chore: prepare v3.0.0-rc.1

[olliethedev]

Prepares the first v3 release candidate for issue #153.\n\n- makes the release workflow prerelease-aware and publishes both packages under the same npm dist-tag\n- makes publish retries idempotent and verifies versions, integrity metadata, and stable latest\n- sets @btst/stack to 3.0.0-rc.1 and @btst/codegen to 0.2.0-rc.1\n- validated build, typecheck, lint, knip, unit, registry, init smoke, and all three framework E2E suites\n\nThe workflow commit will also be proposed separately to main because GitHub evaluates release-event workflows from the default branch.

---

Note

Medium Risk
Touches the production npm publish path (dist-tags, skip-if-published, post-publish verification). A tagging or verification bug could publish to the wrong channel or fail a release, but it does not change product runtime code.

Overview
Bumps @btst/stack to 3.0.0-rc.1 and @btst/codegen to 0.2.0-rc.1, and makes the GitHub release workflow safe for prereleases.

The workflow now chooses a shared npm dist-tag (latest vs next) from hyphenated versions or GitHub prerelease flags, publishes both packages with that tag, and skips already-published versions. After publish it waits for registry consistency, checks integrity metadata, and fails if a prerelease would move @btst/stack@latest off a stable version. Permissions drop to contents: read, install uses --frozen-lockfile, and the artifact action is pinned.

^{Reviewed by Cursor Bugbot for commit 5f2266e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
better-stack-docs	Error		Aug 21, 2026 7:20pm
better-stack-playground	Ready	Preview	Aug 21, 2026 7:20pm

[cursor]

Security Review — no high-confidence vulnerabilities found

This PR is a net security improvement to the release pipeline. All changes reviewed against the threat model (injection, authz bypass, secrets handling, supply chain, SSRF/XSS).

Positive changes

Change	Benefit
contents: write → contents: read	Least-privilege; the workflow cannot push/force-push to the repo even if the job is compromised.
pnpm install --frozen-lockfile	Prevents lockfile drift; a tampered or floating dep can no longer silently land in a release build.
actions/upload-artifact pinned to commit SHA (ea165f8d…)	Tag-mutable supply chain attack eliminated; the exact code is fixed at pin time.
${{ github.event.release.tag_name }} moved from direct shell interpolation to env: block	Eliminates the command-injection vector present in the old run: step where a tag containing shell metacharacters (e.g. a tag named v1.0.0`curl evil`) could execute arbitrary commands in the runner. The new pattern safely passes the value as an environment variable.
set -euo pipefail added throughout	Prevents silent failures from masking errors mid-script; reduces the risk of a partially-failed publish going undetected.

Low-risk observations (no remediation required)

1. GITHUB_PRERELEASE env var name — The GITHUB_ prefix is reserved by GitHub for system-provided variables. Renaming to IS_PRERELEASE or RELEASE_IS_PRERELEASE avoids any risk of shadowing a future GitHub-added variable. Not a current security issue.

2. @btst/codegen version not validated against the release tag — Only @btst/stack is checked against the git tag version. An accidental mismatch in the codegen package version would still publish. This is a correctness gap, not a security vulnerability.

3. Integrity check is non-empty only — STACK_INTEGRITY and CODEGEN_INTEGRITY are checked for non-empty but not cross-referenced against a known-good digest. This is inherent to the publish-then-verify pattern and cannot be meaningfully tightened without a separate SLSA attestation step; the existing --provenance flag already addresses this at the npm level.

Verdict

No vulnerabilities. The command-injection risk from the previous version of this workflow is fully addressed. The permission reduction and lockfile enforcement are meaningful supply-chain hardening. The remaining observations are cosmetic or out of scope for this PR.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5f2266e64e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Pin prerelease codegen to the prerelease stack channel

When someone runs npx @btst/codegen@next init in a fresh project while latest still points to v2, this RC's installInitDependencies installs the bare spec @btst/stack (packages/cli/src/utils/package-installer.ts:37-45). npm's bundled npm-install documentation states that a bare <name> uses the latest tag, so the v3-generated templates are paired with the stable v2 stack rather than 3.0.0-rc.1 and can fail against the breaking v3 API changes. Make the prerelease CLI install @btst/stack@next or otherwise propagate its release channel.

Useful? React with 👍 / 👎.

[github-actions]

✅ Shadcn registry validated — no registry changes detected.