[codex-security] cut npm releases only after public CI succeeds

[soyeon-oai]

Summary

• Keep npm release orchestration in the public repository.
• Start the release cut only after node-ci succeeds on main, while preserving manual dispatch.
• Check out and tag the exact successful CI commit and preserve existing release safety checks.
• Add public Bun regressions for the workflow trigger and exact release commit.

Testing

• bun test sdk/typescript/tests-ts/release-cut-workflow.test.ts
• YAML parsing and workflow trigger assertions

[chatgpt-codex-connector]

💡 Codex Review

codex-security/.github/workflows/node-release-cut.yml

Lines 83 to 86 in 3b1144b

	if [[ "$version" == "$previous_version" ]]; then
	echo "Package version is unchanged; no release is needed."
	echo "changed=false" >> "$GITHUB_OUTPUT"
	exit 0

Don't skip an unpublished version after a follow-up fix

When a version-bump commit fails CI and a subsequent fix commit succeeds without changing package.json, the successful run sees the same version in its immediate parent and exits here before checking npm. The fixed, CI-validated commit is therefore never tagged or published, and further unrelated commits also skip it; only another version bump or manual dispatch can recover the release. Confirm that the current version is already published before treating an unchanged manifest as a no-op.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".