@mannyc1/ts-release 0.2.2 → 0.3.0

package/src/operation-journal.ts

@@ -0,0 +1,51 @@
+/**
+ * Provider-neutral durable operation journal.
+ *
+ * Consumers own payload codecs and provider semantics. This subpath owns only
+ * the canonical envelope, finite transition machine, S3 conditional commit,
+ * durable acknowledgment, and exact-chain replay.
+ */
+export {
+  JournalAuthorityMismatch,
+  JournalConflict,
+  JournalInputError,
+  JournalIntegrityError,
+  JournalStorageOutcomeUnknown,
+  JournalStorageUnavailable,
+  JournalTransitionError,
+  S3JournalBoundaryError,
+  journalRecordTags,
+  operationJournalByteLimits
+} from "./operation-journal/model.js"
+export type {
+  CanonicalOperationJournalShape,
+  JournalAcknowledgement,
+  JournalAppendError,
+  JournalAppendRequest,
+  JournalOperation,
+  JournalReadError,
+  JournalRecord,
+  JournalRecordTag,
+  JournalSnapshot,
+  JournalStateTag,
+  JournalWorkflowCoordinate,
+  S3JournalAuthority,
+  S3JournalBoundaryShape,
+  S3JournalDeleteMarker,
+  S3JournalNamespaceListing,
+  S3JournalObjectVersion,
+  S3JournalOidcClaims,
+  S3JournalOidcTrustConditions,
+  S3JournalPutCondition,
+  S3JournalPutRequest,
+  S3JournalPutResult
+} from "./operation-journal/model.js"
+export {
+  deriveOperationKey,
+  journalEventKey,
+  journalHeadKey,
+  journalNamespace
+} from "./operation-journal/canonical.js"
+export { admitJournalTransition } from "./operation-journal/reducer.js"
+export { makeS3CanonicalOperationJournal } from "./operation-journal/s3.js"
+export type { S3CanonicalOperationJournalOptions } from "./operation-journal/s3.js"

package/src/platform/credentials.ts

@@ -1,5 +1,5 @@
 import { Buffer } from "node:buffer"
-import { chmod, copyFile, mkdir, mkdtemp, rm, writeFile } from "node:fs/promises"
+import { chmod, copyFile, mkdir, mkdtemp, readFile, realpath, rm, stat, writeFile } from "node:fs/promises"
 import { tmpdir } from "node:os"
 import { basename, isAbsolute, join, resolve } from "node:path"
 import * as Config from "effect/Config"
@@ -588,6 +588,7 @@ const makeAuthorizedMutationHttp = (
 type NpmUserConfigMetadata = {
   readonly directory: string
   readonly path: string
+  readonly globalConfigPath: string
   readonly subject: SubjectId
   readonly grant: ScopedSecret
   readonly token: Redacted.Redacted<string>
@@ -620,9 +621,18 @@ const makeNpmUserConfigResource = (
         const directory = await mkdtemp(join(root, "ts-release-npm-"))
         try {
           const path = join(directory, "userconfig")
+          const globalConfigPath = join(directory, "globalconfig")
           const contents = `${npmAuthLine(input.registryUrl, token)}\nignore-scripts=true\n`
           await writeFile(path, contents, { mode: 0o600, flag: "wx" })
-          npmUserConfigs.set(handle, { directory, path, subject: input.operation.subject, grant, token })
+          await writeFile(globalConfigPath, "", { mode: 0o600, flag: "wx" })
+          npmUserConfigs.set(handle, {
+            directory,
+            path,
+            globalConfigPath,
+            subject: input.operation.subject,
+            grant,
+            token
+          })
           return handle
         } catch (cause) {
           await rm(directory, { recursive: true, force: true })
@@ -671,6 +681,58 @@ const optionalPath = Config.option(Config.string("PATH")).pipe(
 const closedBaseEnvironment = (path: string | undefined): Record<string, string> =>
   path === undefined ? {} : { PATH: path }
 
