fix: remove invalid recovery-target release path

[hatayama]

Summary

Removes the obsolete recovery-target publish mode. Every publish now resolves to the approved event-head commit, so a run cannot create assets whose attestation digest differs from the release tag.

It also removes the historical-release resolver path and recovery-only tests, and replaces the old owner-assisted 403 guidance with the roll-forward runbook.

Verification

• C:\\Program Files\\Git\\bin\\bash.exe scripts/test-resolve-native-cli-release-target.sh
• C:\\Program Files\\Git\\bin\\bash.exe scripts/test-native-cli-publish-workflow.sh
• POSIX shell syntax checks for the changed scripts
• YAML parse for .github/workflows/native-cli-publish.yml
• git diff --check

Normal GitHub Actions CI does not run for pull requests targeting the integration branch.

[coderabbitai]

Warning

Review limit reached

@hatayama, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 22 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 43f31f76-38b7-42d6-aee1-0ff3c69490a2

📥 Commits

Reviewing files that changed from the base of the PR and between a1d8d3f and cea8e1c.

📒 Files selected for processing (2)

• docs/release-recovery-runbook.md
• scripts/test-native-cli-publish-workflow.sh

📝 Walkthrough

Walkthrough

The native CLI release flow now uses the approved event commit as its only release target. Recovery-target dispatch and legacy target resolution are removed, metadata validation is tightened, and release-creation 403 handling consistently reports roll-forward recovery guidance.

Changes

Native CLI release publishing

Layer / File(s)	Summary
Resolve and test the event-head release target scripts/resolve-native-cli-release-target.sh, scripts/test-resolve-native-cli-release-target.sh	Release target resolution now uses BUILD_SHA directly, removes legacy tag and release-commit lookup logic, and updates mocks, helpers, and test cases accordingly.
Enforce the approved publish commit .github/workflows/native-cli-publish.yml, scripts/test-native-cli-publish-workflow.sh	The workflow removes recovery-target dispatch and checkout behavior, requires build and target SHAs to equal GITHUB_SHA, and publishes with that SHA.
Report release creation failures .github/workflows/native-cli-publish.yml, scripts/test-native-cli-publish-workflow.sh, docs/release-recovery-runbook.md	Tag and draft-release failures use shared 403 reporting and roll-forward guidance, with matching test and runbook updates.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• hatayama/unity-cli-loop#1790: Enforces release publishing against the approved event commit.
• hatayama/unity-cli-loop#1799: Updates native CLI release-creation 403 handling.
• hatayama/unity-cli-loop#1821: Updates release-recovery runbook guidance.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: removing the obsolete recovery-target release path.
Description check	✅ Passed	The description matches the changeset and explains the removed recovery-target flow, tests, and 403 guidance updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch remove/recovery-target-mode

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/release-recovery-runbook.md`:
- Around line 89-90: Remove or update the historical-resolver guidance in the
passages around lines 52-54 and 94-96 so the runbook consistently documents
event-head-only behavior. Ensure no remaining text claims the resolver can
target or publish a historical commit, while preserving the surrounding recovery
instructions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 15a749f4-509e-4fe3-9443-003b504b8850

📥 Commits

Reviewing files that changed from the base of the PR and between 9fd18f5 and a1d8d3f.

📒 Files selected for processing (5)

• .github/workflows/native-cli-publish.yml
• docs/release-recovery-runbook.md
• scripts/resolve-native-cli-release-target.sh
• scripts/test-native-cli-publish-workflow.sh
• scripts/test-resolve-native-cli-release-target.sh