fix(ci): opt the release publish step out of the prepare hook so the shipped dist/ is the validated one

[KnockOutEZ]

Closes KnockOutEZ/wigolo-studio-run#171.

The defect

release.yml's root Publish wigolo (npm) step ran npm publish with no
WIGOLO_SKIP_PREPARE. npm publish packs, and packing runs prepare. So the
release leg lints, tests, builds an explicit dist/, verifies the tag against
package.json — and then npm publish fires scripts/prepare-build.mjs, which
rebuilds dist/ from scratch.

The artifact that actually shipped was the hook's build, produced after every gate
validated a different one. And a build that flakes at that point fails the release at
publish, with all gates already green behind it. The install step's own comment ("The
explicit build below is the one that produces the published dist/") was false as written.

#169 swept the install legs; publish is the one hook-firing leg that sweep's
npm ci|pack|install register cannot see.

The fix

• WIGOLO_SKIP_PREPARE: '1' on the root Publish wigolo (npm) step env. The hook honors
  it at scripts/prepare-build.mjs:43.
• The install step's comment corrected — it now says why both hook-firing steps on the
  leg need the opt-out, and what shipping the publish-time build would mean.
• Audited the rest of the workflow: Create GitHub Release uses gh release create, and
  the Smithery step uses mcpb pack, neither of which invokes npm's lifecycle. The
  sub-package publishes at :145/:159 run from their own working-directory, so the
  root hook never fired for them; per the issue's non-goals they keep their own hooks.

The pin

A new describe in tests/unit/prepare-build.test.ts enumerating the pack-shaped
register — npm publish / npm pack at the repo root, across every workflow — in the
same YAML-parse style as the existing install-leg arms. Four arms: the step set, the
suppression rule, an off-root control, and a pin that the explicit build still precedes
the publish (the opt-out is only safe because it does).

The shared steps() YAML walker was hoisted to module scope so both registers use it;
its behaviour is unchanged.

Red → green

Red on tip — one arm, naming the exact step:

 ❯ tests/unit/prepare-build.test.ts (17 tests | 1 failed)
     × every one of them suppresses the hook, so the shipped dist/ is the validated one

AssertionError: expected [ Array(1) ] to deeply equal []

- Expected
+ Received

- []
+ [
+   "release.yml / release / Publish wigolo (npm)",
+ ]

 Tests  1 failed | 16 passed (17)

Green with the fix:

 Test Files  1 passed (1)
      Tests  17 passed (17)

Note the 16 already-passing arms: the existing enumeration arms are undisturbed — adding
an env: key cannot change which steps a run:-text regex matches.

Suites

npm test                 →  Test Files  954 passed | 5 skipped (959)
                            Tests  11998 passed | 20 skipped | 7 todo (12025)   exit 0
npx tsc --noEmit         →  exit 0
npm run gate:studio      →  exit 0  (no-electron · lint · typecheck:studio ·
                            check:typecheck-gate: 88/88 · typecheck:debt: baseline 363 ·
                            typecheck:contract)

Non-goals held

What prepare does is unchanged. Sub-package publish hook behaviour is unchanged. No
release or publish is performed — main + npm move at PX2.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b578afdf-d65e-421d-b748-b108a95e5b3e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}