fix(ci): address review findings on PAT handling and install comments

- Pin gh auth setup-git before the git push it authenticates in both
  release and finalize workflow tests, so moving credential setup after
  the push no longer passes.
- Correct the replay comment: npm run generate is not a lifecycle
  script and workspace lifecycle scripts stay disabled.
- Drop the overstated push-boundary claim and record why the push
  needs the bot PAT rather than the job token.

.github/workflows/finalize-release.yml

@@ -71,7 +71,9 @@ jobs:
           NPM_CONFIG_PREFER_OFFLINE: 'true'
         run: |-
           npm ci --ignore-scripts --no-audit --progress=false
-          # Run only the repository-owned install steps skipped above.
+          # Replay the root postinstall (patch-package) and commit-info
+          # generation; dependency and workspace lifecycle scripts remain
+          # disabled.
           npm run postinstall
           npm run generate
 

.github/workflows/release.yml

@@ -100,7 +100,9 @@ jobs:
           NPM_CONFIG_PREFER_OFFLINE: 'true'
         run: |-
           npm ci --ignore-scripts --no-audit --progress=false
-          # Run only the repository-owned install steps skipped above.
+          # Replay the root postinstall (patch-package) and commit-info
+          # generation; dependency and workspace lifecycle scripts remain
+          # disabled.
           npm run postinstall
           npm run generate
 
@@ -173,7 +175,9 @@ jobs:
           NPM_CONFIG_PREFER_OFFLINE: 'true'
         run: |-
           npm ci --ignore-scripts --no-audit --progress=false
-          # Run only the repository-owned install steps skipped above.
+          # Replay the root postinstall (patch-package) and commit-info
+          # generation; dependency and workspace lifecycle scripts remain
+          # disabled.
           npm run postinstall
           npm run generate
 
@@ -233,7 +237,9 @@ jobs:
           NPM_CONFIG_PREFER_OFFLINE: 'true'
         run: |-
           npm ci --ignore-scripts --no-audit --progress=false
-          # Run only the repository-owned install steps skipped above.
+          # Replay the root postinstall (patch-package) and commit-info
+          # generation; dependency and workspace lifecycle scripts remain
+          # disabled.
           npm run postinstall
           npm run generate
 
@@ -282,7 +288,9 @@ jobs:
           NPM_CONFIG_PREFER_OFFLINE: 'true'
         run: |-
           npm ci --ignore-scripts --no-audit --progress=false
-          # Run only the repository-owned install steps skipped above.
+          # Replay the root postinstall (patch-package) and commit-info
+          # generation; dependency and workspace lifecycle scripts remain
+          # disabled.
           npm run postinstall
           npm run generate
 
@@ -401,7 +409,9 @@ jobs:
           NPM_CONFIG_PREFER_OFFLINE: 'true'
         run: |-
           npm ci --ignore-scripts --no-audit --progress=false
-          # Run only the repository-owned install steps skipped above.
+          # Replay the root postinstall (patch-package) and commit-info
+          # generation; dependency and workspace lifecycle scripts remain
+          # disabled.
           npm run postinstall
           npm run generate
 
@@ -443,8 +453,11 @@ jobs:
             git commit -m "chore(release): ${RELEASE_TAG}"
           fi
           if [[ "${IS_DRY_RUN}" == "false" ]]; then
-            # Restore the bot PAT only at the push boundary so dependency
-            # installation and build tooling cannot read write credentials.
+            # Restore the bot PAT in this step rather than persisting it in
+            # git credentials at checkout, so dependency installation and
+            # build tooling in earlier steps cannot read write credentials.
+            # The push itself needs the PAT (not the job token): pushes made
+            # with GITHUB_TOKEN do not trigger downstream CI workflows.
             # Export (not inline) so GH_TOKEN is still set when `git push`
             # invokes the credential helper, which re-resolves the token at
             # push time rather than at `gh auth setup-git` time.

scripts/tests/ai-release-notes-workflow.test.js

@@ -112,6 +112,9 @@ describe('stable release notes workflow', () => {
     expect(changelog).not.toContain('continue-on-error: true');
     expect(changelog).toContain("GH_TOKEN: '${{ secrets.CI_BOT_PAT }}'");
     expect(changelog).toContain('gh auth setup-git');
+    expect(changelog.indexOf('gh auth setup-git')).toBeLessThan(
+      changelog.indexOf('git push origin "${BRANCH_NAME}"'),
+    );
   });
 
   it('updates the changelog before opening the release PR', () => {

scripts/tests/package-scripts.test.js

@@ -446,9 +446,14 @@ describe('package scripts', () => {
     const exportTokenIdx = commitStep.indexOf(
       'export GH_TOKEN="${CI_BOT_PAT}"',
     );
-    expect(
-      commitStep.indexOf('gh auth setup-git', exportTokenIdx),
-    ).toBeGreaterThan(exportTokenIdx);
+    const setupGitIdx = commitStep.indexOf(
+      'gh auth setup-git',
+      exportTokenIdx,
+    );
+    expect(setupGitIdx).toBeGreaterThan(exportTokenIdx);
+    expect(setupGitIdx).toBeLessThan(
+      commitStep.indexOf('git push --force --set-upstream'),
+    );
     expect(buildStep).toContain('npm run build\n          npm run bundle');
   });