fix(release): preserve merge approvals and exclude native binaries from npm

[aidandaly24]

Description

Preserve the existing release flow: dispatch prepare, review and merge the release PR, then verify and publish the exact merged commit.

• Move release-prepare.yml to the approved aws-release-4-core runner.
• Trigger release-publish.yml on pushes to refactor, and proceed only when the pushed SHA matches a merged release/v* PR opened by agentcore-devx-automation[bot] (account ID 282717993) from the same repository into that branch. Skip manually authored release PRs, unrelated pushes, ordinary PRs, and fork PRs; fail closed if the GitHub API request fails. Pin the author's account ID so a login rename does not change the identity check.
• Keep both the check-release and publish jobs on ubuntu-latest. Moving this workflow to the dedicated pool remains a separate change after allowlisting. Verification runners are unchanged.
• Follow main's include/exclude packaging pattern with "files": ["dist", "!dist/bin"]. Keep the generated bundle, runtime assets, and any additional build chunks, while excluding standalone native binaries. Do not add main's legacy scripts, shrinkwrap, or MCP-harness entries.
• Document the release flow.

The packaging regression reproduced with one compiled Linux binary: 40.37 MB before, 1.44 MB after. The current build's package contains 89 files, preserving all 87 non-binary dist files. A fresh workflow already packed before compilation; the fix also excludes native binaries during manual packing and in reused build directories. Other dist outputs remain included.

No companion main change is needed: its release-prepare.yml is only the dispatch placeholder, and its existing release workflows already use the dedicated runner.

Related Issue

Closes #2258

Follow-up to #2206 and #2052.

Documentation PR

Not applicable. Release documentation is updated in .github/workflows/README.md.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe): release workflow configuration

Testing

The refactor branch uses Bun rather than the default branch's separate npm unit/integration scripts.

• bun test (existing repository test suite).
• bun run typecheck
• bun run lint:check
• bun run format:check
• bun run build
• bun run compile:linux-x64, plus Node-bundle and native-binary --help smoke tests.
• Actionlint validation, with the organization's custom runner label declared in a temporary local config.
• Local execution of the actual release-gate shell block against 14 cases, including the real release PR response, manual authors, matching bot names with a different ID, account renames, forks, incorrect branches/SHAs, unmerged PRs, pagination, and API errors.
• Actual Bun tarball inspection and npm pack --dry-run --ignore-scripts --json, with a native binary present.
• Bun and npm compatibility checks in a temporary package: nested dist/bin files are excluded, while additional JS chunks and worker files remain included.

The release-gate and packaging checks were exercised locally; no new test scripts are included in this PR.

No release workflow was dispatched, no npm package was published, and no release artifacts were uploaded for validation.

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works (no new test files included)
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published (no prerequisite code changes; publishing remains on shared runners)

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

Nice hardening pass on the release pipeline. The switch from pull_request: closed to a push-triggered flow with a check-release gate that re-verifies the merged PR against the pushed SHA (same repo head/base, release/v* head ref, merged, correct target branch) is a solid tightening, and the shell-level tests exercising each rejection case (fork, unmerged, wrong branch, wrong commit, deleted fork with null head.repo, empty PR list, API failure) give me confidence the gate fails closed.

A few things I checked and think are fine:

• set -euo pipefail plus command substitution around a gh api | jq pipeline correctly propagates gh failures — the check-release step fails, verify/publish are skipped.
• The narrowed files allowlist (dist/index.js, dist/main.js, dist/assets) keeps dist/bin/* and source maps out of the npm tarball while still shipping README/LICENSE (which npm always includes). The package.test.ts fixture directly validates this against bun pm pack, which is a much better guarantee than eyeballing globs.
• github.event.deleted guard on check-release prevents branch-delete events from running the flow.
• Using github.sha throughout verify and publish means later pushes can't retarget the release, which was the point.

No blocking issues found; ship it.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.04%. Comparing base (4fe2c10) to head (a0a1198).

Additional details and impacted files

@@            Coverage Diff            @@
##           refactor    #2259   +/-   ##
=========================================
  Coverage     97.04%   97.04%           
=========================================
  Files           566      566           
  Lines         39353    39353           
=========================================
  Hits          38190    38190           
  Misses         1163     1163           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[Hweinstock]

so one we get allowlisted we can swap this to codebuild as well?