+const optionalReleaseHome = Config.option(Config.string("TS_RELEASE_HOME")).pipe(
+  Effect.map(Option.getOrUndefined),
+  Effect.orElseSucceed(() => undefined)
+)
+
+const privateTrustedNpmEnvironment = Effect.fn("CertifiedPublisherSpawn.privateTrustedNpmEnvironment")(
+  function*(grant: WorkloadIdentity) {
+    const configured = yield* optionalReleaseHome
+    if (configured === undefined || !isAbsolute(configured) || resolve(configured) !== configured) {
+      return yield* new CredentialUnavailable({
+        subject: grant.subject,
+        provider: grant.provider,
+        purpose: "publish",
+        reason: "Trusted npm publishing requires one canonical absolute TS_RELEASE_HOME."
+      })
+    }
+    return yield* Effect.tryPromise({
+      try: async () => {
+        const canonicalHome = await realpath(configured)
+        if (canonicalHome !== configured) throw new Error("TS_RELEASE_HOME is not canonical.")
+        const homeMetadata = await stat(canonicalHome)
+        const owner = typeof process.getuid === "function" ? process.getuid() : undefined
+        if (!homeMetadata.isDirectory() || (homeMetadata.mode & 0o077) !== 0 ||
+          (owner !== undefined && homeMetadata.uid !== owner)) {
+          throw new Error("TS_RELEASE_HOME is not one private caller-owned directory.")
+        }
+        const userConfig = join(canonicalHome, "npm-userconfig")
+        const globalConfig = join(canonicalHome, "npm-globalconfig")
+        for (const path of [userConfig, globalConfig]) {
+          if (await realpath(path) !== path) throw new Error("A trusted npm config path is not canonical.")
+          const metadata = await stat(path)
+          if (!metadata.isFile() || (metadata.mode & 0o777) !== 0o600 ||
+            (owner !== undefined && metadata.uid !== owner) || (await readFile(path)).length !== 0) {
+            throw new Error("A trusted npm config is not an empty private caller-owned file.")
+          }
+        }
+        return {
+          HOME: canonicalHome,
+          NPM_CONFIG_USERCONFIG: userConfig,
+          NPM_CONFIG_GLOBALCONFIG: globalConfig
+        }
+      },
+      catch: () => new CredentialUnavailable({
+        subject: grant.subject,
+        provider: grant.provider,
+        purpose: "publish",
+        reason: "Trusted npm publishing requires validated empty private npm configuration files."
+      })
+    })
+  }
+)
+
 const workloadEnvironment = Effect.fn("CertifiedPublisherSpawn.workloadEnvironment")(function*(
   trustedWorkloads: TrustedWorkloadVault,
   grant: WorkloadIdentity
@@ -693,7 +755,11 @@ const workloadEnvironment = Effect.fn("CertifiedPublisherSpawn.workloadEnvironme
     })
   }
   const path = yield* optionalPath
-  const env = closedBaseEnvironment(path)
+  const privateEnvironment = yield* privateTrustedNpmEnvironment(grant)
+  const env: Record<string, string> = {
+    ...closedBaseEnvironment(path),
+    ...privateEnvironment
+  }
   for (const name of oidcNames) {
     const value = material.oidc.get(name)
     if (value === undefined) {
@@ -858,7 +924,9 @@ const publisherEnvironment = Effect.fn("CertifiedPublisherSpawn.environment")(fu
     const path = yield* optionalPath
     return {
       ...closedBaseEnvironment(path),
+      HOME: metadata.directory,
       NPM_CONFIG_USERCONFIG: metadata.path,
+      NPM_CONFIG_GLOBALCONFIG: metadata.globalConfigPath,
       NPM_CONFIG_IGNORE_SCRIPTS: "true"
     }
   }

package/src/publication/github.ts

@@ -135,6 +135,10 @@ type GithubMutationPlan =
     readonly uploadUrl: string
     readonly assetIndexes: ReadonlyArray<number>
   }
+  | {
+    readonly _tag: "PublishRelease"
+    readonly releaseId: number
+  }
 
 type PageResult =
   | { readonly _tag: "Complete", readonly assets: ReadonlyArray<ReleaseAssetFacts> }
@@ -451,7 +455,8 @@ const listAllAssets = Effect.fn("GitHubReleaseSubject.listAllAssets")(function*(
 
