Release v0.75.2 — release-tooling hygiene

Date: 2026-04-22 Tag: v0.75.2

Summary

Thin release-tooling patch. Six commits on main since v0.75.1 fixed real bugs in the release + publish workflows themselves. None affect runtime or published API surface; all affect the next and subsequent releases.

No product behaviour changes. No API, schema, CLI, or installer layout changes.

What shipped

1. scripts/check-version.mjs — off-tag false positive fixed

The guardrail used only git tag --points-at HEAD, which returns empty once main has advanced past the tag — the standard post-release state after the [Unreleased] re-add commit lands. The off-tag branch then treated the [X.Y.Z] CHANGELOG section + link as “tag doesn’t exist yet” and errored, blocking every subsequent SDK publish workflow at its Check version consistency step.

Fix: added a second check via git tag -l vX.Y.Z. When the tag exists anywhere in the repo (even if not on HEAD), the section + link are accepted as correct history. Pre-tag strict semantics preserved.

2. release.yml + all 4 publish-sdk-*.yml — unshallow origin/main fetch

The check-ci gate did git fetch origin main --depth=1, which only pulls main’s tip. After the tag commit and the post-release [Unreleased] re-add, git merge-base --is-ancestor <tag-sha> origin/main failed — the shallow origin/main couldn’t see the tag commit as an ancestor even though it was one. Dropped --depth=1; fetches full main history in the CI-gate step.

3. release.yml Windows installer — NSIS PATH propagation

choco install nsis installs NSIS under C:\Program Files (x86)\NSIS but doesn’t propagate PATH across workflow steps, so Build installer failed with makensis not found on PATH. Mirrors the identical fix applied to ci.yml’s windows-installer-validate job in v0.75.1 — explicit Out-File -FilePath $env:GITHUB_PATH -Append after choco install.

4. publish-sdk-typescript.yml — build template-model before sdk

The Publish @pulp-engine/sdk job did a fresh pnpm install --frozen-lockfile then pnpm --filter @pulp-engine/sdk build. The sdk imports @pulp-engine/template-model via workspace:*; tsc needs its dist/*.d.ts present, which a fresh install does not produce. TS2307 on every publish attempt. Added an explicit template-model build step before the sdk build, matching the pattern already used in the build job.

Operational status

v0.75.1 SDK publish gaps remain as follow-up (all per-ecosystem, none scoped into v0.75.2):

• PyPI (pulp-engine) — invalid-publisher OIDC failure. PyPI has no trusted publisher entry for TroyCoderBoy/pulpengine / publish-sdk-python.yml / environment pypi. Operator action at https://pypi.org/manage/project/pulp-engine/settings/publishing/ once the project page is available.
• Go mirror (github.com/TroyCoderBoy/pulp-engine-go) — generated api_admin.go has syntax error: unexpected -, expected semicolon or newline at line 11:13. Bug in the openapi-generator output; needs local repro + template/schema investigation.
• NuGet (PulpEngine.Sdk) — the Smoke test against local API step’s Build the API fails with TS2307 across multiple test files (can’t find @pulp-engine/template-renderer etc.). Same structural issue as the publish-sdk-typescript.yml job that v0.75.2 fixes, but in the .NET workflow’s internal API-build step. Apply the same upstream-build-first prepend pattern.

Verification

Local:

• node scripts/check-version.mjs — passes in both tagged-HEAD and post-tag states with the new logic
• pnpm lint + pnpm typecheck — no material changes, existing green state preserved

CI:

• CI and Release workflows on the tag push use the same content as v0.75.1 (Docker build + scan + sign, installer + eval bundle + GitHub Release assets)
• Any future SDK publish now passes the ancestry + check-version gates without a re-tag needed for those fixes