AIWG 2026.6.5 — "Release-pipeline hardening"

AIWG 2026.6.5 — "Release-pipeline hardening"

Released: 2026-06-21 Channel: stable (`npm install -g aiwg`)

A maintenance cut that closes two release-pipeline gaps surfaced while cutting 2026.6.4. No API or CLI surface changes.

Highlights

What changedWhy you care
`cut-tag.sh` gates `package-lock.json`A stale lockfile is caught before the tag is pushed, instead of failing CI and stranding the npm publish afterward.
GitHub mirror creates Release pages againStable tags get their GitHub Release auto-created; the mirror had been silently skipping it since v2026.6.2.

Fixes

`cut-tag.sh` now verifies `package-lock.json` lockstep

Cutting 2026.6.4 bumped `package.json`, `.claude-plugin/marketplace.json`, and `apps/cockpit/package.json` — but not `package-lock.json`. CI's `check:versions` / `npm ci` reject a lockfile whose version drifts from `package.json`, so the build gate failed after the tag was already pushed and the npm publish never ran. The wrapper's lockstep checks didn't cover the lockfile.

`tools/release/cut-tag.sh` now runs a `package-lock.json` lockstep check (new pre-tag step 5/12) so a stale lockfile fails fast, locally, before tagging:

FAIL: package-lock.json version is '2026.6.4', expected '2026.6.5'.
       Run: npm install --package-lock-only
       (then commit package-lock.json) so CI's check:versions / npm ci pass.

GitHub mirror creates Release pages again

`github-mirror.yml` checked `secrets.GH_TOKEN`, but the configured Gitea Actions secret is named `GH_ACCESS_TOKEN`. The mismatch meant the "Check token availability" step always saw an empty value and skipped the GitHub tag push + Release creation — while still reporting the job as successful (the graceful fork-mode path). As a result, v2026.6.2, v2026.6.3, and v2026.6.4 never got an auto-created GitHub Release.

The workflow now reads `GH_ACCESS_TOKEN` (the `GH_TOKEN` env var that `gh` and the push URL consume is unchanged), so stable tags get their GitHub Release created automatically. This release is the validation that the path works end-to-end.

Upgrade

npm install -g aiwg     # 2026.6.5
aiwg version            # → 2026.6.5 [stable]

No action required. Maintenance release.