Fix npm pack JSON release validation

[Keesan12]

Summary

• accept both npm pack JSON envelopes used by supported npm versions
• retain the exact packed-file allowlist and retired-artifact rejection

Verification

• RED: focused test failed because object-envelope support was absent
• GREEN: root release guard tests 7/7
• public facade packed-artifact smoke: pass
• OSS boundary validation: GO
• git diff --check: pass

This fixes the trusted v0.5.0 release gate failure before any npm publication occurred.

Summary by CodeRabbit

• Bug Fixes

  • Improved release package validation to correctly process package file results in multiple supported formats.
  • Ensured valid packaged file paths are consistently identified during release checks.

• Tests

  • Added coverage for both supported package result formats.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a5ce3c35-1d50-40f4-b325-1a2b3a69b7b0

📥 Commits

Reviewing files that changed from the base of the PR and between 3bfa54b and 13e6a1c.

📒 Files selected for processing (2)

• scripts/root-release-guard.mjs
• scripts/tests/root-release-guard.test.mjs

---

📝 Walkthrough

Walkthrough

The release guard now uses an exported helper to extract packaged file paths from direct or array-wrapped npm pack results. Tests cover both result shapes.

Changes

Pack artifact extraction

Layer / File(s)	Summary
Extraction helper and release-guard coverage scripts/root-release-guard.mjs, scripts/tests/root-release-guard.test.mjs	extractPackFilePaths accepts direct and array-wrapped artifacts, extracts string paths, and returns an empty list when needed. inspectPackedFiles uses the helper. Tests cover both envelopes.

Estimated code review effort: 2 (Simple) | ~10 minutes

Mergeability Score: ⚪ Minimal · up to 13e6a

The release validation now accepts supported npm pack JSON envelopes while preserving the packed-file allowlist and retired-artifact rejection; no actionable merge-blocking risk remains after normal checks and review.

Possibly related PRs

• Keesan12/martin-loop#176: Refines the same pack-artifact extraction helper and adds overlapping tests.

Poem

I hopped through packs, both wide and thin,
Found every path tucked safely in.
Direct or wrapped, the files now show,
The guard can check them as they go.
Squeak—clean tests make carrots grow!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the primary change: fixing npm pack JSON release validation for supported artifact formats.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/release-pack-json

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}