fix(release): unblock the npm native publish and catch release/CI matrix drift

[chaliy]

What changed

@everruns/bashkit (native npm) can publish again, and the drift that stopped it now fails a check instead of a release.

• publish-js.yml no longer runs the ava suites on Node 20. ava 8 requires Node 22.20+; Node 20 keeps exercising the shipped binding through the runtime-compat suite, the same split js.yml already had.
• scripts/check_workflow_parity.py (just check-workflow-parity, part of just check and of the scripts/tests suite CI runs on every push) compares every release workflow with its CI counterpart and fails on:
  • a runtime version tested at release time that CI does not test,
  • a suite both workflows run, gated to more versions at release time than in CI,
  • dtolnay/rust-toolchain pins that disagree between workflows or with rust-toolchain.toml.

Lanes are declared in the script's LANES (today: Node via js.yml ↔ publish-js.yml, Python via python.yml ↔ publish-python.yml), so a new publish workflow with a runtime matrix gets covered by adding one entry.

Why

v0.17.0 published to crates.io, PyPI, and @everruns/bashkit-wasm, then stalled: Publish JS failed its Node 20 test jobs with TypeError: results.values(...).filter is not a function inside emittery, so Release to NPM never ran and the native package stayed at 0.16.0.

The ava 8 bump (#2339) added the Node 22+ gate to js.yml only. Nothing compared that gate with publish-js.yml, and the release path is not exercised before a tag exists, so the gap surfaced after the tag was cut and half the registries had already published. That is the general problem: any release workflow can test a runtime CI does not, and only a release finds out.

Before / After

The checker reproduces the exact failure. Reverting just the Node 20 gate:

$ python3 scripts/check_workflow_parity.py
error: node 20: release workflow runs the 'ava' suite, CI does not run it on 20; gate them the same way
1 release/CI parity problem(s). A release workflow must not test what CI does not.

With the gate in place:

$ just check-workflow-parity
release workflows match CI for: node, python; rust toolchain pins agree

The Node 20 replacement suite passes locally against the built binding:

$ node --test __test__/runtime-compat/*.test.mjs
# pass 163
# fail 0

Full JS suite on the release build is unchanged (569 ava tests pass on Node 22).

Risk

• Low
• Workflow and test-tooling only; no library code changes.
• The checker reads if: conditions only for comparisons against a job's matrix version key; other conditions (runner.os, github.event_name) are ignored, which can make it stricter but never more permissive. A new publish workflow with its own matrix is invisible to it until a lane is added, which the knowledge doc and the script docstring both call out.
• After merge, publish-js.yml gets dispatched for v0.17.0 so the native npm package catches up with the other registries.

Checklist

• Tests added or updated
• Backward compatibility considered

[cloudflare-workers-and-pages]

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	9cd0866	Commit Preview URL Branch Preview URL	Aug 22 2026, 05:35 PM