fix: manual release runs should version pending changesets and always re-deploy

[abueide]

Summary

Manually workflow_dispatch-ing this workflow to test deploy-cdn (against a non-release commit - no pending changeset, no version bump) surfaced create-release-from-tags throwing No git tags found, since changeset publish correctly produced zero new tags (nothing new to publish). That's an expected outcome for a no-op release run, not a failure - it now logs and returns instead of throwing.

Deploy to CDN never got a chance to run in that failed run, since it depends on publish succeeding - this fix is what actually lets deploy-cdn run on a manual dispatch that isn't a real version bump, so the current build gets re-uploaded to the CDN.

What this PR does NOT do (reverted from an earlier version)

An earlier version of this PR also had a manual workflow_dispatch run version pending changesets directly and push a "Version Packages" commit straight to master, bypassing PR review. That was wrong: a release should be a read-only operation against a commit already on master - tag it, publish it to npm, cut a GitHub release, deploy it to the CDN - never a vehicle for landing new code (a version bump is a code change and belongs in a reviewed PR like every other change). That step has been removed.

The correct fix for "how does a new version actually get released" is making the normal, reviewed path work again: release-creator.yml opens a "Version Packages" PR for pending changesets, someone reviews and merges it, and that merge is the commit a release tags and publishes.

Also: build once, share the artifact between npm publish and CDN deploy

publish and deploy-cdn each ran their own full build independently (yarn build --force inside yarn release, and yarn . build inside release:cdn) - double the build time, and no guarantee the two destinations ever got the exact same bits, since each build was a separate yarn install + compile on a separate runner.

Added a build job that runs once (after test passes), uploads packages/*/dist and packages/consent/*/dist as a single GitHub Actions artifact (actions/upload-artifact/download-artifact - both GitHub-owned, no allowed-actions issue). publish and deploy-cdn now both depend only on build (not on each other, so they run in parallel) and download that same artifact instead of rebuilding:

• release:publish-only (new script) is release minus the clean+build - just changeset publish, tag push, and CDN cache purge.
• release:cdn:no-build (new script, packages/browser) is release:cdn minus the yarn . build prefix.

Both now publish/deploy the exact same, single build the build job produced.

Separately found, not fixed here

release-creator.yml (opens the "Version Packages" PR) has failed with startup_failure on every run since at least 2026-07-16 - 0 jobs run, consistent with a workflow-level rejection rather than a step failure. Strong suspicion: changesets/action@a45c4d594 is a third-party action, likely hitting the same allowed-actions restriction fixed for aws-actions/configure-aws-credentials in #1393. Fixing that is the actual path to cutting new releases again - not addressed in this PR.

Test plan

• scripts/create-release-from-tags/__tests__/index.test.ts still passes
• tsc clean repo-wide (pre-push hook, 14/14 packages)
• Manual workflow_dispatch run against current master (no pending version bump) completes build, publish, and deploy-cdn without error, with publish/deploy-cdn running in parallel and neither rebuilding

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 33111f9

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.59%. Comparing base (1e9ac21) to head (a0db5be).
⚠️ Report is 1 commits behind head on master.

⚠️ Current head a0db5be differs from pull request most recent head 33111f9

Please upload reports for the commit 33111f9 to get more accurate results.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1394   +/-   ##
=======================================
  Coverage   91.59%   91.59%           
=======================================
  Files         127      127           
  Lines        4142     4142           
  Branches     1033     1033           
=======================================
  Hits         3794     3794           
  Misses        348      348           

Flag	Coverage Δ
browser	92.51% <ø> (ø)
core	90.07% <ø> (ø)
node	89.43% <ø> (ø)

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.