feat(ci): automate TypeScript SDK release

[fuller]

Summary

• Detect merged TypeScript SDK version bumps and create an annotated typescript-sdk-v<version> tag on the exact merge commit.
• Build, test, and publish the tagged artifact in dependent jobs in the same workflow.
• Keep release-control checks and npm environment approval in the release path.

Why

A version bump in packages/sdk-typescript/package.json is the release signal. A version-bump PR may include SDK source or dependency changes; the generated tag points to the exact merged commit, which is then built, tested, and published.

Release flow

1. A merged PR touching packages/sdk-typescript/package.json starts Tag and Publish TypeScript SDK.
2. The tag job reads package metadata from merge_commit_sha, validates the version bump and lockfile, and creates typescript-sdk-v<version>.
3. The dependent jobs verify the tag, build/test the exact merge commit, run release-control preflight, and publish the artifact after npm environment approval.

The tag remains the immutable release marker. Because it is created with GITHUB_TOKEN, it intentionally does not start a second workflow; publishing is a dependent job in this same workflow. No manual workflow trigger or downstream workflow dispatch is required.

Required repository configuration

• Allow the GitHub Actions actor/integration to bypass creation/update/deletion of the protected typescript-sdk-v* tag ruleset. The current ruleset has user bypass actors only, so this must be updated before the workflow can create the tag.
• Keep the npm environment configured with required reviewers and prevent self-review.
• Keep npm Trusted Publishing configured for repository gemini/developer-platform, workflow filename publish-typescript-sdk.yml, environment npm, and npm publish.

No GitHub App credentials or SDK_RELEASE_TAG_RULESET_READY variable are required.

Validation

• Parsed the workflow YAML with yq.
• Syntax-checked all embedded Node scripts and shell blocks.
• Verified the workflow has no stale tag-event, App-token, or explicit chaining references.
• Verified the current SDK package and lockfile metadata and the version-diff guard.
• No SDK runtime tests were run because this is workflow-only code.

[nostradamus-bot]

Nostradamus Risk Rating — Medium

This PR introduces a pull_request_target-triggered workflow that mints a GitHub App installation token with Contents: write access to auto-tag SDK releases, and requires adding the App as a bypass actor on the protected typescript-sdk-v* tag ruleset — a new privileged automation path controlling the npm publish pipeline for @gemini-markets/sdk. Risk is substantially mitigated by SHA-pinned actions, strict input validation on all PR event data (SHA format, numeric PR number, semver pattern), the merged == true guard preventing triggering on fork PRs, and publish workflow hardening that verifies commit alignment and rejects force-pushed or lightweight tags.

[sdlc-pr-bot]

Change Control Evidence Check

Authorization — ❌ Fail

Evidence:

• Linear ticket: ⚠️ No ticket linked
• Change owner: Andrew Fuller
• Type of change: Normal

Testing — ⚠️ Incomplete

Evidence:

• Tests from CI checks: ➖ No tests ran
• Security scans: ⚠️ Not configured — Semgrep OSS, scan_for_secrets, Scan with Semgrep, Socket Security: Pull Request Alerts not found
• Testing summary: ✅ Found in PR description
  • Summary: Workflow YAML syntax and configuration were validated using yq, with embedded Node scripts and shell blocks checked and no stale references or version inconsistencies identified. SDK runtime tests were not performed as the code is workflow-only.
• Evidence link: View run

Approval — ⏳ Awaiting approval

Evidence:
(no approvers yet)

Segregation of Duties — ⏳ Awaiting approval

Validated:

• PR author: Andrew Fuller

---

Last checked: 2026-08-31 13:58 UTC

↩ Re-run Clarissa if tickets, CI, or approvals have changed.