ci: stop publishing the alien CLI distribution from this repo

[alongubkin]

Why

The stable release built the alien executable from a separately pinned external composition. That pin went stale, and the release compiled a combination of sources that no other CI job tested.

What

This repository now publishes only what it builds from its own source:

• crates.io, npm libraries, native addons, AI gateway, client SDKs, PyPI wheels
• GHCR images (alien-base, alien-worker-typescript, alien-builder, alien-operator, alien-manager, alien-sandbox-agent)
• OSS binaries on releases.alien.dev: alien-deploy, alien-operator, alien-manager, alien-worker-runtime
• the immutable release tag

These move to the official CLI distribution, which publishes them from this repository's release tag after the release: the alien executable, @alienplatform/cli, the GitHub release, the Homebrew formula and channels/stable.

The GitHub release keeps the same archives as every earlier release (alien plus this release's binaries per target, and checksums). Immutable releases can't gain assets after they're published, so the release has to be created by whatever builds alien. This workflow now creates only the tag; the distribution then creates the release on it, with the changelog rendered from cliff.toml over vPREV..vX.

Removed:

• .github/official-cli-platform-revision, plus the extra checkout and build in the four binary jobs. Cache keys go to -b2 because the cached set changed.
• qualify-github-release and generate-changelog. create-github-release becomes create-release-tag: it keeps the immutable-release and tag-ruleset checks, then creates the tag at the qualified commit, or verifies it if it already exists.
• publish-homebrew-tap, publish-stable-channel, qualify-npm-cli-wrapper, publish-npm-cli-wrapper, scripts/build-npm-packages.sh, packages/alien-cli-npm.
• In release-stable.yml, the resume check now waits on qualify-images and stops requiring the removed artifacts (changelog, qualified-github-release, qualified-npm-cli).

Nothing changes for clients: alien upgrade, the install scripts and alien-deploy up still resolve channels/stable and download versioned objects from releases.alien.dev.

Validation

• node --test scripts/sdk-release-metadata.test.mjs scripts/release-routing.test.mjs: 9/9 pass. The routing test for the removed composition is deleted with it.
• actionlint reports no errors beyond the custom Depot runner labels, and no job needs a removed job.
• pnpm install --frozen-lockfile --lockfile-only passes with the removed package's importer dropped.

The next stable release exercises the full path: OSS artifacts publish from here, then the CLI distribution follows from the tag.

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

[Critical risk] Stops publishing the CLI distribution from this repository.

The PR appears safe to merge; no outstanding or new actionable finding was established.

Summary

The PR moves CLI distribution out of this repository’s stable-release workflow while retaining publication of its own packages, images, and binaries.

• Qualification no longer produces the CLI-composed binaries or changelog artifact; stable publication creates the qualified release tag for the separate distribution.
• The subsequent release-version update aligns workspace packages, SDK metadata, and manager deployment defaults with v3.3.27.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Q[Qualify repository artifacts] --> P[Publish packages, images, and binaries]
  P --> T[Create immutable release tag]
  T --> D[Official CLI distribution]
  D --> G[GitHub release and CLI package]
  G --> H[Homebrew]
  H --> S[Stable channel]

Loading

_{Reviews (2) · Last reviewed commit: "ci: create only the release tag; the CLI..."}

[alongubkin]

@greptileai review