 const compareReleaseMetadata = (
   publication: PreparedGitHubPublication,
-  facts: ReleaseFacts
+  facts: ReleaseFacts,
+  options: { readonly ignoreDraft?: boolean } = {}
 ): ReadonlyArray<Difference> => {
   const differences: Array<Difference> = []
   if (facts.tag !== publication.tag.toString()) {
@@ -462,7 +467,7 @@ const compareReleaseMetadata = (
   }
   const expectedBody = publication.body ?? ""
   if (facts.body !== expectedBody) differences.push(textDifference("release.body", expectedBody, facts.body))
-  if (facts.draft !== publication.draft) {
+  if (options.ignoreDraft !== true && facts.draft !== publication.draft) {
     differences.push(scalarDifference("release.draft", publication.draft, facts.draft))
   }
   if (facts.prerelease !== publication.prerelease) {
@@ -521,6 +526,14 @@ const decideFor = (
           })
         })
       }
+      if (plan?._tag === "PublishRelease") {
+        return NeedsMutation.make({
+          subject: publication.authority.subject,
+          precondition: MutationPrecondition.make({
+            kind: NonEmptyName.make("github-exact-draft-assets-complete")
+          })
+        })
+      }
       return ProviderBlocked.make({
         subject: publication.authority.subject,
         reason: SafeReason.make("GitHub absence carried no exact mutation plan.")
@@ -557,7 +570,9 @@ const appliedAttempt = (publication: PreparedGitHubPublication): Applied => Appl
   subject: publication.authority.subject,
   fact: ProviderMutationFact.make({
     subject: publication.authority.subject,
-    detail: SafeReason.make("GitHub accepted the release mutation and every planned asset upload.")
+    detail: SafeReason.make(
+      "GitHub accepted every mutation dispatched in this convergence phase; final equivalence still requires provider reobservation."
+    )
   })
 })
 
@@ -720,7 +735,10 @@ export const makeGithubSubjects = (
     if (release === undefined || !validateUploadUrl(publication, release.id, release.uploadUrl)) {
       return inconclusive(publication, "The GitHub release response omitted identity facts or carried an invalid repository-scoped upload template.")
     }
-    const releaseDifferences = compareReleaseMetadata(publication, release)
+    const stagedForPublicPromotion = publication.draft === false && release.draft === true
+    const releaseDifferences = compareReleaseMetadata(publication, release, {
+      ignoreDraft: stagedForPublicPromotion
+    })
     if (releaseDifferences.length > 0) return presentDifferent(publication, releaseDifferences)
 
     const listed = yield* listAllAssets(publication, http, grant, release.id)
@@ -799,6 +817,11 @@ export const makeGithubSubjects = (
       }
     }
     if (missingIndexes.length > 0) {
+      if (!release.draft) {
+        return presentDifferent(publication, missingIndexes.map((index) => scalarDifference(
+          `asset.${publication.assets[index]!.name}.count`, 1, 0
+        )))
+      }
       if (mutationMayStillBecomeVisible) {
         return pending(publication, "One or more intended GitHub assets are not yet visible after the accepted mutation.")
       }
@@ -814,6 +837,14 @@ export const makeGithubSubjects = (
         "A full paginated release-asset enumeration proved at least one intended asset name absent."
       )
     }
+    if (stagedForPublicPromotion) {
+      mutationPlan = { _tag: "PublishRelease", releaseId: release.id }
+      return absent(
+        publication,
+        "github-exact-draft-assets-complete",
+        "The exact private draft and complete asset set are ready for one final public transition."
+      )
+    }
     return PresentEquivalent.make({ subject: publication.authority.subject })
   })
 
@@ -837,14 +868,19 @@ export const makeGithubSubjects = (
         decision.proof.kind === "github-authenticated-repository-and-unique-tag"
       : plan._tag === "CreateRelease"
       ? decision._tag === "NeedsMutation" && decision.precondition.kind === "github-release-absent-at-exact-tag"
-      : decision._tag === "NeedsMutation" &&
+      : plan._tag === "UploadAssets"
+      ? decision._tag === "NeedsMutation" &&
         decision.precondition.kind === "github-intended-assets-authoritatively-absent"
+      : decision._tag === "NeedsMutation" &&
+        decision.precondition.kind === "github-exact-draft-assets-complete"
     if (!expectedDecision) {
       return yield* mutationFailure(publication, "The GitHub mutation decision does not match its observed precondition.")
     }
     const indexes = plan._tag === "CreateRelease"
       ? publication.assets.map((_, index) => index)
-      : [...plan.assetIndexes]
+      : plan._tag === "UploadAssets"
+      ? [...plan.assetIndexes]
+      : []
     const bytesByIndex = new Map<number, Uint8Array>()
     for (const index of indexes) {
       const asset = publication.assets[index]
@@ -866,7 +902,10 @@ export const makeGithubSubjects = (
       decision
     }
     let acceptedWrites = 0
-    const dispatch = Effect.fn("GitHubReleaseSubject.dispatch")(function*(request: MutationHttpRequest) {
+    const dispatch = Effect.fn("GitHubReleaseSubject.dispatch")(function*(
+      request: MutationHttpRequest,
+      acceptedStatus: 200 | 201
+    ) {
       const exchange = yield* executeMutation(mutationHttp, operation, request, grant)
       if (exchange._tag === "Failure") {
         if (acceptedWrites > 0 || exchange.error.commitment === "unknown") {
@@ -881,7 +920,7 @@ export const makeGithubSubjects = (
           "before-dispatch"
         )
       }
-      if (exchange.response.status === 201) {
+      if (exchange.response.status === acceptedStatus) {
         acceptedWrites += 1
         return { _tag: "Accepted", response: exchange.response } as const
       }
@@ -891,14 +930,15 @@ export const makeGithubSubjects = (
       ) } as const
     })
 
