ci: add Surface Tag release+purge (Step 2) and drop the stale bundle-guard

surface-forms (packages/surface-scripts) now owns the tag source and pushes the
built surface_tag.js / surface_embed_v1.js to this repo. Add the release-and-purge
workflow: on a push to main that changes those files, cut the next semver release
(so jsDelivr @latest advances) and purge the CDN (raw + .min.js) fail-loud. Remove
the ci.yml 'Bundle is up to date' step — it rebuilds from this repo's now
non-authoritative src/ and would diff against the pushed bytes and red main.

Author: vighnesh-radhakrishnan

.github/workflows/ci.yml

@@ -27,10 +27,7 @@ jobs:
 
       - name: Unit tests
         run: pnpm test
-
-      # surface_tag.js / surface_embed_v1.js are committed CDN artifacts.
-      # Fail if src/ was edited without rebuilding them.
-      - name: Bundle is up to date
-        run: |
-          pnpm run build
-          git diff --exit-code surface_tag.js surface_embed_v1.js
+      # NOTE: the "Bundle is up to date" build-guard was removed — surface-forms
+      # (packages/surface-scripts) now owns the tag source and pushes the built
+      # surface_tag.js / surface_embed_v1.js here, so rebuilding from this repo's
+      # (now non-authoritative) src/ would diff against the pushed bytes and fail main.

.github/workflows/release-and-purge.yml

@@ -0,0 +1,75 @@
+# STEP 2 of the two-step Surface Tag publish pipeline.
+#
+#   Step 1 (surface-forms/.github/workflows/push-scripts-to-cdn.yml): builds the two bundles and pushes
+#           them to this repo's main in one commit (via the "Scripts Repo Deploy" GitHub App).
+#   Step 2 (this file): that push triggers this workflow, which cuts a release (advancing jsDelivr
+#           @latest) and purges the CDN so customers get the new bytes immediately.
+#
+# No provisioned token needed — this Action acts on its OWN repo, so the built-in GITHUB_TOKEN (granted
+# contents:write below) is enough. surface-forms is now the source of truth; this repo only serves the
+# built artifacts it pushes (the ci.yml "Bundle is up to date" build-guard is removed in this same PR).
+
+name: Release Surface Tag + purge CDN
+
+on:
+  push:
+    branches: [main]
+    # Only react to a real tag-bundle change, not docs/readme commits.
+    paths:
+      - surface_tag.js
+      - surface_embed_v1.js
+
+permissions:
+  contents: write
+
+# Never let two releases race (e.g. two quick pushes); run them one at a time.
+concurrency:
+  group: release-surface-tag
+  cancel-in-progress: false
+
+jobs:
+  release-and-purge:
+    runs-on: ubuntu-latest
+    steps:
+      # jsDelivr @latest resolves to the highest SEMVER release, and this repo already uses v1.1.x — so
+      # bump the PATCH of the latest release (v1.1.8 -> v1.1.9). Date-based tags would break @latest:
+      # leading zeros (2026.09.02) are not valid semver, so jsDelivr would ignore them. target = the exact
+      # pushed commit, so @latest serves precisely these bytes.
+      - name: Cut a release for the pushed commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          latest=$(gh api "repos/${GITHUB_REPOSITORY}/releases/latest" --jq '.tag_name' 2>/dev/null || echo "v1.1.0")
+          ver=${latest#v}                       # strip an optional leading v
+          IFS=. read -r MAJOR MINOR PATCH <<< "${ver}"
+          RELEASE_TAG="v${MAJOR}.${MINOR}.$((PATCH + 1))"
+          echo "Latest release ${latest}; cutting ${RELEASE_TAG} at ${GITHUB_SHA}"
+          gh api -X POST "repos/${GITHUB_REPOSITORY}/releases" \
+            -f tag_name="${RELEASE_TAG}" \
+            -f target_commitish="${GITHUB_SHA}" \
+            -f name="${RELEASE_TAG}" \
+            -f body="Surface Tag synced from surface-forms (packages/surface-scripts)."
+          echo "Released ${RELEASE_TAG}; jsDelivr @latest now resolves to this commit."
+
+      # jsDelivr caches aggressively; purge so @latest / @main serve the new bytes immediately instead of
+      # up to 7 days later. A swallowed purge failure would show a green release while customers keep stale
+      # bytes, so fail loudly.
+      - name: Purge jsDelivr cache
+        run: |
+          set -euo pipefail
+          purge_failed=0
+          for f in surface_tag.js surface_tag.min.js surface_embed_v1.js surface_embed_v1.min.js; do
+            for ref in latest main; do
+              url="https://purge.jsdelivr.net/gh/${GITHUB_REPOSITORY}@${ref}/${f}"
+              echo "Purging ${url}"
+              if ! curl -sfS "${url}"; then
+                echo "::warning::purge failed for ${url}"
+                purge_failed=1
+              fi
+            done
+          done
+          if [ "${purge_failed}" -ne 0 ]; then
+            echo "::error::One or more jsDelivr purges failed; @latest/@main may serve stale bytes. Re-run the purge."
+            exit 1
+          fi