ci(release): harden stable release orchestration and recovery

.github/workflows/release-cli.yml

@@ -1,13 +1,11 @@
-# Auto-releases CLI on push to:
-# - main (@next channel)
-# - stable (@latest channel)
+# Auto-releases CLI on push to main (@next channel).
+# Stable releases are orchestrated centrally by release-stable.yml.
 name: 📦 Release CLI
 
 on:
   push:
     branches:
       - main
-      - stable
     paths:
       # Keep in sync with apps/cli/.releaserc.cjs includePaths (patch-commit-filter).
       # Workflow paths trigger CI; includePaths control semantic-release commit analysis.
@@ -19,6 +17,7 @@ on:
       - 'packages/ai/**'
       - 'packages/word-layout/**'
       - 'packages/preset-geometry/**'
+      - 'shared/**'
       - 'scripts/semantic-release/**'
       - 'pnpm-workspace.yaml'
       - '!**/*.md'
@@ -29,7 +28,7 @@ permissions:
   packages: write
 
 concurrency:
-  group: ${{ github.ref_name == 'stable' && 'release-stable-writeback' || format('{0}-{1}', github.workflow, github.ref) }}
+  group: ${{ github.ref_name == 'stable' && 'release-stable' || format('{0}-{1}', github.workflow, github.ref) }}
   cancel-in-progress: ${{ github.ref_name != 'stable' }}
 
 jobs:

.github/workflows/release-create.yml

@@ -17,8 +17,8 @@ permissions:
   packages: write
 
 concurrency:
-  group: release-create-${{ github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.ref_name == 'stable' && 'release-stable' || format('{0}-{1}', github.workflow, github.ref) }}
+  cancel-in-progress: ${{ github.ref_name != 'stable' }}
 
 jobs:
   release:
@@ -36,6 +36,12 @@ jobs:
           fetch-depth: 0
           token: ${{ steps.generate_token.outputs.token }}
 
+      - name: Refresh stable branch head
+        if: github.ref_name == 'stable'
+        run: |
+          git fetch origin "${{ github.ref_name }}" --tags
+          git checkout -B "${{ github.ref_name }}" "origin/${{ github.ref_name }}"
+
       - uses: pnpm/action-setup@v4
 
       - uses: actions/setup-node@v6

.github/workflows/release-esign.yml

@@ -1,11 +1,11 @@
-# Auto-releases on push to main (@next) or stable (@latest)
+# Auto-releases on push to main (@next).
+# Stable releases are orchestrated centrally by release-stable.yml.
 name: 📦 Release esign
 
 on:
   push:
     branches:
       - main
-      - stable
     paths:
       - 'packages/esign/**'
       - 'packages/superdoc/**'
@@ -14,6 +14,7 @@ on:
       - 'packages/ai/**'
       - 'packages/word-layout/**'
       - 'packages/preset-geometry/**'
+      - 'shared/**'
       - 'pnpm-workspace.yaml'
       - '!**/*.md'
   workflow_dispatch:
@@ -23,8 +24,8 @@ permissions:
   packages: write
 
 concurrency:
-  group: release-esign-${{ github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.ref_name == 'stable' && 'release-stable' || format('{0}-{1}', github.workflow, github.ref) }}
+  cancel-in-progress: ${{ github.ref_name != 'stable' }}
 
 jobs:
   release:
@@ -42,6 +43,12 @@ jobs:
           fetch-depth: 0
           token: ${{ steps.generate_token.outputs.token }}
 
+      - name: Refresh stable branch head
+        if: github.ref_name == 'stable'
+        run: |
+          git fetch origin "${{ github.ref_name }}" --tags
+          git checkout -B "${{ github.ref_name }}" "origin/${{ github.ref_name }}"
+
       - uses: pnpm/action-setup@v4
 
       - uses: actions/setup-node@v6

.github/workflows/release-mcp.yml

@@ -17,8 +17,8 @@ permissions:
   packages: write
 
 concurrency:
-  group: release-mcp-${{ github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.ref_name == 'stable' && 'release-stable' || format('{0}-{1}', github.workflow, github.ref) }}
+  cancel-in-progress: ${{ github.ref_name != 'stable' }}
 
 jobs:
   release:
@@ -36,6 +36,12 @@ jobs:
           fetch-depth: 0
           token: ${{ steps.generate_token.outputs.token }}
 
+      - name: Refresh stable branch head
+        if: github.ref_name == 'stable'
+        run: |
+          git fetch origin "${{ github.ref_name }}" --tags
+          git checkout -B "${{ github.ref_name }}" "origin/${{ github.ref_name }}"
+
       - uses: pnpm/action-setup@v4
 
