[AAASM-3503] 🔧 (ci): SDK release operator-dispatch only (no auto-publish on core release)

[Chisanan232]

What changed

Removes the repository_dispatch: agent-assembly-release-published trigger from release-node.yml, making it operator-dispatch-only (workflow_dispatch). The now-unreachable repository_dispatch resolve branch and its client_payload reference are removed; the publish/docs if: gates already keyed off dry_run/publish_mode outputs and are unaffected.

Why

The core agent-assembly release.yml notify-downstream step fires this repository_dispatch on every core publish. The resolve step set npm_version="${DISPATCH_PAYLOAD_TAG#v}" (the core tag), publish_mode=all, and forced dry_run=false — a real publish. Because the Node SDK has an independent version iterator and is at/ahead of the core-derived version, npm rejects the duplicate and the publish step fails on every core release.

• Recurring failures: node run 27861677199 (2026-06-20T05:34Z) and again 2026-06-15T09:36Z — builds succeed, only publish fails.
• Violates the independent-per-repo-version model and the AAASM-3007 operator-gated SDK-release SOP. The real beta.4 publish succeeded via manual workflow_dispatch.
• The core already has a separate update-node-sdk-ffi-pin PR job, so the FFI-pin handoff does not depend on this dispatch — dropping the trigger loses nothing.

How to verify

• actionlint .github/workflows/release-node.yml is clean.
• workflow_dispatch path (the working manual release path, incl. main-only and dry-run) is unchanged.
• No remaining client_payload references.

Relates AAASM-3503. References AAASM-3007 (operator-gated SDK-release SOP).

Note: merge after confirming no in-flight release window.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Chisanan232]

Merge-readiness review — READY to approve ✅

CI: all 17 checks green. test (18/20/22/24), napi-build (20/22), quality, module-smoke (18/20/22), Analyze ×2 + CodeQL, coverage-and-analysis, codecov/patch, SonarCloud — all pass. No red, no acceptance-class exceptions needed.

Scope vs AAASM-3503 — complete and correct for node-sdk:

• repository_dispatch: agent-assembly-release-published trigger removed; on: now workflow_dispatch-only. ✅
• Unreachable resolve branch removed; the fall-through else now hard-errors workflow_dispatch-only. ✅
• No dangling client_payload / DISPATCH_PAYLOAD_TAG references remain (verified by grep — the only repository_dispatch hits are explanatory comments). ✅
• workflow_dispatch path fully intact: npm_version, binary_source_tag, publish_mode (incl. main-only), dry-run inputs and all downstream if: gates (publish / main-only bump / docs-version) unchanged. ✅
• actionlint clean. ✅
• Consistent with sibling python-sdk PR Bump napi from 3.9.2 to 3.9.3 in /native/aa-ffi-node #157 (same AAASM-3503, same operator-dispatch-only fix). ✅

Correctness note: the FFI-pin handoff does not depend on this dispatch (core's update-node-sdk-ffi-pin PR job handles it), so dropping the trigger loses nothing — matches the AAASM-3007 operator-gated SOP.

Verdict: READY to merge. This is operator-gated by design; beta.3/beta.4 are already fully published and there is no in-flight release window, so the PR-body "merge after confirming no in-flight release" condition is satisfied. Leaving the actual merge to the operator per policy.

— Claude Code