[jeffreylouden]

Description

release.yml only runs on a push to main, so nothing tests the release path before a real release does. That's how the checksum bug in #952 reached main: the split sign-and-release job ran sha256sum -c from inside dist/ against lines naming dist/<file>, and the first release failed (fixed in #955).

This PR adds a rehearsal that runs the real steps rather than a copy:

• .github/workflows/release-build.yml (new, workflow_call): the release's build job, moved unchanged. It takes one input, assign-ids, which runs pnpm assign-ids locally first, the same way validate.yml does. A PR's ids land later through assign-ids.yml, and pnpm validate/pnpm build reject an entry without one.
• .github/actions/verify-dist/action.yml (new, composite): the "Verify build output" step, moved unchanged. It's shell only and comes from the same commit as the calling workflow, so sign-and-release still installs nothing and runs nothing from scripts/.
• release.yml: build now calls release-build.yml, and sign-and-release uses the composite for its check. Job names, needs, if, permissions and the artifact are unchanged, and so is everything after the check (minisign, signing, attestation, release).
• .github/workflows/release-dry-run.yml (new): on PRs touching the release workflows, the composite, scripts/** or the dependency manifests, it runs release-build.yml, then a read-only job that downloads the artifact and runs the same check. It references no secret and stops before minisign.

Verification

• actionlint 1.7.7 is clean on release.yml, release-build.yml and release-dry-run.yml.
• Prettier is clean on all four files.
• Locally, pnpm validate, pnpm build and pnpm build:index all pass, and so do the checksums plus the composite's script: dist/catalog.sqlite: OK, dist/catalog-index.json: OK.
• The same check with the pre-fix: iec-c14 on the DB 700, checksum paths in the release job #955 (cd dist && sha256sum -c ...) line fails with FAILED open or read and exits 1. So this dry run would have caught feat(validate): duplicates, ids, connections and the release job (AUREO-1483) #952's bug on the PR.
• This PR touches release.yml, so the dry run runs on it.

Type of Change

• Schema or script change

Checklist

• pnpm validate passes
• No data files touched. No changeset, because this is CI only and should not cut a catalog release.

Additional Notes

The first real test of the release.yml change is the next release after merge. The dry run covers build and the artifact check, but not the uses: wiring of sign-and-release.

Refs AUREO-1483

---

Generated by Claude Code

Summary by CodeRabbit

• Chores
  • Release builds now verify expected build files and checksums before publishing artifacts.
  • Pull requests that affect release workflows or build inputs run a release dry run and validate the generated artifacts.
  • Release build steps are shared between dry runs and releases for consistent validation.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 3f78211

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: existential-engineering/catalog/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 863adfbc-35e1-49ef-92a2-3f074b488d2c

📥 Commits

Reviewing files that changed from the base of the PR and between b1b472f and 3f78211.

📒 Files selected for processing: 4

• .github/actions/verify-dist/action.yml
• .github/workflows/release-build.yml
• .github/workflows/release-dry-run.yml
• .github/workflows/release.yml

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Walkthrough

The release build now runs through a reusable workflow. A shared action checks build output files and checksums. The pull-request dry run and release workflow use these shared components.

Changes

Release build and verification

Layer / File(s)	Summary
Reusable release build .github/workflows/release-build.yml	A callable workflow accepts an optional assign-ids input and runs dependency installation, validation, builds, checksum and SBOM generation, and artifact upload.
Dry-run artifact verification .github/actions/verify-dist/action.yml, .github/workflows/release-dry-run.yml	The verification action checks for the exact expected files and validates the database and catalog index checksums. The pull-request workflow calls the reusable build with ID assignment enabled, downloads its artifact, and runs the verification action.
Release workflow adoption .github/workflows/release.yml	The release workflow calls the reusable build and uses the shared verification action instead of its inline build and output checks. The build job’s existing conditions remain; comments identify the reusable workflow.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 3f782

The pull-request rehearsal and release workflow share the build-output check. No actionable issue remains beyond normal checks.

### Architecture Summary

Architecture risk: 🔵 Low · up to 3f782

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/actions/verify-dist/action.yml: Adds the Verify build output composite action. It compares the sorted contents of dist/ with the exact five-file list; on mismatch, it emits an error, lists the directory, and exits with status 1. Otherwise, it checks the SQLite database and catalog index checksum files from the repository root.
• observed — Modified behavior in .github/workflows/release-build.yml: Adds the callable Release build workflow and its optional boolean assign-ids input, defaulting to false.
• observed — Modified behavior in .github/workflows/release-build.yml: Adds a build job that checks out the repository without persisted credentials, sets up Node.js 24 and pnpm, installs frozen dependencies, conditionally runs pnpm assign-ids, validates and builds the database and web index, generates SHA-256 checksums and an SBOM, and uploads the listed outputs with one-day retention, failing if no files are found.
• observed — Modified behavior in .github/workflows/release-dry-run.yml: Adds a pull-request workflow targeting main for changes to listed release and build inputs. It runs the reusable build with assign-ids: true, then checks out without persisted credentials, downloads the catalog-dist artifact into dist, and invokes verify-dist. Runs are grouped by workflow and ref with in-progress runs canceled; permissions are read-only for contents.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: running a release build dry run on pull requests.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}