fix: unblock lockfile action release

[peakematt]

The automatic v1 release after PR #10 failed with GitHub-signed release commit tree differs from the staged tree, leaving the lockfile repair action unpublished. The new scripts/scrub-lockfile.sh was executable in the staged package, but GitHub's createCommitOnBranch file additions cannot specify an executable mode for a new file.

This removes the helper's unnecessary executable bit (100755 → 100644). The controller, CI, and tests already invoke it through bash, so its behavior does not change. No publisher logic, signature verification, exact-tree checks, token permissions, or release workflow is changed.

The previous publisher mock returned the desired tree hash directly, hiding this mismatch. The regression now constructs an actual Git tree from the mutation payload, preserving existing file modes and assigning 100644 to new files against a five-file pre-scrub release fixture. The fixed package passes. Reintroducing the executable bit produces the same release error and verifies that neither discovery ref moves and the temporary staging branch is cleaned up. The packaged controller/normalizer tests also run successfully with the non-executable helper.

From the repository root, with Bash, Node.js 24+, Git, jq, and standard command-line utilities, no credentials or dependency installation are needed:

bash scripts/publish-release.test.sh
bash scripts/build-release.test.sh
node --test scripts/fix-lockfile.test.mjs scripts/scrub-npm-lockfile.test.mjs

These checks passed locally. The new publisher regression failed with the original file mode before the fix. All 49 Node tests, the existing shell suites, ShellCheck, shfmt, and workflow linting passed as well.

After this merges and main CI passes, the existing release workflow should publish the new action-only commit. This PR does not publish a release or manually move any refs; that live verification remains necessary after merge.

Failed release run:
https://github.com/workos/setup-socket-firewall/actions/runs/34853295286

Related work:
#10
https://linear.app/workos/issue/HELP-723

[linear-code]

HELP-723

[peakematt]

@greptile

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with no outstanding or newly introduced actionable issues.

Summary

• Updates release-build assertions to require the helper’s publication-compatible 100644 mode.
• Makes the publisher mock construct a mode-aware Git tree from the mutation payload.
• Adds regressions covering successful publication, exact-tree mismatch detection, unchanged discovery refs, and staging-branch cleanup.

_{Reviews (2) · Last reviewed commit: "fix: unblock lockfile action release wit..."}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.