-    let uploadUrl: string
+    let releaseId: number
+    let uploadUrl: string | undefined
     if (plan._tag === "CreateRelease") {
       const body = JSON.stringify({
         tag_name: publication.tag.toString(),
         target_commitish: publication.targetCommit.toString(),
         name: publication.title.toString(),
         body: publication.body ?? "",
-        draft: publication.draft,
+        draft: true,
         prerelease: publication.prerelease
       })
       const created = yield* dispatch({
@@ -910,23 +950,28 @@ export const makeGithubSubjects = (
           "content-length": String(new TextEncoder().encode(body).length)
         },
         body
-      })
+      }, 201)
       if (created._tag === "Attempt") return created.attempt
       const facts = releaseFacts(parseJson(created.response.body))
-      if (facts === undefined || !validateUploadUrl(publication, facts.id, facts.uploadUrl) ||
-        compareReleaseMetadata(publication, facts).length > 0) {
+      if (facts === undefined || facts.draft !== true ||
+        !validateUploadUrl(publication, facts.id, facts.uploadUrl) ||
+        compareReleaseMetadata(publication, facts, { ignoreDraft: publication.draft === false }).length > 0) {
         return unknownAttempt(
           publication,
           "GitHub accepted release creation but its response did not establish the exact release identity and repository-scoped upload template."
         )
       }
+      releaseId = facts.id
       uploadUrl = facts.uploadUrl
-    } else {
+    } else if (plan._tag === "UploadAssets") {
+      releaseId = plan.releaseId
       uploadUrl = plan.uploadUrl
+    } else {
+      releaseId = plan.releaseId
     }
     for (const index of indexes) {
       const bytes = bytesByIndex.get(index)!
-      const uploaded = yield* dispatch(uploadRequest(publication, uploadUrl, index, bytes))
+      const uploaded = yield* dispatch(uploadRequest(publication, uploadUrl!, index, bytes), 201)
       if (uploaded._tag === "Attempt") return uploaded.attempt
       const intended = publication.assets[index]!
       const facts = releaseAssetFacts(publication, parseJson(uploaded.response.body))
@@ -939,6 +984,29 @@ export const makeGithubSubjects = (
         )
       }
     }
+    if (plan._tag === "PublishRelease") {
+      const body = JSON.stringify({ draft: false })
+      const published = yield* dispatch({
+        method: "PATCH",
+        url: `${publication.authority.audience}/releases/${releaseId}`,
+        headers: {
+          ...githubJsonHeaders,
+          "content-type": "application/json",
+          "content-length": String(new TextEncoder().encode(body).length)
+        },
+        body
+      }, 200)
+      if (published._tag === "Attempt") return published.attempt
+      const facts = releaseFacts(parseJson(published.response.body))
+      if (facts === undefined || facts.id !== releaseId || facts.draft !== false ||
+        !validateUploadUrl(publication, releaseId, facts.uploadUrl) ||
+        compareReleaseMetadata(publication, facts).length > 0) {
+        return unknownAttempt(
+          publication,
+          "GitHub accepted final release publication but its response did not establish the exact public release identity."
+        )
+      }
+    }
     return appliedAttempt(publication)
   })
 

package/src/release/capabilities.ts

@@ -113,8 +113,9 @@ export const contributeSourceArtifacts = (
         id, argv: preparation.run,
         cwd, inputs,
         outputs: [
-          output(preparation.outputs[0]!.id, preparation.outputs[0]!.path, preparation.outputs[0]!.kind ?? "file", preparation.outputs[0]!.mediaType),
-          ...preparation.outputs.slice(1).map((item) => output(item.id, item.path, item.kind ?? "file", item.mediaType))
+          output(preparation.outputs[0]!.id, render(preparation.outputs[0]!.path, config), preparation.outputs[0]!.kind ?? "file", preparation.outputs[0]!.mediaType),
+          ...preparation.outputs.slice(1).map((item) =>
+            output(item.id, render(item.path, config), item.kind ?? "file", item.mediaType))
         ]
       }))
       else preparations.push(GraphCommandCollection.make({

