[HarryCordewener]

Requested by Grave · project thread

Workstream P3 of the 1.0 readiness plan (audit-packages.md §8: nothing creates release tags, most packages have none, CI only checks engine main).

What changes

• Version bump check (checks job, pull requests only). tools/release/packages.py check-bumps fails a PR that changes any file in a package directory (renames counted on both sides) without raising that package's version above the merge base's, or whose new version is already tagged. New packages pass. Versions compare as the engine's PackageVersion does (SemVer 2 prerelease order).
• Release job (push to main and workflow_dispatch, after validate and checks). pending-tags lists every package version on main with no <dir>/v<version> tag, tagged at the last commit that touched the directory; the job creates annotated tags and pushes them in one --atomic push with GITHUB_TOKEN (contents: write). If a tagged version's directory changed later without a bump (for example two PRs raised the same package to the same version), the job still pushes the other tags, then fails with an error naming the package.
• Engine refs matrix. validate runs against SharpMUSH main (or vars.SHARPMUSH_REF) and, once one exists, SharpMUSH's latest vX.Y.Z tag. There is none today, so only main runs until v1.0.0 is tagged.
• README: "Repo structure & releases" and "Contributing a package" describe the CI flow.

Read before merging

• Merging creates 73 tags at once (Grave approved this on the plan thread): every package without a tag for its current version. roll-tables/v1.0.0 already matches; pf2e-remaster gets v1.6.3. The protect-release-tags ruleset blocks moving or deleting them afterwards. It has no creation rule, so GITHUB_TOKEN can push them; no secret is needed.
• The job name changes from validate to validate (SharpMUSH main). If classic branch protection requires the old name, update the required check.

Testing

• check-bumps b42fdc6~1 b42fdc6 fails on pf2e (subcategory edit without a bump); a README-only change fails; a file moved from one package into another fails for the package it left.
• Release step against a local bare clone: 73 annotated tags pushed, a second run prints "No new package versions."; with drift in one package and a bump in another, it pushes the bump's tag and exits 1.
• Independent review, two rounds: the first found 5 non-blocking issues (fixed: --no-renames, --atomic, pipefail, drift as error, ASCII digits); the second found none.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Rqqt7UboEPqDhRV5S7thiu

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 3 billable files and costs up to $0.75.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 8 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 60 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Essentials
• Run ID: dc8cb7f6-d12c-4d6b-9329-3f597585fdad

Commits

Reviewing files that changed from the base of the PR and between e577d91 and 078f101.

Files selected for processing: 3

• .github/workflows/validate.yml
• README.md
• tools/release/packages.py

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts