ci: maintain a rolling draft release PR

[mldangelo-oai]

Summary

Release proposals are currently assembled by hand, so later merges can leave the proposed version and notes out of date. Maintain one draft release PR per cycle and preserve the maintainer's edits as new changes reach main.

Changes

• Recompute the proposal from the commit where the current package version first reached main. Before 1.0, ordinary changes, including features, bump the patch; explicitly marked breaking changes bump the minor. Release PRs use the repository's squash merge flow, and a new empty draft can open after the preceding version bump merges.
• Append commits without force-pushing, retry concurrent branch changes, and pause for another release PR on main, an intentionally closed, retargeted, or ready-for-review proposal, or unrelated edits on the release branch. Recheck these conditions before advancing the branch; returning a ready proposal to draft resumes updates.
• Preserve edited or deleted note sections and the PR description. Post later suggestions and request Codex review on the current head, with a final check for a closed, retargeted, or ready PR.
• Keep the workflow read-only by default. An explicit manual write run uses a repository-scoped GitHub App; automatic writes after pushes require a separate opt-in. Document the rollout and note ownership controls.

Testing

• Focused updater suite: 48 tests passed, covering real temporary Git repositories, concurrent commits, note ownership, duplicate prevention, ready/draft transitions, retargeting across runs, orphan-branch recovery, competing-PR races, repeated updates before squash-merge rollover, workflow controls, HTTP request serialization, and pagination.
• SDK types and formatting checks passed.
• Node syntax, Actionlint, and whitespace checks passed.
• Live read-only preview against current main selected the expected next patch and paused for the existing manual release PR without changing it.
• Full SDK suite on 2a69e60a, with seed 12345: 2,143 passed, 43 skipped, zero failures.
• Codex review on 2a69e60a reported no major issues; all review threads are addressed.

Risk and rollout

This does not change the public CLI, enable automated writes, merge a release PR, or publish a package. Existing publication gates remain in place. Breaking-change detection uses commit/PR metadata, and generated notes still need maintainer review. Ready proposals are frozen; if main advances before merge, return the proposal to draft and rerun the updater before the final review.

The GitHub App write path has been exercised with serialized API fixtures, but has not been run on a hosted workflow. After merging, configure the repository-scoped App, run a manual write pilot with automatic updates disabled, and verify its draft, CI, and Codex review before enabling push-triggered writes. The existing manual release PR is left untouched.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review the current head 982ece7. Please focus on release-cycle boundaries, preservation of human notes, concurrent GitHub updates, and workflow write controls.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-30T07:43:49.290356Z	2a69e60	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 982ece706d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

@codex review the current head 7475203. The follow-up freezes ready proposals, rechecks competing releases before the branch write, and documents the existing squash-only release flow. The focused suite now has 44 passing tests.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7475203b03

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

@codex review the current head 2a69e60. The latest fix preserves retargeted proposals across workflow runs and orphan-branch recovery, with 48 focused tests passing.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 2a69e60a4f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

Final validation for 2a69e60a4fae536a03e839eaef08137759d679ba: both full SDK runs passed with 2,143 tests and 43 skips each (seeds 12345 and 29381448). The 48 focused updater tests also pass. Current CI is green, and Codex reported no major issues.