package/src/release/prepare.ts

@@ -5,16 +5,14 @@ import {
   existsSync,
   lstatSync,
   mkdirSync,
-  mkdtempSync,
   readFileSync,
   readdirSync,
   realpathSync,
   rmSync
 } from "node:fs"
 import { basename, isAbsolute, join, relative, resolve, sep } from "node:path"
-import { tmpdir } from "node:os"
 import { tarGz, zip, type ArchiveEntry } from "../drivers/archive.js"
-import { secureRead, secureWrite } from "../drivers/workspace.js"
+import { makeCanonicalTemporaryDirectory, secureRead, secureWrite } from "../drivers/workspace.js"
 import type {
   BunCompileRuntimeIdentity,
   CommandOutcome,
@@ -956,12 +954,12 @@ const runtimeIdentity = (
     : encodeCanonicalJson(bunCompileRuntimes),
   npmPack: npmPack === undefined ? "not-used" : encodeCanonicalJson(npmPack),
   releaseGraph,
-  preparer: "@mannyc1/ts-release@0.2.2"
+  preparer: "@mannyc1/ts-release@0.3.0"
 })
 
 export const prepareRelease = Effect.fn("prepareRelease")(function*(input: PreparationRequest) {
   const sourceRoot = input.context.workspace.toString()
-  const root = yield* attempt(() => mkdtempSync(join(tmpdir(), "ts-release-prepare-")))
+  const root = yield* attempt(() => makeCanonicalTemporaryDirectory("ts-release-prepare-"))
   try {
     const sourceSnapshot = yield* input.materializeSource(input.context, WorkspaceRoot.make(root)).pipe(Effect.mapError(failure))
     const context = stagedContext(input.context, root)

package/src/release/prepared-store.ts

@@ -161,8 +161,9 @@ const causeReason = (cause: unknown): string =>
     : String(cause)
 const canonicalDirectory = (directory: string): string => {
   if (!existsSync(directory)) mkdirSync(directory, { recursive: true, mode: 0o700 })
+  if (lstatSync(directory).isSymbolicLink()) fail("Prepared store root must not be a symlink.")
   const real = realpathSync(directory)
-  if (real !== directory) fail("Prepared store root must not be a symlink.")
+  if (!lstatSync(real).isDirectory()) fail("Prepared store root must be a directory.")
   return real
 }
 const syncDirectory = (directory: string): void => {
@@ -220,16 +221,16 @@ export interface CommittedPreparedRelease {
 }
 
 const readBundle = (directory: string): PreparedBundle => {
+  if (lstatSync(directory).isSymbolicLink()) fail("Prepared bundle directory must not be a symlink.")
   const real = realpathSync(directory)
-  if (real !== directory || lstatSync(directory).isSymbolicLink()) fail("Prepared bundle directory must not be a symlink.")
-  const bytes = secureRead(directory, "prepared-release.json").bytes
+  const bytes = secureRead(real, "prepared-release.json").bytes
   const manifest = decodePreparedRelease(bytes)
   if (manifest.kind !== "complete") fail("Prepared store refuses every unknown or partial bundle kind.")
   const manifestDigest = sha256Digest(bytes).hex
-  if (basename(directory) !== manifestDigest) fail("Prepared bundle directory does not match its manifest digest.")
-  const entries = readdirSync(directory, { withFileTypes: true })
+  if (basename(real) !== manifestDigest) fail("Prepared bundle directory does not match its manifest digest.")
+  const entries = readdirSync(real, { withFileTypes: true })
   if (entries.some((entry) => entry.name !== "prepared-release.json" && entry.name !== "blobs")) fail("Prepared bundle contains an unexpected top-level entry.")
-  const blobDirectory = join(directory, "blobs")
+  const blobDirectory = join(real, "blobs")
   if (!existsSync(blobDirectory) || lstatSync(blobDirectory).isSymbolicLink() || !statSync(blobDirectory).isDirectory()) fail("Prepared bundle is missing its real blobs directory.")
   const artifacts = artifactsById(manifest)
   validatePublications(manifest, artifacts)
@@ -241,7 +242,7 @@ const readBundle = (directory: string): PreparedBundle => {
   if (actualBlobs.size !== expectedBlobs.size || [...expectedBlobs].some((blob) => !actualBlobs.has(blob))) fail("Prepared bundle blob set does not match its manifest.")
   const blobs = new Map<string, Uint8Array>()
   for (const artifact of artifacts.values()) {
-    const blob = secureRead(directory, `blobs/${artifact.blob.hex}`).bytes
+    const blob = secureRead(real, `blobs/${artifact.blob.hex}`).bytes
     if (blob.length !== artifact.size || !digestEquals(sha256Digest(blob), artifact.digest)) fail(`Prepared blob ${artifact.id} failed size or digest verification.`)
     blobs.set(artifact.id.toString(), new Uint8Array(blob))
   }

