Guard npm release publishing behind exclusive cutover

Require an operator-confirmed cutover before publishing with channel tags; document retirement and draining of the old publisher and correct the recheck comment.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 23fc3b8d-7678-46d3-9fe7-875d8311b526

Author: devm33

.github/workflows/publish-npm.yml

@@ -25,6 +25,14 @@ jobs:
       contents: read
       id-token: write
     steps:
+      - name: Require completed npm publisher cutover
+        env:
+          CUTOVER_COMPLETE: ${{ vars.CLI_NPM_RELEASE_CUTOVER_COMPLETE }}
+        run: |
+          if [ "$CUTOVER_COMPLETE" != "true" ]; then
+            echo "Set CLI_NPM_RELEASE_CUTOVER_COMPLETE only after retiring and draining the runtime npm publisher." >&2
+            exit 1
+          fi
       # Never check out the release tag: it can contain different workflow/script code.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:

README.md

@@ -113,7 +113,9 @@ version-specific `release-<version>` npm tag if `latest` or `prerelease` has
 advanced, so recovery never intentionally downgrades those channels. A version
 already on npm with a missing/stale channel tag fails closed: npm OIDC cannot
 perform `npm dist-tag add`, so an npm administrator must repair that tag
-separately.
+separately. The npm dist-tag recheck cannot prevent a concurrent publisher
+from advancing a tag between the read and `npm publish --tag`; the cutover
+requires exclusive ownership of these packages' channel tags.
 
 **Required setup before cutover:** On npmjs.com, configure an npm trusted
 publisher **with `npm publish` permission** for each of the nine packages:
@@ -127,7 +129,16 @@ repository is `github/copilot-cli`); leave environment unset. Use GitHub-hosted
 runners. The workflow uses Node 24, npm >= 11.5.1 and `id-token: write`, with
 no `NPM_TOKEN` or `NODE_AUTH_TOKEN`. The runtime repository must continue its
 existing publishing until this workflow is merged **and all nine npm trusted
-publishers are configured**; only then should its npm publication be cut over.
+publishers are configured**. At cutover, disable the old runtime
+`publish-cli.yml` workflow, wait for all its in-progress and queued runs to
+finish, then merge the runtime workflow change. Retire any other publisher
+of these nine packages and prohibit reruns of older runtime release runs.
+Only then set the `CLI_NPM_RELEASE_CUTOVER_COMPLETE` repository Actions
+variable to `true` in `github/copilot-cli` and re-enable the updated runtime
+workflow. Without this variable the new workflow fails before any npm
+publish, including manual recovery. If an external publisher is restarted,
+unset the variable before publishing another release; a dist-tag read is
+not a concurrency lock.
 Its internal Azure feed publication and ancillary release tasks remain separate.
 The release artifact producer must attach the nine actual npm package tarballs
 under the new `npm-github-copilot-` names before cutover. Older releases such as

script/publish-npm-release.mjs

@@ -159,7 +159,7 @@ export async function publishRelease(tag, {
         console.log(`Already published ${item.name}@${version} (integrity matches)`);
         continue;
       }
-      // Re-check immediately before publishing; a concurrent external publisher must not move a newer tag back.
+      // Re-check for sequential changes; cross-repository publishers must be retired at cutover.
       const existing = await lookup(item.name, version);
       if (existing) {
         if (existing.dist?.integrity !== item.integrity) {