release: prepare v1.5.3 and repair pinned npm registry probes

[MisterWanted]

Scope

Prepare stable @groeponline/opencodex@1.5.3 after the OAuth/security and product consolidation merges.

• Bump package version to 1.5.3 and record the shipped changes in CHANGELOG.md.
• Use the npm binary pinned before Bun installation for release preflight and post-publication registry reads.
• Reset inherited registry authentication configuration before those public reads, avoiding the npm shim/blank-token failure that left 1.5.2 partially published.
• Add regression coverage for both registry-probe steps.

Security analysis

The exact workflow diff changes only the two registry-read steps: no trigger, runner, permission, secret, publish eligibility or deployment capability is added. NPM_PUBLISH_BIN is selected by the existing trusted setup step, not user input. NODE_AUTH_TOKEN is unset and setup-node's userconfig is rewritten to registry-only before reads; the isolated token fallback restores its own placeholder only for --ignore-scripts publishing. Package lifecycle scripts still receive no publish token. Existing expected-SHA, full-platform CI, service-lifecycle, version/channel and immutable metadata gates are unchanged. The retired runtime deploy route remains disabled.

Verification

All 92 release-workflow regressions pass in the isolated remote fixture. Product consolidation has already landed after 22 exact-head successful checks; its final GUI suite passed 631 tests. This four-file release commit requires its own CI before merge. Full-platform pre-release CI and service-lifecycle verification will run on the final merged release SHA, followed by dry-run then guarded publication. npm 1.5.3, tag v1.5.3 and matching GitHub Release were absent at preflight. No production deployment is requested or claimed.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 58 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: GroepOnline/opencodex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: e6062179-81ee-41e6-a90f-290ea5a36691

📥 Commits

Reviewing files that changed from the base of the PR and between 6a451f8 and a644e1b.

📒 Files selected for processing (4)

• .github/workflows/release.yml
• CHANGELOG.md
• package.json
• tests/ci-workflows.test.ts

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[MisterWanted]

Exact release-patch security verification

Reviewed a644e1b3f474eae429f1311655dac118b5597d4a against merged product base 6a451f8b6c556dc104eb25492f873daf96dd8224; the diff is exactly release.yml, package.json, CHANGELOG.md and tests/ci-workflows.test.ts.

Both edited shell blocks pass bash -n; all 92 workflow regression tests pass. Registry probes use the previously pinned npm binary, remove inherited NODE_AUTH_TOKEN, and restore a registry-only NPM_CONFIG_USERCONFIG. Existing lifecycle-build/token-fallback separation, expected-SHA/channel/version/CI/service checks and immutable publication behavior remain intact. No secrets, permissions, runner changes, deployment capability or extra provider credential destinations are introduced.

Observed preflight: npm 1.5.3 returned version-not-found (404), refs/tags/v1.5.3 was absent (404), and GitHub release v1.5.3 was null. Recheck before real publication. Publication uses only the existing guarded workflow, with deploy=false and first-publish=false; run full-platform CI and service-lifecycle on the final merged release SHA before dry-run/publication. No production cutover is authorized by this patch or claimed as evidence.