Converge the release instead of executing it once

[shanev]

Why

A release is retried by re-running the workflow or re-pushing the tag — and both assume every step is safe to run twice. Publishing isn't, so the recovery an operator reaches for first is guaranteed to fail.

That's how 0.24.0 ended up published to PyPI, missing from its GitHub release, and impossible to re-tag: the relay-bundling step failed after a successful upload, and the natural fix-and-re-tag hit 400 File already exists.

Reordering alone wouldn't fix this. There is always a last irreversible step, and uv publish uploads two files non-atomically — a wheel-succeeds/sdist-fails split is reachable wherever you put it. The retry semantics are the problem, not the ordering.

Four changes, ordered by what actually caused the incident

1. The corpus is enumerated, not listed. trace-v8-*.ndjson was spelled out in two workflows, the packaging check, the release tarball, and suites in another repo. The v8 → v9 rename was missed in release.yml — the one place no PR exercises. conformance_fixture_names() answers the question instead, so a rename is invisible to consumers.

2. The release path runs on every PR. Bundling moved from inline YAML into scripts/bundle-relay.sh, so a new release-dryrun job runs the identical code with the single irreversible action stubbed out. A step that only executes on a tag is discoverable only by breaking a release.

3. Publishing is last. Build and bundle both complete before the first irreversible byte leaves the runner.

4. Publishing converges. --check-url was documented as making re-runs idempotent and doesn't — it predicts from a CDN-cached index and compares against freshly built artifacts, but sdists aren't byte-reproducible, so a rebuild is a different file under the same name and the upload is attempted anyway. scripts/publish-pypi.sh asks the authority — is this version on PyPI — both before uploading and after a failed upload.

The dry run paid for itself immediately

Running it locally surfaced eight stale artifacts (0.6.0 → 0.20.0) sitting in dist/, which uv publish uploads wholesale. The publish script now refuses anything that isn't the version being cut:

::error::dist/ holds artifacts that are not droste 0.24.0: droste-0.20.0-py3-none-any.whl …
::error::clear dist/ and rebuild — publishing would upload them too

And the case that made 0.24.0 unrecoverable is now a clean no-op:

$ scripts/publish-pypi.sh 0.24.0
droste 0.24.0 is already on PyPI — nothing to publish   (exit 0)

Verification

1263 passed, 3 skipped. Both workflows parse; both scripts exercised locally end to end.

Separately: v0.24.0's artifacts (sdist, wheel, relay tarball) are now attached to its GitHub release — the sdist and wheel pulled from PyPI so they're byte-identical to what's published.

Unrelated flake seen once and not reproducible: test_native_and_pyodide_deliver_the_same_ordered_terminal_event_lifecycle.

🤖 Generated with Claude Code