fix: make historical release recovery actionable

[hatayama]

Summary

• Add an owner-assisted release recovery runbook for historical release targets.
• Explain the required tag and draft release pre-creation steps when recovery is blocked by GitHub.

User Impact

• Recovery-target failures now identify the historical-commit 403 cause and point directly to the recovery procedure.
• Operators can complete native CLI, dispatcher coordination, package release sync, and workflow-dispatch cleanup from one documented procedure.

Changes

• Add docs/release-recovery-runbook.md with the confirmed reproduction evidence and executable gh command sequence.
• Preserve native release creation and reuse behavior while adding recovery-only guidance for 403 failures from tag and draft release creation.
• Confirm dispatcher-publish has no historical-target creation path; its concurrency behavior is documented. Package sync historical release creation is covered by the runbook.

Verification

• go test ./internal/architecture -run 'TestWorkflowActions|TestPullRequestWorkflow' -count=1 (from cli/release-automation)
• Ruby YAML parse
• bash -n for the modified native publish step
• git diff --check

Refs: 2026-07-16 release recovery 403 plan, To-Do 7

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 647fe682-8781-4500-997e-4c6a1404d547

📥 Commits

Reviewing files that changed from the base of the PR and between 2c73c6a and d97f6a9.

📒 Files selected for processing (2)

• .github/workflows/native-cli-publish.yml
• docs/release-recovery-runbook.md

---

📝 Walkthrough

Walkthrough

The publish workflow now captures tag and draft-release API failures and emits recovery guidance for specific 403 errors. A new runbook documents manual recovery for historical-commit releases, blocked jobs, package releases, and workflow-dispatch recovery.

Changes

Release recovery

Layer / File(s)	Summary
Recovery-aware release creation .github/workflows/native-cli-publish.yml	Passes RECOVERY_TARGET into the publish step and captures failures from tag and draft-release creation, including recovery-specific guidance for insufficient integration access.
Recovery procedure documentation docs/release-recovery-runbook.md	Documents owner-authenticated commands and operational steps for recovering historical-commit tags, draft releases, jobs, package releases, and workflow-dispatch recovery.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• hatayama/unity-cli-loop#1797: Introduces the recovery publishing flow and anchored RELEASE_SHA tag and release logic used by these changes.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: making historical release recovery actionable.
Description check	✅ Passed	The description is directly related to the runbook and recovery guidance added in the PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/recovery-403-runbook-guidance

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}