fix(release): rehearse production paths before release

.github/scripts/ci_changes.py

@@ -186,6 +186,7 @@
         ".github/workflows/release-candidate.yml",
         ".github/workflows/release-repeatability.yml",
         ".github/workflows/release-candidate-cleanup.yml",
+        ".github/workflows/release-rehearsal.yml",
     }
 )
 REPO_ROOT = Path(__file__).resolve().parents[2]

.github/workflows/ci.yml

@@ -305,7 +305,7 @@ jobs:
 
       - name: Upload fuzz failures
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: platform-fuzz-${{ matrix.target }}
           path: products/platform/fuzz/artifacts/${{ matrix.target }}/
@@ -598,6 +598,9 @@ jobs:
       - name: Test release candidate manifest and promotion verifier
         run: python3 -m unittest release/scripts/test_release_candidate.py
 
+      - name: Test public release verifier
+        run: python3 -m unittest release/scripts/test_verify_public_release.py
+
       - name: Test release storage preflight
         run: python3 -m unittest release/scripts/test_check_release_storage.py
 
@@ -607,6 +610,9 @@ jobs:
       - name: Test release repeatability workflow
         run: python3 -m unittest release/scripts/test_release_repeatability_workflow.py
 
+      - name: Test release rehearsal workflow
+        run: python3 -m unittest release/scripts/test_release_rehearsal.py
+
       - name: Test release workflow structure
         run: python3 -m unittest release/scripts/test_release_workflow_structure.py
 
@@ -855,9 +861,9 @@ jobs:
         working-directory: docs/site
         run: npm test
 
-      - name: Check docs build
+      - name: Check production-shaped docs build
         working-directory: docs/site
-        run: npm run check
+        run: npm run check:production
 
   docs-required:
     # Branch protection requires this exact context. Keep it successful for

.github/workflows/docs-pages.yml

@@ -168,12 +168,7 @@ jobs:
 
       - name: Build protected main at /dev/
         working-directory: docs/site
-        run: |
-          set -euo pipefail
-          npm run generate
-          DOCS_DOCSET=latest DOCS_BASE=/dev/ npx astro check
-          DOCS_DOCSET=latest DOCS_BASE=/dev/ npx astro build --outDir dist/dev
-          node scripts/apply-archive-seo.mjs dist/dev
+        run: npm run build:dev
         env:
           DOCS_RELEASED_TAG: ${{ steps.release.outputs.released_tag }}
           PUBLIC_UMAMI_WEBSITE_ID: ${{ vars.PUBLIC_UMAMI_WEBSITE_ID }}

.github/workflows/evidence-dev.yml

@@ -188,7 +188,7 @@ jobs:
           done
 
       - name: Upload native Evidence development binaries
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: evidence-dev-${{ matrix.asset }}-${{ github.run_id }}-${{ github.run_attempt }}
           path: development-platform
@@ -482,7 +482,7 @@ jobs:
           node smoke.js
 
       - name: Upload Evidence development client packages
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: evidence-dev-clients-${{ matrix.asset }}-${{ github.run_id }}-${{ github.run_attempt }}
           path: development-clients
@@ -510,7 +510,7 @@ jobs:
           submodules: false
 
       - name: Download exact native binaries and client packages
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: evidence-dev-*-${{ github.run_id }}-${{ github.run_attempt }}
           path: development-inputs
@@ -577,7 +577,7 @@ jobs:
           done
 
       - name: Upload exact Evidence development assets
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: evidence-dev-assets-${{ github.run_id }}-${{ github.run_attempt }}
           path: development-assets
@@ -596,7 +596,7 @@ jobs:
       contents: write
     steps:
       - name: Download exact assembled development assets
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: evidence-dev-assets-${{ github.run_id }}-${{ github.run_attempt }}
           path: development-assets

.github/workflows/nightly-rust-coverage.yml

@@ -154,7 +154,7 @@ jobs:
             --output-path "${coverage_dir}/${{ matrix.name }}.lcov"
 
