Remove the self-grantable FUSION_RELEASE_AUTHORIZED env signal and replace
it with an interactive prompt: a real release now requires a live human to
type "authorized" at a TTY. Releases can no longer run non-interactively
(no TTY is blocked outright), and --yes does not bypass the typed phrase.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Require an out-of-repository operator signal before the release script can mutate version, publish, push, or tag.
- Add a reusable release authorization gate that allows dry-runs and blocks real releases without FUSION_RELEASE_AUTHORIZED.
- Invoke the gate in scripts/release.mjs before the first release mutation while preserving dry-run behavior.
- Cover blocked, authorized, dry-run, whitespace, TTY, and call-order behavior with script tests.
Files changed:
.../__tests__/release-authorization-gate.test.mjs | 70 ++++++++++++++++++++++
scripts/lib/release-authorization-gate.mjs | 30 ++++++++++
scripts/release.mjs | 26 +++++++-
3 files changed, 123 insertions(+), 3 deletions(-)
Fusion-Task-Id: FN-6480
Fusion-Task-Lineage: 5347552c-e395-4852-b389-6bbdba0e044e
