test(common): gate the release job's CLI invocations pre-merge - #1044

Closes #1035.

Problem

release.yml's Generate completions step shells out to the freshly built mip / min / minimald binaries — nine invocations at release.yml:724-732. They only ever execute on a workflow_dispatch release, so a breaking CLI change clears every PR gate, merges, and sits until someone cuts a release. That is exactly how #1009 (completions <shell> → completions print <shell>) shipped: twenty days later it exited 2 on run 30425725370 and took the GCS archive upload, the GitHub Release, and the whole stage-installer job down with it, an hour of build time in. #1034 fixed the call site; the structural gap stayed.

Fix

scripts/release-cli-smoke.sh reads those invocations back out of release.yml and replays them against the debug binaries. Nothing here is a hand-maintained copy of the release job's command list — both the artifact→binary map (from the mv min minimal-linux-amd64 rename step) and the invocations themselves are parsed from the workflow, so a call site the release job adds or edits is covered on the next run without touching the harness. Discovering zero invocations is a hard failure, never a green skip.

Each invocation is checked three ways, because exit 0 alone is too weak:

1. exits 0 and writes a non-empty file;
2. the shell it generates for matches the directory it is written to;
3. the shim registers the command its destination filename implies — bash/<cmd>, zsh/_<cmd>, fish/<cmd>.fish.

Check 3 is the one an exit-code-only gate would have missed: the #737 binary rename left the release job writing min's completions to files named minimal, which no shell autoloads, and that shipped silently until #1034. The check handles both shapes clap emits — mip/minimald's static (aot) generator and min's dynamic (env) registration shim.

.github/workflows/ is frozen and CODEOWNER-gated, so CI reaches the harness the same way it reaches scripts/lint-shell.sh (#899): a convention-discovered workspace test, crates/common/tests/release_cli_smoke.rs, run by the always-on Linux lanes' core-tests suite — the reviewed-code extension point in docs/ci-strategy.md §10. Plus just test-release-cli for a direct local run.

The test passes --build so a bare cargo test -p common builds what is missing rather than silently covering nothing. The build uses --workspace --bin <name> rather than -p <package> --bin <name> deliberately: selecting the whole workspace resolves features exactly as the workspace test build does, so after the core-tests suite it is a link or a no-op instead of a rebuild of every shared dependency under a narrower feature set (measured: 3 min for the narrow form locally).

Verification

• Reproduces Release-job CLI invocations have no pre-merge coverage — a breaking min/mip change only surfaces on a release run #1035 pre-merge. Pointed at the pre-fix(release): call min completions print in the release job #1034 workflow, the Rust test fails with FAIL … exited 2 — error: unrecognized subcommand 'bash' for all three min completions <shell> calls.
• Negative cases, against synthetic workflows: min completions written to a file named minimal (the refactor(minimal): name the CLI binary target min #737 class) → fails check 3; a zsh shim written to bash/ → fails check 2; an artifact with no rename line; a missing binary without --build; a workflow with no invocations → the zero-discovery guard.
• Green on main: 6 passed, 3 skipped. minimald is Linux-only (platform matrix), so its three invocations self-skip on macOS by name and run for real on the Linux lanes. 0.24 s when the binaries already exist.
• shellcheck clean; just lint-shell 25/25; cargo fmt --check; cargo clippy -p common --all-targets -- -D warnings; cargo test -p common. Full just ci is not runnable on this host — the macOS scope excludes common, so the new test's real run is the Linux lanes on this PR.

Audit

Per the issue's request to check the rest of the release path: the completions step is the only place the release and stage-installer jobs invoke a shipped binary. Everything else they run is gcloud, gh, tar, or a reviewed scripts/ helper that already has its own harness (install.sh → install_test.sh, verify-nightly-provenance.sh → verify-nightly-provenance_test.sh). Recorded in the script's SCOPE header, with a pointer to where discovery widens if a later step starts calling one of the binaries.

Complements #687's PR9b (post-release artifact smoke); this is the pre-merge half.

🤖 Generated with Claude Code