       - name: Upload shard coverage artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: nightly-rust-${{ matrix.name }}-coverage
           path: target/nightly-rust-coverage/coverage/${{ matrix.name }}.lcov

.github/workflows/nightly-security.yml

@@ -188,7 +188,7 @@ jobs:
 
       - name: Upload platform fuzz artifacts
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: nightly-platform-fuzz-artifacts
           path: products/platform/fuzz/artifacts
@@ -238,7 +238,7 @@ jobs:
 
       - name: Upload manifest fuzz artifacts
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: nightly-manifest-fuzz-artifacts
           path: products/manifest/fuzz/artifacts

.github/workflows/release-canary.yml

@@ -294,7 +294,7 @@ jobs:
           test -s canary/provenance-subjects.sha256
 
       - name: Upload canary candidate
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-canary-${{ github.run_id }}-${{ github.run_attempt }}
           path: |
@@ -311,7 +311,7 @@ jobs:
             canary/registry-stack-v1.2.3-candidate.tar.gz
 
       - name: Download and authenticate canary candidate
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: release-canary-${{ github.run_id }}-${{ github.run_attempt }}
           path: canary/downloaded

.github/workflows/release-candidate-cleanup.yml

@@ -71,7 +71,7 @@ jobs:
 
       - name: Upload cleanup receipt
         if: ${{ always() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-candidate-cleanup-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/release-candidate-cleanup.json

.github/workflows/release-candidate.yml

@@ -1,4 +1,5 @@
 name: RegistryStack Release Candidate
+run-name: Release candidate ${{ github.event.client_payload.release_id }} v${{ github.event.client_payload.version }} (${{ github.event.client_payload.request_id }})
 
 on:
   repository_dispatch:
@@ -60,6 +61,7 @@ jobs:
           REQUEST_VERSION: ${{ github.event.client_payload.version }}
           REQUEST_RELEASE_ID: ${{ github.event.client_payload.release_id }}
           REQUEST_SOURCE_SHA: ${{ github.event.client_payload.source_sha }}
+          REQUEST_ID: ${{ github.event.client_payload.request_id }}
         shell: bash
         run: |
           set -euo pipefail
@@ -81,6 +83,10 @@ jobs:
             echo "release_id is invalid" >&2
             exit 1
           fi
+          if [[ ! "${REQUEST_ID}" =~ ^[0-9a-f]{32}$ ]]; then
+            echo "request_id is invalid" >&2
+            exit 1
+          fi
           if [[ ! "${REQUEST_SOURCE_SHA}" =~ ^[0-9a-f]{40}$ ]]; then
             echo "source_sha must be one exact commit" >&2
             exit 1
@@ -331,7 +337,7 @@ jobs:
             candidate-canonical/
 
       - name: Upload canonical build products
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: candidate-canonical-${{ github.run_id }}-${{ github.run_attempt }}
           path: candidate-canonical
@@ -392,7 +398,7 @@ jobs:
           mv platform candidate-platform/platform
 
       - name: Upload native platform payload
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: candidate-${{ matrix.asset }}-${{ github.run_id }}-${{ github.run_attempt }}
           path: candidate-platform
@@ -558,7 +564,7 @@ jobs:
           done
 
       - name: Upload native client packages
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: candidate-clients-${{ matrix.asset }}-${{ github.run_id }}-${{ github.run_attempt }}
           path: candidate-client-package
@@ -588,7 +594,7 @@ jobs:
           submodules: false
 
       - name: Download exact build products
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: candidate-*-${{ github.run_id }}-${{ github.run_attempt }}
           path: inputs
@@ -1073,7 +1079,7 @@ jobs:
             --output candidate/release-candidate-manifest.json
 
