Merge pull request #1154 from paperclipai/release-automation-followups

Release automation follow-ups

.github/CODEOWNERS

@@ -1,10 +1,10 @@
 # Replace @dotta if a different maintainer or team should own release infrastructure.
 
-.github/workflows/release.yml @dotta
+.github/** @dotta @devinfoley
-scripts/release*.sh @dotta
+scripts/release*.sh @dotta @devinfoley
-scripts/release-*.mjs @dotta
+scripts/release-*.mjs @dotta @devinfoley
-scripts/create-github-release.sh @dotta
+scripts/create-github-release.sh @dotta @devinfoley
-scripts/rollback-latest.sh @dotta
+scripts/rollback-latest.sh @dotta @devinfoley
-doc/RELEASING.md @dotta
+doc/RELEASING.md @dotta @devinfoley
-doc/PUBLISHING.md @dotta
+doc/PUBLISHING.md @dotta @devinfoley
-doc/RELEASE-AUTOMATION-SETUP.md @dotta
+doc/RELEASE-AUTOMATION-SETUP.md @dotta @devinfoley

.github/workflows/refresh-lockfile.yml

@@ -79,3 +79,15 @@ jobs:
           else
             echo "PR #$existing already exists, branch updated via force push."
           fi
+
+      - name: Enable auto-merge for lockfile PR
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          pr_url="$(gh pr list --head chore/refresh-lockfile --json url --jq '.[0].url')"
+          if [ -z "$pr_url" ]; then
+            echo "Error: lockfile PR was not found." >&2
+            exit 1
+          fi
+
+          gh pr merge --auto --squash --delete-branch "$pr_url"

.github/workflows/release.yml

@@ -92,6 +92,9 @@ jobs:
       - name: Install dependencies
         run: pnpm install --no-frozen-lockfile
 
+      - name: Restore tracked install-time changes
+        run: git checkout -- pnpm-lock.yaml
+
       - name: Configure git author
         run: |
           git config user.name "github-actions[bot]"
@@ -218,6 +221,9 @@ jobs:
       - name: Install dependencies
         run: pnpm install --no-frozen-lockfile
 
+      - name: Restore tracked install-time changes
+        run: git checkout -- pnpm-lock.yaml
+
       - name: Configure git author
         run: |
           git config user.name "github-actions[bot]"

doc/RELEASE-AUTOMATION-SETUP.md

@@ -16,6 +16,7 @@ Note:
 
 - the release workflows intentionally use `pnpm install --no-frozen-lockfile`
 - this matches the repo's current policy where `pnpm-lock.yaml` is refreshed by GitHub automation after manifest changes land on `master`
+- the publish jobs then restore `pnpm-lock.yaml` before running `scripts/release.sh`, so the release script still sees a clean worktree
 
 ## 1. Merge the Repo Changes First