package/templates/README.md

@@ -29,7 +29,7 @@ its publish job fails after preparation, rerun that failed job in the same
 workflow run so `${{ needs.prepare.outputs.prepared-ref }}` continues to name
 the original bundle. Do not create a new prepare run as recovery.
 
-The trusted-publishing job installs the Node 22.22.2 and npm 11.5.1
+The trusted-publishing job installs the Node 22.22.2 and npm 11.11.0
 publisher boundary explicitly. The reviewed prepare job has no OIDC or publish
 authority; only its publish job installs that publisher toolchain.
 Trusted configuration must name the invoking workflow and exact ref: the
@@ -49,7 +49,7 @@ explicit token-mode migration template for non-OIDC hosts; it names a
 credential reference but never contains a credential value.
 
 All public Action templates use the exact intended monorepo coordinate
-`mannyc2/ts-release/apps/ts-release-action@v0.2.2`. Do not switch it to a
+`mannyc2/ts-release/apps/ts-release-action@v0.3.0`. Do not switch it to a
 floating branch. Candidate certification must stop unless the immutable tag
 can exist at the exact result commit before a package README naming it is
 published.

package/templates/github-actions/release.yml

@@ -19,38 +19,55 @@ permissions:
 jobs:
   release:
     if: ${{ github.ref == 'refs/heads/main' && github.sha == inputs.candidate_sha }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       actions: read
       contents: write
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v4
+      - id: setup-node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22.22.2"
-      - uses: oven-sh/setup-bun@v2
+      - id: setup-bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: "1.3.14"
-      - run: bun add --global npm@11.5.1
+      - id: release-tools
+        name: Bind exact release tool paths
+        env:
+          SETUP_BUN_PATH: ${{ steps.setup-bun.outputs.bun-path }}
+        run: |-
+          node_path="$(type -P node)"
+          bun_path="$(type -P bun)"
+          [[ "$node_path" = /* && "$bun_path" = /* ]]
+          [[ "$("$node_path" --version)" == v22.22.2 ]]
+          [[ "$("$bun_path" --version)" == 1.3.14 ]]
+          [[ "$(realpath "$bun_path")" == "$(realpath "$SETUP_BUN_PATH")" ]]
+          echo "node-bin=$node_path" >> "$GITHUB_OUTPUT"
+          echo "bun-bin=$bun_path" >> "$GITHUB_OUTPUT"
+      - run: bun add --global npm@11.11.0
       - name: Prime isolated Bun dependency cache
         if: ${{ inputs.prepared_ref == '' }}
         run: |-
           bun install --frozen-lockfile --ignore-scripts --no-save --linker=hoisted
           bun --no-env-file --no-install -e 'await (await import("node:fs/promises")).rm("node_modules", { recursive: true, force: true })'
       - id: release
-        uses: mannyc2/ts-release/apps/ts-release-action@v0.2.2
+        uses: mannyc2/ts-release/apps/ts-release-action@v0.3.0
         env:
           GITHUB_TOKEN: ${{ github.token }}
+          TS_RELEASE_NODE_BIN: ${{ steps.release-tools.outputs.node-bin }}
+          TS_RELEASE_BUN_BIN: ${{ steps.release-tools.outputs.bun-bin }}
         with:
           command: ${{ inputs.prepared_ref == '' && 'release' || 'publish' }}
           config: ${{ inputs.prepared_ref == '' && 'release.config.json' || '' }}
           prepared: ${{ inputs.prepared_ref }}
       - name: Upload redacted release report
         if: ${{ always() && steps.release.outputs.report-ref != '' }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ts-release-report-${{ github.run_attempt }}
           path: ${{ steps.release.outputs.report-ref }}