(MOT-4299) feat(release): add immutable worker release train

[ytallo]

Summary

• Add exact prepare, candidate publication and stable publication workflows.
• Keep Git, GitHub Releases, GHCR and Registry effects idempotent and factually identifiable.
• Add immutable artifact reuse for recovery and a separate Registry finalization executor.
• Add RC semver, CAS inputs, dispatch identity validation and cleanup of terminal attempt refs.

Validation

• Release script suite: 204 tests passed, plus 3 subtests.
• Python bytecode compilation passed.
• All workflow YAML files parsed successfully.

Refs MOT-4299

Summary by CodeRabbit

• New Features

  • Added end-to-end workflows for preparing, publishing, and finalizing candidate and stable releases.
  • Added automated cleanup of outdated release-attempt references.
  • Added safer registry tag assignment with version checks and retry support.

• Improvements

  • Release candidates now support numbered versions such as rc.10, with correct numeric ordering.
  • Release operations validate release identity, source versions, checksums, and execution metadata more thoroughly.

• Bug Fixes

  • Prevented incorrect registry tags from being included in immutable publication payloads.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
workers	Ready	Preview	Aug 19, 2026 7:45pm
workers-tech-spec	Ready	Preview	Aug 19, 2026 7:45pm

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4e2d1890-31a2-4283-92c2-63c3e3e2b57a

📥 Commits

Reviewing files that changed from the base of the PR and between 90eb86f and 7f58382.

📒 Files selected for processing (15)

• .github/scripts/_lib.py
• .github/scripts/build_publish_payload.py
• .github/scripts/cleanup_release_attempt_refs.py
• .github/scripts/release_control_contract.py
• .github/scripts/release_train.py
• .github/scripts/tests/test_lib.py
• .github/scripts/tests/test_release_control_contract.py
• .github/scripts/tests/test_release_workflows.py
• .github/workflows/_publish-registry.yml
• .github/workflows/cleanup-release-attempt-refs.yml
• .github/workflows/finalize-registry.yml
• .github/workflows/prepare-release.yml
• .github/workflows/publish-candidate.yml
• .github/workflows/publish-stable.yml
• scripts/check-links.sh

---

📝 Walkthrough

Walkthrough

The PR adds numbered RC version handling, exact release-control contracts, preparation and publication workflows, guarded Registry promotion, execution evidence artifacts, and scheduled cleanup of stale release-attempt refs.

Changes

Release control and publication

Layer / File(s)	Summary
Numbered release candidates .github/scripts/_lib.py, .github/scripts/tests/test_lib.py	Release parsing and ordering support numeric rc.N identifiers. Same-core transitions and release history reject repeated or decreasing RC numbers.
Release-control identity contracts .github/scripts/release_control_contract.py, .github/scripts/tests/test_release_control_contract.py, .github/scripts/tests/test_release_workflows.py	Dispatch and result payloads validate release identities, hashes, UUIDs, versions, and artifact digests. Workflow tests cover required and optional inputs.
Immutable release attempt preparation .github/scripts/release_train.py, .github/workflows/prepare-release.yml	The preparation flow validates the source and candidate version, builds deployment artifacts, computes checksums, and uploads prepared metadata and execution results.
Candidate publication .github/workflows/publish-candidate.yml	The workflow verifies prepared metadata, publishes the RC tag and prerelease, pushes image artifacts when required, invokes Registry publication, and records evidence.
Stable publication and Registry promotion .github/workflows/publish-stable.yml, .github/workflows/_publish-registry.yml, .github/workflows/finalize-registry.yml, .github/scripts/build_publish_payload.py	Stable publication supports recovery or rebuild paths. Registry payloads are immutable, while registry tag assignment and latest promotion use compare-and-swap validation.
Release-attempt reference cleanup .github/scripts/cleanup_release_attempt_refs.py, .github/workflows/cleanup-release-attempt-refs.yml, scripts/check-links.sh	A scheduled job removes stale eligible refs and preserves recent or unverifiable refs. The link checker ignores non-GET workflow endpoints.

Estimated code review effort: 5 (Critical) | ~120 minutes

Possibly related PRs

• iii-hq/workers#719: Both changes extend release-version parsing, maturity transitions, tag-history validation, and SemVer ordering.
• iii-hq/workers#694: Both changes modify Registry tag publication semantics and release workflows.
• iii-hq/workers#725: Both changes add Release Control identity inputs and deterministic workflow execution handling.

Poem

A rabbit checks each RC in line,
rc.10 hops past rc.2 just fine.
Prepared bundles stack by SHA,
Tags move safely, guarded on their way.
Old refs fade beneath the moon—
Release carrots reach the burrow soon.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/immutable-worker-release-train

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

skill-check — worker

0 verified, 61 skipped (no docs/).

Layer	Result
structure	✓
vale	✓
ai	✓
render	✓

Four for four. Nicely done.