Workflow updates

[coreymartin]

Note

Medium Risk
CI/release workflow changes can affect build validation and npm publishing behavior; mistakes could lead to skipped checks or unintended release/lockfile commits.

Overview
Replaces the test-release-sync.yaml workflow with a new test-and-release.yaml pipeline that first auto-updates/commits sdks/js/yarn.lock on PRs (and enforces immutable installs on main), then runs JS SDK unit tests using the verified lockfile commit.

Updates the test matrix to Node 20.x and 24.x, changes release gating/steps (including pinning changesets/action to v1.5.1, adding system/Rust/Protoc setup, and adding logic to update the lockfile on the changeset-release/main branch when a version-packages PR is created), and fixes a YAML typo in public/actions/js-sdk-unit-test (save-if).

^{Written by Cursor Bugbot for commit 95330f9. This will update automatically on new commits. Configure here.}

[cursor]

Release job guard commented out, runs on PRs

High Severity

The if: success() && github.event_name == 'push' guard on the release job is commented out. In the old workflow this condition restricted the release job to only run on pushes to main. Without it, the release job — including changesets/action with publish: yarn release — will also execute on pull_request events, potentially publishing packages to npm from PR branches or creating unwanted release PRs.

 

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[cursor]

Lock file update runs on wrong branch

Medium Severity

The setup-node-yarn-install with update-lock-only (lines 155–162) runs yarn install --mode update-lockfile while still checked out on main. The next step then does git checkout changeset-release/main, which either fails due to uncommitted yarn.lock changes conflicting with the target branch, or silently replaces the updated lock file with that branch's version. Either way, the lock file for changeset-release/main is never actually regenerated from its own bumped package.json files, defeating the purpose of this entire block.