gates: publish-check (deno publish --dry-run); release: JSR publish before the GH release

.github/justfile

@@ -56,6 +56,7 @@ core:
     @just gha::_step test-wasi-shims
     @just gha::_step test-ct-runner
     @just gha::_step test-bundle
+    @just gha::_step publish-check
     @just gha::_step examples
     @just gha::_step test-translate
     @just gha::_step conformance

.github/workflows/release.yml

@@ -59,6 +59,41 @@ jobs:
         # bundle_test.ts in the core matrix), and SHA256SUMS.
         run: just release-artifacts
 
+      - name: publish unstable prereleases to JSR
+        # Version scheme (issue #16, interim): 0.1.0-pre.g<shorthash> —
+        # correlates 1:1 with this run's `pre-<shorthash>` release tag. The
+        # `g` prefix (git-describe's convention) is load-bearing: a bare
+        # short hash can be all-digits-with-leading-zero, which is INVALID
+        # semver (numeric identifiers forbid leading zeros) and would fail
+        # ~0.4% of publishes at random. Hash versions are unique per commit
+        # (JSR refuses duplicates, making re-runs no-ops-by-failure like
+        # the tag guard) but deliberately NOT monotonic under semver
+        # ordering: unstable prereleases are pinned exactly, never ranged.
+        # The stamped versions are CI-working-tree-only (never committed);
+        # cross-package workspace deps are rewritten by `deno publish`.
+        # Auth: OIDC (permissions.id-token) — the @deltic packages must
+        # exist on jsr.io and be linked to this repository (one-time
+        # manual setup; see the #16 checklist). The scope's "actor must be
+        # a scope member" restriction is OFF: merges armed by the machine
+        # account make the workflow actor `lannbot`, which broke the
+        # publish (actorNotScopeMember) until the setting was disabled.
+        # Runs BEFORE the GitHub release: it is the step most likely to
+        # fail, and ordering it first keeps partial failures re-runnable —
+        # a re-run passes the tag guard (no release yet) and `deno
+        # publish` skips already-published versions, so it converges
+        # instead of stranding a release that claims unpublished JSR
+        # versions.
+        run: |
+          VERSION="0.1.0-pre.g${SHORT}"
+          echo "publishing @deltic/* ${VERSION}"
+          for p in runtime translator wasi-shims ct-runner; do
+            jq --arg v "$VERSION" '.version = $v' "$p/deno.json" > "$p/deno.json.tmp"
+            mv "$p/deno.json.tmp" "$p/deno.json"
+          done
+          deno publish --allow-dirty
+        env:
+          SHORT: ${{ steps.tag.outputs.short }}
+
       - name: create prerelease
         run: |
           {
@@ -88,29 +123,3 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ steps.tag.outputs.tag }}
-
-      - name: publish unstable prereleases to JSR
-        # Version scheme (issue #16, interim): 0.1.0-pre.g<shorthash> —
-        # correlates 1:1 with this run's `pre-<shorthash>` release tag. The
-        # `g` prefix (git-describe's convention) is load-bearing: a bare
-        # short hash can be all-digits-with-leading-zero, which is INVALID
-        # semver (numeric identifiers forbid leading zeros) and would fail
-        # ~0.4% of publishes at random. Hash versions are unique per commit
-        # (JSR refuses duplicates, making re-runs no-ops-by-failure like
-        # the tag guard) but deliberately NOT monotonic under semver
-        # ordering: unstable prereleases are pinned exactly, never ranged.
-        # The stamped versions are CI-working-tree-only (never committed);
-        # cross-package workspace deps are rewritten by `deno publish`.
-        # Auth: OIDC (permissions.id-token) — the @deltic packages must
-        # exist on jsr.io and be linked to this repository (one-time
-        # manual setup; see the #16 checklist).
-        run: |
-          VERSION="0.1.0-pre.g${SHORT}"
-          echo "publishing @deltic/* ${VERSION}"
-          for p in runtime translator wasi-shims ct-runner; do
-            jq --arg v "$VERSION" '.version = $v' "$p/deno.json" > "$p/deno.json.tmp"
-            mv "$p/deno.json.tmp" "$p/deno.json"
-          done
-          deno publish --allow-dirty
-        env:
-          SHORT: ${{ steps.tag.outputs.short }}

AGENTS.md

@@ -38,6 +38,8 @@ just test-runtime         # runtime check + tests (deps: shim, fixtures, corpus)
 just test-protocol
 just test-wasi-shims test-ct-runner
 just test-bundle          # embedder-bundle release asset
+just publish-check        # deno publish --dry-run: the JSR publish checks, no upload
+just examples test-translate  # embedder examples; build-time translation CLI
 just conformance          # official CM suite, Deno lane
 just sched-seeds          # seeded-shuffle reruns: DELTIC_SCHED_SEED=1, =4242 (FIFO when unset)
 just test-ports           # ports/webcrypto + ports/websocket unit suites

justfile

@@ -16,7 +16,7 @@ ci: (gha::core) (gha::browser)
 # Includes the consumer smokes CI cannot run (they need the polymorph
 # checkouts; docs/consumers.md).
 # The full pre-commit pass (AGENTS.md "Gates"): everything.
-gates: build test-rust test-protocol test-runtime test-wasi-shims test-ct-runner test-bundle examples test-translate conformance sched-seeds test-ports test-webrtc shells browsers websocket-conformance smoke-tls smoke-c0
+gates: build test-rust test-protocol test-runtime test-wasi-shims test-ct-runner test-bundle publish-check examples test-translate conformance sched-seeds test-ports test-webrtc shells browsers websocket-conformance smoke-tls smoke-c0
 
 # Fast sanity: builds + native tests + type-checks, no suites.
 check: build test-rust
@@ -100,6 +100,18 @@ test-ct-runner: shim fixtures
 test-bundle: shim
     deno test -A tools/release-bundle/
 
+# The JSR publish checks (public-API type check, slow types, export and
+# import analyzability, config validation) — `deno task check` covers
+# none of them, so they only fired at publish time on main before this
+# gate. Needs the shim: @deltic/translator ships translator_shim.wasm
+# (statically imported by shim_asset_deno.ts). Registry-side failures
+# (scope auth, version conflicts) still only manifest on a real publish.
+# --allow-dirty because this is a PRE-commit gate (the dirty check
+# protects uploads; there is no upload here).
+# JSR publish verification, no upload (`deno publish --dry-run`).
+publish-check: shim
+    deno publish --dry-run --allow-dirty
+
 # The harness task chains corpus generation and the shim check itself.
 # The official CM conformance suite, Deno lane.
 conformance: