[JacobStephens2]

Summary

fresh release
  validate version and tags
  wait while CI on the selected main commit is unfinished
  refuse unless CI succeeded
  create version-bump PR → merge → tag → publish

Closes #765

Evidence

• Before: cargo test --test release an_unfinished_ci_run_on_main_is_watched_before_releasing -- --exact failed with CI on main ... is in_progress, not finished.
  After: the same test passes through merging and tagging. an_unfinished_ci_run_on_main_that_does_not_succeed_pushes_nothing verifies that CI ending in failure, cancellation, timeout, or skip leaves remote refs and PRs unchanged after waiting.
• Full cargo test: 1,944 passed, 2 ignored before upstream reconciliation. Reconciliation retained the same runtime implementation; its fixture, assertion, and manual changes were revalidated below.
• cargo test --test release: 61 passed.
• cargo check --all-targets, cargo clippy --all-targets -- -D warnings, cargo fmt --check, and bash -n scripts/release.sh: passed.
• cd site && npm test: generated manual freshness check and 13 browser tests passed.
• python3 -m unittest discover -s scripts -p 'test_*.py': 1 passed.

Test seams

• scripts/release.sh <version> against a real local git origin and fake GitHub/Harness CLIs: default-branch CI completion gates release publication.

Review coverage

Independent Standards and Spec reviews against main each read all four changed files: scripts/release.sh, tests/release.rs, docs/guide.md, and site/docs/index.html. Both axes reported no findings. Unread changed files: none. Generated-output exclusions: none; both reviewers inspected the generated HTML change.

Unaddressed findings

• Standards: None.
• Spec: None.
• Security: None. Guidance-mode review at ecec64a against pinned merge base b3d2f1ae941dd464f35910d3e617ce2795a53c40 found no introduced security findings; ten sandboxed local CI-gate checks passed.

Security review outcome

No unaddressed introduced findings.

Merge Danger

Door: two-way

Reverting restores immediate refusal for unfinished main CI.

Blast Radius: releases

Fresh release invocations can now wait without an overall timeout for main CI, using the existing polling interval. Publication still requires successful CI on the selected commit.

Built with codex · gpt-6.1-sol · high

CI notes

• Run 39200851428 on b8799b0 was cancelled after the newer ecec64a run started at 04:50:18 UTC, consistent with the unchanged PR concurrency policy: Linux and all four macOS shards report cancellation, the macOS aggregate reports RESULT: cancelled, and all 61 release tests (including both changed tests) had already passed; this branch does not change the CI workflow or the cancelled macOS tests.
• Local validation on ecec64a: full cargo test passed (1,944 passed, 0 failed, 2 existing ignored), including all 61 release tests; macOS execution is unavailable on this Linux host.