feat(release): prepare ASF npm candidates

[M4n5ter]

English

Summary

• add a credential-free, upstream-only workflow that prepares one unsigned npm convenience candidate from the exact ASF source RC reference;
• reuse the immutable CLI validation matrix and carry the same tarball through Linux, macOS, Windows, and Eval checks;
• generate the ASF-specific SHA-512 sidecar only at handoff, then write a closed record binding the tarball bytes to the source reference, commit, repository, workflow run, and attempt;
• reject fork provenance and partial job re-runs, and revalidate the live tag target and main ancestry immediately before upload;
• document the Release Manager handoff and the boundary around tag-signature authentication, voting, credentials, and publication.

Trust boundary

The Release Manager and source-release process remain the sole authority for deciding that a source RC tag is signed by a key in the trusted ASF KEYS material. This workflow pins the selected annotated tag, commit, and validated npm bytes; it does not authenticate the tag signature or establish source-release approval.

A partial job re-run is intentionally rejected because it could combine authorization and artifact facts from different workflow attempts. Use Re-run all jobs instead.

Scope and dependency

This is the first, non-publishing slice of G8. It depends on #3222 for unified product identity, npm package construction, and the reusable validation workflow.

The workflow does not sign artifacts, call npm staging or publication, modify dist-tags, or claim that the source release has passed either required vote. Those requirements remain tracked in #3275.

Refs #3275.

Verification

• node --test scripts/asf-npm-candidate.test.mjs scripts/asf-npm-workflow-policy.test.mjs
• mise exec go -- go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github/workflows/asf-npm-candidate.yml .github/workflows/cli-package-validation.yml
• npm run build
• npm run format:check
• npm run lint
• npm run check:release
• real npm tarball creation, confirmation that the generic pack emits no SHA-512, ASF record creation, and independent verification
• npm run release:cli:smoke

简体中文

概述

• 新增无凭据、仅允许上游仓库运行的工作流，从精确的 ASF 源码 RC reference 准备唯一的未签名 npm convenience candidate；
• 复用不可变 CLI 验证矩阵，让同一份 tarball 通过 Linux、macOS、Windows 和 Eval 检查；
• 只在 ASF handoff 边界生成 SHA-512，并写入闭合记录，将 tarball 字节绑定到源码 reference、commit、仓库、workflow run 和 attempt；
• 拒绝 fork provenance 和部分 job 重跑，并在上传前重新验证 live tag target 与 main ancestry；
• 记录 Release Manager 交接流程，明确 tag 签名认证、投票、凭据和发布的职责边界。

信任边界

只有 Release Manager 和 source-release 流程有权判断 source RC tag 是否由可信 ASF KEYS 中的密钥签名。该工作流只固定所选 annotated tag、commit 和已经验证的 npm 字节；它不会认证 tag 签名，也不会建立源码 release 已获批准的事实。

部分 job 重跑会混合不同 workflow attempt 的 authority 与 artifact 事实，因此被刻意拒绝；应使用 Re-run all jobs。

范围与依赖

这是 G8 的第一个非发布阶段。它依赖 #3222 提供统一产品身份、npm 包构建和可复用验证工作流。

该工作流不签名、不调用 npm staging 或发布、不修改 dist-tag，也不声称源码 release 已通过任一必要投票。其余要求继续由 #3275 跟踪。

Refs #3275。

验证

• node --test scripts/asf-npm-candidate.test.mjs scripts/asf-npm-workflow-policy.test.mjs
• mise exec go -- go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github/workflows/asf-npm-candidate.yml .github/workflows/cli-package-validation.yml
• npm run build
• npm run format:check
• npm run lint
• npm run check:release
• 实际 npm tarball 构建、确认通用 pack 不生成 SHA-512、ASF record 生成以及独立验证
• npm run release:cli:smoke