From f1a0460105b8b0c35d9540b49db4157673bab559 Mon Sep 17 00:00:00 2001
From: Dotta <bippadotta@protonmail.com>
Date: Tue, 17 Mar 2026 14:53:23 -0500
Subject: [PATCH 1/3] fix: reset lockfile changes before release publish

---
 .github/workflows/release.yml   | 6 ++++++
 doc/RELEASE-AUTOMATION-SETUP.md | 1 +
 2 files changed, 7 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5342b20f..1ef1726b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -92,6 +92,9 @@ jobs:
       - name: Install dependencies
         run: pnpm install --no-frozen-lockfile
 
+      - name: Restore tracked install-time changes
+        run: git checkout -- pnpm-lock.yaml
+
       - name: Configure git author
         run: |
           git config user.name "github-actions[bot]"
@@ -218,6 +221,9 @@ jobs:
       - name: Install dependencies
         run: pnpm install --no-frozen-lockfile
 
+      - name: Restore tracked install-time changes
+        run: git checkout -- pnpm-lock.yaml
+
       - name: Configure git author
         run: |
           git config user.name "github-actions[bot]"
diff --git a/doc/RELEASE-AUTOMATION-SETUP.md b/doc/RELEASE-AUTOMATION-SETUP.md
index 7e629c14..7f77003a 100644
--- a/doc/RELEASE-AUTOMATION-SETUP.md
+++ b/doc/RELEASE-AUTOMATION-SETUP.md
@@ -16,6 +16,7 @@ Note:
 
 - the release workflows intentionally use `pnpm install --no-frozen-lockfile`
 - this matches the repo's current policy where `pnpm-lock.yaml` is refreshed by GitHub automation after manifest changes land on `master`
+- the publish jobs then restore `pnpm-lock.yaml` before running `scripts/release.sh`, so the release script still sees a clean worktree
 
 ## 1. Merge the Repo Changes First
 

From 3921466aae0292d292c6e7ff822461252187b3f6 Mon Sep 17 00:00:00 2001
From: Dotta <bippadotta@protonmail.com>
Date: Tue, 17 Mar 2026 15:02:16 -0500
Subject: [PATCH 2/3] chore: auto-merge lockfile refresh PRs

---
 .github/workflows/refresh-lockfile.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.github/workflows/refresh-lockfile.yml b/.github/workflows/refresh-lockfile.yml
index a879e5bc..9f28fc28 100644
--- a/.github/workflows/refresh-lockfile.yml
+++ b/.github/workflows/refresh-lockfile.yml
@@ -79,3 +79,15 @@ jobs:
           else
             echo "PR #$existing already exists, branch updated via force push."
           fi
+
+      - name: Enable auto-merge for lockfile PR
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          pr_url="$(gh pr list --head chore/refresh-lockfile --json url --jq '.[0].url')"
+          if [ -z "$pr_url" ]; then
+            echo "Error: lockfile PR was not found." >&2
+            exit 1
+          fi
+
+          gh pr merge --auto --squash --delete-branch "$pr_url"

From 62e8fd494fa2fcf9327b21b0921838f3aa836c5f Mon Sep 17 00:00:00 2001
From: Dotta <bippadotta@protonmail.com>
Date: Tue, 17 Mar 2026 15:03:18 -0500
Subject: [PATCH 3/3] chore: expand github codeowners coverage

---
 .github/CODEOWNERS | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index ddff1460..43b61c45 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,10 +1,10 @@
 # Replace @dotta if a different maintainer or team should own release infrastructure.
 
-.github/workflows/release.yml @dotta
-scripts/release*.sh @dotta
-scripts/release-*.mjs @dotta
-scripts/create-github-release.sh @dotta
-scripts/rollback-latest.sh @dotta
-doc/RELEASING.md @dotta
-doc/PUBLISHING.md @dotta
-doc/RELEASE-AUTOMATION-SETUP.md @dotta
+.github/** @dotta @devinfoley
+scripts/release*.sh @dotta @devinfoley
+scripts/release-*.mjs @dotta @devinfoley
+scripts/create-github-release.sh @dotta @devinfoley
+scripts/rollback-latest.sh @dotta @devinfoley
+doc/RELEASING.md @dotta @devinfoley
+doc/PUBLISHING.md @dotta @devinfoley
+doc/RELEASE-AUTOMATION-SETUP.md @dotta @devinfoley