Require an out-of-repository operator signal before the release script can mutate version, publish, push, or tag.
- Add a reusable release authorization gate that allows dry-runs and blocks real releases without FUSION_RELEASE_AUTHORIZED.
- Invoke the gate in scripts/release.mjs before the first release mutation while preserving dry-run behavior.
- Cover blocked, authorized, dry-run, whitespace, TTY, and call-order behavior with script tests.
Files changed:
.../__tests__/release-authorization-gate.test.mjs | 70 ++++++++++++++++++++++
scripts/lib/release-authorization-gate.mjs | 30 ++++++++++
scripts/release.mjs | 26 +++++++-
3 files changed, 123 insertions(+), 3 deletions(-)
Fusion-Task-Id: FN-6480
Fusion-Task-Lineage: 5347552c-e395-4852-b389-6bbdba0e044e
81188f1996