fix(release): audit untagged companion packages

.github/workflows/release.yml

@@ -51,8 +51,12 @@ jobs:
       - name: Verify non-publishing package version
         if: github.event_name == 'workflow_dispatch' && !inputs.publish_release
         run: node scripts/verify-release-version.js --allow-untagged
-      - name: Verify Companion release identity
+      - name: Verify tagged Companion release identity
+        if: github.event_name == 'push' || inputs.publish_release
         run: node scripts/verify-companion-release.js
+      - name: Verify non-publishing Companion package metadata
+        if: github.event_name == 'workflow_dispatch' && !inputs.publish_release
+        run: node scripts/verify-companion-release.js --allow-untagged
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}

scripts/verify-companion-release.js

@@ -31,6 +31,7 @@ function exactVersionTag(extensionRoot, expectedTag) {
 export function verifyCompanionRelease({
   repositoryRoot = defaultRepositoryRoot,
   resolveExactTag = exactVersionTag,
+  requireExactTag = true,
 } = {}) {
   const extensionRoot = path.join(repositoryRoot, 'Extensions', 'Browser');
   const packagePath = path.join(extensionRoot, 'package.json');
@@ -53,6 +54,9 @@ export function verifyCompanionRelease({
   }
 
   const expectedTag = `v${packageVersion}`;
+  if (!requireExactTag) {
+    return { tag: null, version: packageVersion };
+  }
   const tag = resolveExactTag(extensionRoot, expectedTag);
   if (!tag) {
     throw new Error(
@@ -68,8 +72,13 @@ export function verifyCompanionRelease({
 
 function main() {
   try {
-    const { tag, version } = verifyCompanionRelease();
+    const requireExactTag = !process.argv.includes('--allow-untagged');
-    console.log(`Companion release ${version} matches exact tag ${tag}.`);
+    const { tag, version } = verifyCompanionRelease({ requireExactTag });
+    console.log(
+      requireExactTag
+        ? `Companion release ${version} matches exact tag ${tag}.`
+        : `Non-publishing Companion package metadata agrees at version ${version}.`
+    );
   } catch (error) {
     console.error(error instanceof Error ? error.message : String(error));
     process.exitCode = 1;

scripts/verify-companion-release.node-test.js

@@ -84,6 +84,27 @@ test('rejects an untagged Companion commit', () => {
   }
 });
 
+test('accepts aligned untagged Companion metadata for a non-publishing audit', () => {
+  const root = createFixture('2.0.7', '2.0.7');
+  let tagLookupCalled = false;
+  try {
+    assert.deepEqual(
+      verifyCompanionRelease({
+        repositoryRoot: root,
+        requireExactTag: false,
+        resolveExactTag: () => {
+          tagLookupCalled = true;
+          return null;
+        },
+      }),
+      { tag: null, version: '2.0.7' }
+    );
+    assert.equal(tagLookupCalled, false);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
 test('rejects a Companion tag for another version', () => {
   const root = createFixture('2.0.7', '2.0.7');
   try {