fix(sdk-release-finalize): preserve Fern generation commits

[gavinsharp]

Summary

SDK release finalization now preserves Fern's replay generation commit after a package publish succeeds. This works around Fern issue fern-api/fern#16314, where hosted autorelease can lose access to the prior .fern/replay.lock current_generation commit and then fail auto-version with fatal: bad object.

Changes & impact

SDK repos that call sdk-release-finalize will get an additional durable fern-generation/<sha> tag for the current Fern replay generation. The workflow remains idempotent for publish retries and continues to create the existing SDK version and Fern origin release tags.

This is operationally important for Phenoml SDK releases: without a durable ref, Fern can open placeholder-version PRs such as 0.0.0-fern-placeholder / 0.0.0.dev0 even though generation otherwise succeeded. Preserving the replay generation commit keeps the next autorelease diff base reachable.

Details

• Adds a replay-lock-path input defaulting to .fern/replay.lock.
• Reads and validates current_generation, fetches that commit directly by SHA when needed, and creates/verifies fern-generation/<sha>.
• Exposes fern_generation_tag and fern_generation_tag_created outputs for callers that want to inspect the preservation step.
• Updates the README workflow summary to include the new replay-preservation tag.

Testing

• actionlint .github/workflows/sdk-release-finalize.yml
• git diff --check origin/main...HEAD

Related

• autoVersion hard-fails (and replay silently degrades) when the prior generation commit is unreachable fern-api/fern#16314 tracks the Fern-side bug this shared workflow works around.

🤖 Generated with Claude Code

---

Note

Medium Risk
Adds git tag pushes and SHA fetches in a release workflow; failures or tag conflicts could block finalize, but behavior mirrors existing idempotent tagging and skips when replay is not configured.

Overview
sdk-release-finalize now keeps Fern Replay’s current_generation commit reachable after a successful registry publish, so the next hosted autorelease does not hit missing-object failures when the prior generation SHA is no longer on a ref.

After the existing version and origin tags, the workflow reads replay-lock-path (default .fern/replay.lock) from the release commit, validates current_generation, fetches that commit by SHA if needed, and creates or verifies an idempotent fern-generation/<sha> tag. If the lock file is absent, the step is skipped. New workflow outputs fern_generation_tag and fern_generation_tag_created expose the result; the README documents the extra tag.

^{Reviewed by Cursor Bugbot for commit 3776a0e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8855766. Configure here.}