fix(ci): 允许发布校验安装依赖 / allow publish validation dependency install

[tiye]

中文

问题

PR #28 合并后的 v0.2.0 publish run 已证明 MOON_CREDENTIALS 能被 Actions 正常读取，但 moon publish --frozen 在 MoonBit 自身的发布校验阶段失败。

moon publish 会解压生成的 ZIP 到全新临时模块并再次运行 moon check。该目录没有 .mooncakes，需要首次安装 moon.mod 声明的依赖；--frozen 禁止安装，因此日志精确报错：new modules need to be installed。

修复

• 与 ../respo.mbt 的成功发布配置保持一致，将最终 registry 命令改为 moon publish。
• 保留发布前所有确定性门禁：moon update/check/test/info/fmt、生成器、browser、build、moon package --frozen、17 文件白名单与 checksum。
• README 明确说明只有 MoonBit 内部 fresh-extraction validation 允许安装声明依赖；源代码与 package 输入仍由前置门禁冻结。

验证

• MOON_CREDENTIALS：上一 run 已进入实际 moon publish，认证 Secret 非空且成功加载。
• YAML parse：通过。
• git diff --check：通过。
• release metadata/package gate：通过，17/17 文件，意外文件 0。
• 参考证据：respo.mbt 的 release workflow 使用 moon publish，近 10 次 release runs 均成功。

合并后重新 dispatch v0.2.0，并跟踪 registry 与全新下游验证至完成。关联 #17。

---

English

Problem

The v0.2.0 publish run after PR #28 proves that Actions can read MOON_CREDENTIALS, but moon publish --frozen fails during MoonBit's own publication validation.

moon publish extracts the generated ZIP into a fresh temporary module and runs moon check again. That directory has no .mooncakes and must install dependencies declared by moon.mod; --frozen forbids that installation, producing the exact error new modules need to be installed.

Fix

• Matches the proven ../respo.mbt configuration by using moon publish for the final registry command.
• Keeps every deterministic pre-publish gate: moon update/check/test/info/fmt, generator, browser, build, moon package --frozen, the 17-file allowlist, and checksum.
• Documents that only MoonBit's internal fresh-extraction validation may install declared dependencies; source and package inputs remain frozen by the preceding gates.

Verification

• MOON_CREDENTIALS: the previous run reached real moon publish, proving the Secret is non-empty and loaded.
• YAML parse: passes.
• git diff --check: passes.
• Release metadata/package gate: passes with 17/17 files and zero unexpected files.
• Reference evidence: respo.mbt uses moon publish, and its latest ten Release runs succeeded.

After merge, dispatch v0.2.0 again and follow registry/fresh-downstream verification through completion. Tracks #17.

Summary by CodeRabbit

• Documentation

  • Updated release instructions to clarify dependency installation during package publishing.
  • Clarified that source and package inputs remain frozen and validated before publishing.

• Chores

  • Improved the release workflow’s publishing step to support validation from a freshly extracted package archive.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 91009da0-f40f-4d94-9e62-8f4f2068b0f3

📥 Commits

Reviewing files that changed from the base of the PR and between dce47fa and ed8f93e.

📒 Files selected for processing (2)

• .github/workflows/release.yml
• README.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The release workflow now runs moon publish without --frozen. The README explains that archive validation installs declared dependencies from a fresh extraction, while earlier release gates keep source and package inputs frozen.

Changes

Release publish validation

Layer / File(s)	Summary
Publish validation and release documentation .github/workflows/release.yml, README.md	The workflow removes --frozen from moon publish. The README documents dependency installation during archive validation and the frozen preceding release gates.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to ed8f9

The release workflow now allows dependency installation during MoonBit’s fresh-archive validation while retaining the preceding deterministic checks; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately identifies the CI fix and its purpose: allowing publish validation to install dependencies. It is specific, concise, and directly related to the main change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/actions-moon-publish-fix

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}