From fc191bbf578cd4a4b5fafaf9262047fde291c22d Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Fri, 11 Sep 2026 22:55:04 +0100
Subject: [PATCH 1/2] fix(ci): point release-core's pnpm/action-setup at
 ts/package.json

pnpm/action-setup reads the packageManager field from the repo root's
package.json by default, but this repo has no root package.json -- the
field lives at ts/package.json, exactly the reason ts-verify already
passes package_json_file explicitly. Without it, the release job failed
outright on every push to main with "No pnpm version is specified",
before ever reaching the actual release step.
---
 .github/workflows/ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e5f01f6..82d15e8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -247,6 +247,8 @@ jobs:
           persist-credentials: false
 
       - uses: pnpm/action-setup@v6
+        with:
+          package_json_file: ts/package.json
 
       - uses: actions/setup-node@v7
         with:

From ec6b1e68fc5c0d8886ed571f67af9f502c5395fb Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Fri, 11 Sep 2026 22:59:23 +0100
Subject: [PATCH 2/2] ci(release): dry-run the release job on every PR, gated
 as a required check

The release job only ever ran on push to main, so nothing in a PR's own
CI exercised it -- the pnpm/action-setup bug this same branch fixes
merged three times before anyone noticed main had gone red on every
push since. A dry-run job now runs the identical
checkout/pnpm-setup/install/build path on every PR and calls
semantic-release --dry-run instead of a real publish, wired into
required-checks so a break in that shared path fails the PR itself
rather than surfacing only after merge.
---
 .github/workflows/ci.yml | 42 +++++++++++++++++++++++++++++++++++++++-
 1 file changed, 41 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 82d15e8..236e4f6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -217,10 +217,50 @@ jobs:
         working-directory: rust
         run: cargo run --bin conformance-check
 
+  release-core-dry-run:
+    name: Release wire-mesh-core (dry run)
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: pnpm/action-setup@v6
+        with:
+          package_json_file: ts/package.json
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version-file: .tool-versions
+          # Do NOT set registry-url -- it creates an .npmrc that overrides OIDC
+
+      - run: pnpm install --frozen-lockfile
+        working-directory: ts
+
+      - run: pnpm turbo run _build
+        working-directory: ts
+
+      # A dry run exercises the exact same setup/build/plugin-load path release-core's real publish does -- catching a break in that shared path (e.g. #70's pnpm/action-setup misconfiguration) here, before merge, rather than discovering it only after main goes red on the next real push.
+      - run: pnpm exec semantic-release --dry-run
+        working-directory: ts/packages/core
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   required-checks:
     name: Required Checks
     needs:
-      [cddl-validate, conformance-verify, ts-verify, web-console-e2e, rust-verify]
+      [
+        cddl-validate,
+        conformance-verify,
+        ts-verify,
+        web-console-e2e,
+        rust-verify,
+        release-core-dry-run,
+      ]
     if: always()
     runs-on: ubuntu-latest
     steps: