned in ci(publish): keep the dev toolchain out of the job that can mint the npm OIDC token (PHARN-07) #201 remain unverified from this environment.

🤖 Generated with Claude Code

https://claude.ai/code/session_0199owRmYfskqYQVQrVP679o

---

Generated by Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 33f85f24-81a7-4a63-980c-c4c0d1a73d92

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}