chore: release v0.2.0

.github/workflows/release.yml

@@ -29,6 +29,16 @@ jobs:
 
       - run: bun install --frozen-lockfile
 
+      - name: Validate release tag
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: |
+          VERSION=$(node -p "require('./packages/cli/package.json').version")
+          if [ "$GITHUB_REF_NAME" != "v$VERSION" ]; then
+            echo "release tag $GITHUB_REF_NAME does not match package version $VERSION" >&2
+            exit 1
+          fi
+          echo "RELEASE_VERSION=$VERSION" >> "$GITHUB_ENV"
+
       - run: bun run typecheck
 
       - name: Install desktop test dependencies
@@ -63,6 +73,10 @@ jobs:
 
       - run: bun run build
 
+      - name: Install npm with trusted publishing support
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: npm install --global npm@11.5.1
+
       - name: Upload sourcemaps to Sentry
         if: startsWith(github.ref, 'refs/tags/v')
         env:
@@ -74,22 +88,31 @@ jobs:
             echo "SENTRY_AUTH_TOKEN not set; skipping"
             exit 0
           fi
-          VERSION=$(node -p "require('./packages/cli/package.json').version")
           if ! {
             npx --yes @sentry/cli sourcemaps inject packages/cli/dist &&
-            npx --yes @sentry/cli sourcemaps upload --release "picklab@$VERSION" packages/cli/dist
+            npx --yes @sentry/cli sourcemaps upload --release "picklab@$RELEASE_VERSION" packages/cli/dist
           }; then
             echo "::warning::Sentry sourcemap upload failed; continuing release"
           fi
 
       - name: Publish @pickforge/picklab
         if: startsWith(github.ref, 'refs/tags/v')
         working-directory: packages/cli
-        run: npm publish --access public --provenance
+        run: |
+          if npm view "@pickforge/picklab@$RELEASE_VERSION" version >/dev/null 2>&1; then
+            echo "@pickforge/picklab@$RELEASE_VERSION is already published; skipping"
+          else
+            npm publish --access public --provenance
+          fi
 
       - name: Create GitHub release
         if: startsWith(github.ref, 'refs/tags/v')
         env:
           GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ github.ref_name }}
-        run: gh release create "$RELEASE_TAG" --generate-notes
+        run: |
+          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
+            echo "GitHub release $RELEASE_TAG already exists; skipping"
+          else
+            gh release create "$RELEASE_TAG" --draft --generate-notes
+          fi

AGENTS.md

@@ -49,14 +49,15 @@ Repo-local guide for agents working in PickLab.
   internal/release changes, what was tested, what was not tested yet, and known
   blockers. At release time, use it to polish the generated GitHub release
   description, then reset the draft.
-- Bump `packages/cli/package.json` to the new version, land on `main`, tag
-  `vX.Y.Z`, push the tag. CI runs the full suite, publishes
-  `@pickforge/picklab` to npm, and creates the GitHub release — both go live
-  without manual steps, so make sure `main` is truly ready before tagging.
-- The GitHub release description is the single source of release notes
-  (`--generate-notes` drafts it; edit it after if the generated list reads
-  poorly). pickforge.dev/picklab shows the latest release via the GitHub API —
-  no website change needed for a normal release.
+- Bump every workspace package manifest and `bun.lock` to the new version, land
+  on `main`, tag `vX.Y.Z`, and push the tag. CI validates the tag/package match,
+  runs the full suite, publishes `@pickforge/picklab` to npm, and creates a draft
+  GitHub release. Make sure `main` is truly ready before tagging because npm goes
+  live without a manual gate.
+- The GitHub release description is the single source of release notes. A human
+  polishes the generated draft from `docs/releases/UNRELEASED.md` and publishes
+  it; pickforge.dev/picklab then shows it via the GitHub API. Reset UNRELEASED
+  after publication. No website change is needed for a normal release.
 - Only touch `landing-page` (`src/pages/products.ts`) when the install story
   or positioning changes.
 ## Workspace policy