       - name: Upload one candidate manifest and bundle
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: registry-stack-release-candidate-${{ github.run_id }}-${{ github.run_attempt }}
           path: |
@@ -1104,7 +1110,7 @@ jobs:
           submodules: false
 
       - name: Download compact candidate
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: registry-stack-release-candidate-${{ github.run_id }}-${{ github.run_attempt }}
           path: candidate

.github/workflows/release-rehearsal.yml

@@ -0,0 +1,65 @@
+name: Rehearse RegistryStack Release
+run-name: Rehearse ${{ inputs.release_id }} v${{ inputs.version }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Prepared canonical semantic version without the v prefix
+        required: true
+        type: string
+      release_id:
+        description: Prepared release train identity
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  rehearse:
+    name: Exercise future-tag release paths on Ubuntu
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Require a branch rehearsal
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ "${GITHUB_REF}" != refs/heads/* ]]; then
+            echo "release rehearsal must run from a prepared branch" >&2
+            exit 1
+          fi
+
+      - name: Checkout prepared branch
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4.2.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          submodules: false
+
+      - name: Refresh protected-main comparison ref
+        run: >-
+          git fetch --no-tags --force origin
+          refs/heads/main:refs/remotes/origin/main
+
+      - name: Setup Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v4.4.0
+        with:
+          node-version: 22.12.0
+          cache: npm
+          cache-dependency-path: docs/site/package-lock.json
+
+      - name: Install exact docs dependencies
+        working-directory: docs/site
+        run: npm ci
+
+      - name: Rehearse prepared release without publishing
+        env:
+          REHEARSAL_VERSION: ${{ inputs.version }}
+          REHEARSAL_RELEASE_ID: ${{ inputs.release_id }}
+        run: >-
+          release/scripts/rehearse-release
+          --version "${REHEARSAL_VERSION}"
+          --release-id "${REHEARSAL_RELEASE_ID}"
+          --base-ref origin/main

.github/workflows/release-repeatability.yml

@@ -297,7 +297,7 @@ jobs:
             }' > proof/release-repeatability-result.json
 
       - name: Upload 30-day repeatability evidence
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-repeatability-${{ steps.release.outputs.tag }}-${{ github.run_id }}-${{ github.run_attempt }}
           path: |

.github/workflows/release.yml

@@ -266,7 +266,7 @@ jobs:
           fi
 
       - name: Upload verified promotion input
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-promotion-input-${{ github.run_id }}
           path: promotion/candidate
@@ -301,7 +301,7 @@ jobs:
           submodules: false
 
       - name: Download verified promotion input
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: release-promotion-input-${{ github.run_id }}
           path: promotion
@@ -483,7 +483,7 @@ jobs:
           cp "${RUNNER_TEMP}/staged-draft.json" contract/draft-release.json
 
       - name: Upload draft reconciliation contract
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-draft-contract-${{ github.run_id }}
           path: contract
@@ -512,13 +512,13 @@ jobs:
           submodules: false
 
       - name: Download verified candidate and draft contract
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: release-*-input-${{ github.run_id }}
           path: inputs
 
       - name: Download exact draft contract
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: release-draft-contract-${{ github.run_id }}
           path: contract
@@ -675,13 +675,13 @@ jobs:
           submodules: false
 
       - name: Download exact candidate and staged draft contract
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: release-*-input-${{ github.run_id }}
           path: inputs
 
       - name: Download exact staged draft contract
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: release-draft-contract-${{ github.run_id }}
           path: contract
@@ -857,7 +857,7 @@ jobs:
             | jq -s 'sort_by(.name)' > contract/final-assets.json
 
       - name: Upload final reconciliation contract
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-final-contract-${{ github.run_id }}
           path: contract
@@ -879,13 +879,13 @@ jobs:
       contents: write
     steps:
       - name: Download exact candidate manifest
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: release-promotion-input-${{ github.run_id }}
           path: promotion
 
       - name: Download exact final contract
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: release-final-contract-${{ github.run_id }}
           path: contract