       - uses: actions/setup-node@v6

.github/workflows/release-react.yml

@@ -1,11 +1,11 @@
-# Auto-releases on push to main (@next) or stable (@latest)
+# Auto-releases on push to main (@next).
+# Stable releases are orchestrated centrally by release-stable.yml.
 name: 📦 Release react
 
 on:
   push:
     branches:
       - main
-      - stable
     paths:
       - 'packages/react/**'
       - 'packages/superdoc/**'
@@ -14,6 +14,7 @@ on:
       - 'packages/ai/**'
       - 'packages/word-layout/**'
       - 'packages/preset-geometry/**'
+      - 'shared/**'
       - 'pnpm-workspace.yaml'
       - '!**/*.md'
   workflow_dispatch:
@@ -23,8 +24,8 @@ permissions:
   packages: write
 
 concurrency:
-  group: release-react-${{ github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.ref_name == 'stable' && 'release-stable' || format('{0}-{1}', github.workflow, github.ref) }}
+  cancel-in-progress: ${{ github.ref_name != 'stable' }}
 
 jobs:
   release:
@@ -42,6 +43,12 @@ jobs:
           fetch-depth: 0
           token: ${{ steps.generate_token.outputs.token }}
 
+      - name: Refresh stable branch head
+        if: github.ref_name == 'stable'
+        run: |
+          git fetch origin "${{ github.ref_name }}" --tags
+          git checkout -B "${{ github.ref_name }}" "origin/${{ github.ref_name }}"
+
       - uses: pnpm/action-setup@v4
 
       - uses: actions/setup-node@v6

.github/workflows/release-sdk.yml

@@ -1,14 +1,12 @@
-# Auto-releases SDK on push to:
-# - main (@next channel)
-# - stable (@latest channel)
+# Auto-releases SDK on push to main (@next channel).
+# Stable releases are orchestrated centrally by release-stable.yml.
 # Also supports manual dispatch as a fallback for one-off releases.
 name: "\U0001F4E6 Release SDK"
 
 on:
   push:
     branches:
       - main
-      - stable
     paths:
       # Keep in sync with packages/sdk/.releaserc.cjs includePaths (patch-commit-filter).
       - 'packages/sdk/**'
@@ -20,22 +18,23 @@ on:
       - 'packages/ai/**'
       - 'packages/word-layout/**'
       - 'packages/preset-geometry/**'
+      - 'shared/**'
       - 'scripts/semantic-release/**'
       - 'pnpm-workspace.yaml'
       - '!**/*.md'
   workflow_dispatch:
     inputs:
       version:
-        description: "Version to release (e.g. 1.0.0-next.7). Leave empty to publish the current repo version."
+        description: 'Version to release (e.g. 1.0.0-next.7). Leave empty to publish the current repo version.'
         required: false
         type: string
       dry-run:
-        description: "Dry run — build and validate without publishing"
+        description: 'Dry run — build and validate without publishing'
         required: false
         type: boolean
         default: false
       npm-tag:
-        description: "npm dist-tag for Node SDK publish (e.g. latest, next). Only used for manual version override."
+        description: 'npm dist-tag for Node SDK publish (e.g. latest, next). Only used for manual version override.'
         required: false
         type: string
         default: latest
@@ -46,7 +45,7 @@ permissions:
   id-token: write # PyPI trusted publishing (OIDC)
 
 concurrency:
-  group: ${{ github.ref_name == 'stable' && 'release-stable-writeback' || format('{0}-{1}', github.workflow, github.ref) }}
+  group: ${{ github.ref_name == 'stable' && 'release-stable' || format('{0}-{1}', github.workflow, github.ref) }}
   cancel-in-progress: ${{ github.ref_name != 'stable' }}
 
 jobs:
@@ -85,15 +84,15 @@ jobs:
         with:
           node-version-file: .nvmrc
           cache: pnpm
-          registry-url: "https://registry.npmjs.org"
+          registry-url: 'https://registry.npmjs.org'
 
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.3.12
 
       - uses: actions/setup-python@v5
         with:
-          python-version: "3.12"
+          python-version: '3.12'
 
       - name: Install canvas system dependencies
         run: |
@@ -233,15 +232,15 @@ jobs:
         with:
           node-version-file: .nvmrc
           cache: pnpm
-          registry-url: "https://registry.npmjs.org"
+          registry-url: 'https://registry.npmjs.org'
 
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.3.12
 
       - uses: actions/setup-python@v5
         with:
-          python-version: "3.12"
+          python-version: '3.12'
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile