fix(release): defer registry and public publication by default

Author: ngallodev

.github/workflows/promote-qualified-release.yml

@@ -7,6 +7,11 @@ on:
         description: "Existing DRAFT release tag qualified on luigi.home.arpa (vX.Y.Z or prerelease)"
         required: true
         type: string
+      publish_registries:
+        description: "Publish npm/PyPI packages and make the GitHub release public (requires registry credentials)"
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -51,6 +56,7 @@ jobs:
             --expected-source-commit "$SOURCE_COMMIT"
 
   publish-registries:
+    if: ${{ !cancelled() && needs.verify-external-qualification.result == 'success' && inputs.publish_registries }}
     needs: [verify-external-qualification]
     runs-on: ubuntu-latest
     permissions:
@@ -103,6 +109,7 @@ jobs:
           twine upload --non-interactive --skip-existing dist/*
 
   publish-final:
+    if: ${{ !cancelled() && needs.verify-external-qualification.result == 'success' && needs.publish-registries.result == 'success' && inputs.publish_registries }}
     needs: [verify-external-qualification, publish-registries]
     runs-on: ubuntu-latest
     permissions:

.github/workflows/release.yml

@@ -36,6 +36,11 @@ on:
         required: false
         type: boolean
         default: true
+      publish_registries:
+        description: "Publish npm/PyPI packages and make the GitHub release public (requires registry credentials)"
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -456,7 +461,7 @@ jobs:
   # release stays in draft so we can re-run without a half-shipped state.
   publish-registries:
     needs: [verify]
-    if: ${{ !cancelled() && !failure() && needs.verify.result == 'success' && !inputs.hold_for_external_qualification }}
+    if: ${{ !cancelled() && !failure() && needs.verify.result == 'success' && !inputs.hold_for_external_qualification && inputs.publish_registries }}
     runs-on: ubuntu-latest
     permissions:
       contents: read

BACKLOG.md

@@ -80,3 +80,8 @@
   is all-platform and its default Windows qualification hold remains in force.
   Setting that hold to false is not a Linux-only release mode. See the canonical
   upstream ledger's Linux publication readiness audit for live configuration evidence.
+
+- [ ] Public/registry publication is deferred by maintainer instruction.
+  `publish_registries=false` is now the default in release and promotion CI;
+  npm/PyPI credentials are only required when opting in. Draft qualification
+  still requires VirusTotal and applicable Windows evidence.

docs/UPSTREAM_308_CANDIDATE_AUDIT_20260912.md

@@ -250,3 +250,10 @@ Publication blockers in the existing all-platform `release.yml`:
 Obtain the service credentials through their providers and supply a local
 credential-file or secret-manager reference for secure GitHub secret setup.
 Do not commit token values or remove release checks to bypass missing secrets.
+
+Maintainer update: defer all public/registry publication. Both release and
+promotion workflows now expose `publish_registries` with default false.
+Default dispatches skip npm/PyPI jobs and public un-drafting, so registry
+credentials are not required to create/verify a draft candidate. VirusTotal
+and the external qualification hold remain unchanged. Publication is still
+blocked until explicitly opted in, with credentials and qualification evidence.

tests/test_release_gate_chain_contract.sh

@@ -354,6 +354,22 @@ for token in ("release-candidates.tsv", "virustotal-candidate-results.tsv",
         failures.append(
             f"release verify: existing candidate evidence is not reused: {token}")
 
+# Registry publication is opt-in in both entry points; default runs stay draft.
+for workflow_name in ("release.yml", "promote-qualified-release.yml"):
+    source = pathlib.Path(sys.argv[1]).with_name(workflow_name).read_text()
+    option = re.search(r"^      publish_registries:\s*\n(?P<body>(?:^        .*\n?)*)", source, re.M)
+    if not option or not re.search(r"^        default: false$", option.group("body"), re.M):
+        failures.append(f"{workflow_name}: publishing must default to false")
+    jobs = workflow_jobs(source)
+    registry = jobs.get("publish-registries", "")
+    condition = re.search(r"^    if:.*$", registry, re.M)
+    if not condition or "inputs.publish_registries" not in condition.group():
+        failures.append(f"{workflow_name}: registry job must require publishing opt-in")
+    final = jobs.get("publish-final", "")
+    condition = re.search(r"^    if:.*$", final, re.M)
+    if not condition or "needs.publish-registries.result == 'success'" not in condition.group():
+        failures.append(f"{workflow_name}: public release requires registry success")
+
 if failures:
     for f in failures:
         print("FAIL: " + f, file=sys.stderr)