feat(ci): let release artifacts be attached to a hand-cut tag

[andreszorro]

This commit was on the branch for #8 but is not on main — #8 merged at 424cc94, one commit before 988d5b4 was pushed. Re-proposing just that commit.

It matters for the v1.0.0 release in #9: without it, release-assets can only run behind release-please, so a tag created by hand produces a Release with no tarball, no rendered example and no checksums, and no way to fill it afterwards.

release-assets now also accepts workflow_dispatch with a tag. Before building anything it checks that the tag looks like a release tag, that it exists, and that a Release exists to attach to — then derives the version from the tag rather than from release-please's output, so both entry points agree.

🤖 Generated with Claude Code

[upwind-code-us]

Upwind Code Scan - ✅ Proceed with Deployment

0 newly introduced vulnerabilities · 0 resolved · 1 total in this PR vs the default branch

🔴 1 Critical

View full analysis in Upwind Console

Scan completed in 34s

Scan history (2 scans)

Commit	Scanned at	New	Resolved	Net
988d5b4	2026-08-17 00:54 UTC	—	—	—
988d5b4 <	2026-08-17 00:54 UTC	0	0	0

Last scanned: 988d5b4 · 2026-08-17 00:54 UTC

[andreszorro]

No fix pushed, because the scan reports no new finding and the pre-existing one is held deliberately. Detail, since a red "1 Critical" badge otherwise stops the next reader:

Nothing was introduced here. This PR changes exactly one file — .github/workflows/release.yml — and touches no manifest and no lockfile, so it cannot introduce a dependency vulnerability. The scan agrees: 0 newly introduced, 0 resolved, verdict Proceed with Deployment.

The 1 finding is GHSA-mw96-cpmx-2vgc in rollup, reached through vite > rollup, and it is pinned on purpose. package.json holds rollup at exactly 4.52.5, and renovate.json carries a rule with enabled: false so a security PR cannot silently undo it.

Why it is not simply patched: the advisory's fixed version is >=4.59.0, and scripts/escapes.js parses the built bundle with parseAst, which vite re-exports from rollup's native parser. I re-verified this just now in a throwaway directory rather than trusting the note:

$ npm install rollup@4.59.0 && node -e "require('rollup/parseAst').parseAst('\"\\uD800\";')"
called `Option::unwrap()` on a `None` value

That is precisely the input scripts/escapes.test.js feeds it — a directive prologue holding a lone-surrogate escape. Taking the patch makes pnpm test fail.

Why holding it is the lesser harm: rollup is a devDependency and a build-time parser. It is not among the packages inlined into rendered output, so nothing reaches a user of a generated site. The guard it supports still refuses rather than emit an unsafe artifact.

Lift the pin when node --test scripts/escapes.test.js passes on a newer rollup, or when escapes.js stops depending on that parser — both are recorded in the renovate.json rule.

No inline comments were left on this PR, so there are no threads to reply to or resolve.

🤖 Addressed by Claude Code