Build only what a release needs; verify tap push access

[lwrage]

Each release was building all three tools

You spotted this. The build-cli input never skipped anything — it gated the test-count assertion and the artifact upload, while scripts/build-test-release went on building the language server, the extension and the CLI unconditionally. A language-server release was packaging a VSIX and running the CLI integration suite for nothing.

Worse, release-osate-cli.yml called the reusable build workflow and then rebuilt everything in its package job, because packaging needs the dist tree on disk. That was a second full build per release.

• build-test-release gains --skip-extension (implying --skip-extension-tests) and --skip-cli, so the phases are genuinely selectable.
• build.yml gains a build-extension input, maps all three inputs onto those flags, and prints the resulting argument list so a run states what it built.
• release-server.yml builds the language server alone; release-vscode.yml builds the language server and extension; ci.yml still builds everything.
• release-osate-cli.yml drops the redundant build job — the package job computes the osate2 pin itself for the cache keys and builds once.

Measured locally against a warm OSATE cache: language-server-only drops from ~4 min to 41 s; the CLI path is 2m15s with the dist tree in place for packaging.

The tap check was reporting a pass it hadn't earned

Your verify-credentials run was green, but the tap step had taken its empty-repo branch (warning: You appear to have cloned an empty repository) and only proved the token can read — a read-only token clones fine. Push access, which is the last step of a CLI release and would fail after the GitHub Release already exists, was never exercised.

It now manufactures a throwaway local commit when the tap has no history, so git push --dry-run has something to offer and the server actually authorizes the ref update. Nothing is written. Rehearsed against a local empty repo: unborn HEAD → probe commit → dry run accepted → remote still empty.

Also pins the tap branch to main instead of inheriting the runner's init.defaultBranch. My local rehearsal picked master, and for an empty tap that choice decides which branch the first release creates — the same logic is now used in both the check and the release step so they cannot disagree.

Confirmed working from your run

vsce verify-pat reported "The Personal Access Token verification succeeded for the publisher 'osate'" and ovsx reported "PAT valid to publish at osate" — so the Marketplace publisher exists and both tokens are good. That closes the blocker flagged since the original publish.

🤖 Generated with Claude Code