infra(actions): restore release and native lifecycle execution

Problem

Craft v0.0.48 and its source tag are pushed, but GitHub creates no push/tag runs. A direct dispatch of native-lifecycle.yml at v0.0.48 returns HTTP 422: Actions has been disabled for this repository.

The repository endpoint reports enabled: true and allowed_actions: all, while the organization policy endpoint returns HTTP 403 and requires organization-admin Actions-policy permission. This confirms the effective block is above repository code/settings available to the current maintainer token.

Blocked publication:

• Releaser cannot sign/notarize macOS binaries, publish Pantry/npm packages, or create the GitHub Release.
• Native Package Lifecycle cannot retain repository-owned macOS, Linux, and Windows reports and installers.
• Stacks can consume and test the exact Craft source revision, but stable Craft publication must remain gated.

Current source:

• tag: v0.0.48
• revision: bf75807669e3af6cfb4ae34724be5c613442aee2
• Windows x64 MSI platform/install-root correction: 302460b1cf23706946ec0b91b4b79630636e3495 in the consuming Stacks history
• bounded macOS hdiutil contention retry is included in v0.0.48
• independent source-pinned lifecycle evidence is green in Stacks: https://github.com/stacksjs/stacks/actions/runs/29891017631 and https://github.com/stacksjs/stacks/actions/runs/29891194375

Acceptance criteria

• Organization Actions policy permits workflow dispatch and push/tag triggers for home-lang/craft.
• Dispatch Native Package Lifecycle at v0.0.48; all four target jobs pass.
• Confirm each matrix artifact contains report.json plus versioned installer artifacts and is retained for 90 days.
• Dispatch Releaser at v0.0.48; signing/notarization is mandatory and green.
• Confirm Pantry, npm, and GitHub Release publication succeeded for v0.0.48.
• Link the successful repository-owned runs and release from Stacks desktop support evidence.

Follow-up release v0.0.43 (f51ec37) adds the missing macOS Intel native lifecycle runner, so the defined matrix now covers macOS arm64, macOS x64, Linux x64, and Windows x64. This supersedes v0.0.42 for the acceptance run. Actions remains blocked at the organization/repository policy boundary; no release or lifecycle run was created automatically.

Pinned source candidate is now v0.0.44 (ddd23c7), which distinguishes the immutable Craft source revision from a downstream orchestrator revision in lifecycle reports. Use v0.0.44 for the acceptance runs and downstream Stacks evidence.

Retested the native path after pushing v0.0.48. Repository Actions permissions still report enabled/all, but workflow dispatch returns HTTP 422 "Actions has been disabled for this repository." Reading organization Actions policy returns HTTP 403 and requires organization-admin Actions-policy permission. No manual GitHub Release was created because that would bypass the intended signed Releaser workflow.

The Actions policy block described here is gone. What is left is a different set of blockers, all now identified.

The org policy no longer blocks anything. GET /repos/craft-native/craft/actions/permissions returns {"enabled": true, "allowed_actions": "all"}, and all three trigger types have demonstrably run since:

The HTTP 422 Actions has been disabled for this repository is not reproducible.

The remaining acceptance criteria are still unmet, for reasons unrelated to policy. Triaged in full this week:

• Releaser is red on both legs. The Linux leg dies cross-compiling x86_64-windows: build.zig disabled unwind tables for every non-debug build, which reaches the mingw-w64 CRT and fails with .seh_ directive must appear within an active frame. Fixed in #21, verified against the compiler CI actually installs. The darwin leg fails at "Require macOS release credentials" — the repo has exactly two secrets, NPM_TOKEN and PANTRY_TOKEN, and none of the seven APPLE_* values that gate requires. That gate was added in 1e50f98 on 2026-07-19, after the last green release, so it has never once passed. It needs an admin decision, not a code change.
• Native Package Lifecycle fails on three of four platforms. linux-x64 passes once #22 lands (a stale UDZO/ULMO assertion). darwin fails at scripts/native-lifecycle.ts:27, which sha256s the produced artifact — and on macOS that artifact is a .app, a directory: EISDIR: illegal operation on a directory. windows-x64 fails earlier, at "Install WiX Toolset v3".

On the target revision. This issue is scoped to v0.0.48 (2026-07-21). The tree is now at v0.0.66, and no tag between v0.0.38 and v0.0.66 has a GitHub release behind it — the last one that landed was v0.0.37 in May. Re-dispatching v0.0.48 would hit the same SEH failure, since the fix is not in that tag.

Worth knowing before the next attempt: the tag trigger itself is not firing. There are zero tag-push runs of release.yml between May and August despite ~29 tags existing, consistent with them having been delivered in one bulk git push --tags — GitHub suppresses workflow events past the first few in a single push. Push the next tag on its own and confirm a run starts, or use workflow_dispatch.

Suggest re-scoping this to the credentials decision, or closing it once a release actually publishes — the infrastructure half is done.

Both halves are working again.

Release: npm latest is 0.0.76, matching package.json and the newest tag — the needs: gating that made every publish wait on a macOS signing step, and silently stranded v0.0.56–v0.0.68, is gone.

Native lifecycle: runs on every PR that touches packaging. It was failing for an unrelated reason — bun test was reading its argument as a filter and walking the repo until it ran out of file descriptors — fixed in #59.