fix(release): restack publication JSON integrity on latest protected main

[seonghobae]

Purpose

Create a clean current-protected-main successor for #293 after protected main advanced when #292 merged. The predecessor's successful CI/reviewer/security evidence is now historical because its exact head was built on the prior protected base. This Draft preserves only the reviewed immutable-release publication JSON integrity fix and its focused regression, without force-pushing, rebasing, or mutating the predecessor branch.

Exact construction identity

• protected main immediately before construction: 7a62f6ddfc2b435ceab84a954714b97a9534161c;
• current protected-main tree: e59acedde19cf0b4a2fc731cc6aa0f70b9994a4c;
• predecessor fix(release): restack publication JSON integrity on current main #293 exact unchanged head: ce4a5cc5aba3f0d22c06a34e905776cec089e553;
• predecessor branch remained fix/release-publication-duplicate-json-e60eff at that SHA and had zero formal reviews and zero inline review threads at the pre-write refetch;
• successor exact head: 2c52919de917533df421b58b7b3079328d272635;
• successor tree: c2ceeca94a8ecabec0f03dab11d56c7b99d54d1e;
• ancestry: exactly one commit on current protected main, 1 ahead / 0 behind, merge base exactly 7a62f6ddfc2b435ceab84a954714b97a9534161c;
• scope: exactly two paths, scripts/release-publication-receipt.mjs (+4/-0) and new test/release-publication-duplicate-json.test.ts (+146/-0).

Current protected main still has source blob 8e66d6325cb9d49fc8e951da8c2f509cf7b39f45 for scripts/release-publication-receipt.mjs and does not contain the focused regression file. The successor overlays the predecessor-tested blobs 74c3592e0da60a5a43b922d1e18322a1b8bbed68 and 93d5a466f7b8e4219e9766df9e22f011497fc12d, respectively. The intervening #292 integration therefore does not overwrite or silently combine a change to this release-publication source lane.

Defect and preserved behavior

Escape-equivalent duplicate decoded JSON object keys such as enabled and en\u0061bled must not be allowed to collapse under JavaScript's last-key-wins parsing before immutable-release policy evaluation. The fix reuses Noema's decoded-key integrity scanner and rejects duplicate object keys before JSON.parse.

Fatal UTF-8 decoding, malformed-JSON handling, exact repository/tag/commit/version identity, exact release asset inventory, SHA-256 checksums, SBOM/Sigstore evidence, immutable-release policy checks, and publication-receipt semantics remain unchanged. The focused regression exercises literal and escape-equivalent duplicates across the relevant release-publication JSON inputs.

Evidence boundary

No CI, coverage, scanner, formal-review, model-review, release, deployment, operational, or predecessor evidence transfers from #293. Keep this successor Draft until this unchanged exact head obtains fresh terminal-success application ci, reviewer-ci, protected-base-eligible central Security Scan, exact 100% owned production statement/branch/function/line coverage with realistic tests, and zero valid unresolved findings. Pending, queued, skipped, absent, neutral, failed, cancelled, stale, predecessor, status-only, model-only, or rate-limited evidence is non-passing.

Immediately before Ready or merge, independently re-resolve protected main, exact head/ref/ancestry, workflow checkout SHAs, live rulesets, the exact central .github Security Scan authority, formal reviews, unresolved threads, and active-writer state. Current live Noema policy requires the central Security Scan workflow and does not currently impose an independent formal-approval rule; no synthetic approval requirement is introduced.

This change does not create or publish a release, prove deployment/KPI/revenue/security-validation/transfer evidence, weaken gates, create a repair/self-modifying workflow, invent authority/evidence, or select an outbound license.

Supersedes #293 only after fresh exact-head verification.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 16 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8f1344bc-a870-4cd9-a911-f33a6f052cc5

📥 Commits

Reviewing files that changed from the base of the PR and between 7a62f6d and 2c52919.

📒 Files selected for processing (2)

• scripts/release-publication-receipt.mjs
• test/release-publication-duplicate-json.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}