fix(api): link digest release rows upstream, not to /release/ stubs

[Zach Dunn (zachdunn)]

Summary

#2218 turned /release/<id> pages into noindexed stubs of upstream content (blanket noindex, Disallow: /release/, sitemap retired) and flipped the web feed's default click to the release's own URL via releaseLinkTarget() (web/src/lib/release-link.ts). That sweep covered the web feed surfaces only — the digest email was never updated, so every release title and version pill in a sent digest still pointed at a page we've decided is non-canonical.

This applies the same policy to the digest. releaseUrl() in workers/api/src/lib/digest-email.ts now resolves upstream-first:

const upstream = (r.url ?? "").trim();
if (/^https?:\/\//i.test(upstream)) return upstream;
return r.webUrl ?? `${baseUrl}/release/${r.id}`;

Same fallback ladder as releaseLinkTarget(): upstream http(s) url → slugged webUrl → bare-ID path (which 308s to canonical). All four call sites inherit it — post title, rollup row, version pill, and the productPageUrl no-org fallback.

No data plumbing needed: mapLatestRowToReleaseItem already populates upstream url alongside webUrl.

Notes for reviewers

• The rollup's "and N more" link is deliberately untouched. It targets the product page (/{org}/{slug}), an org surface rather than a release stub, so the policy doesn't apply.
• Admin email preview: email-samples.ts fabricated url: "https://releases.sh/release/rel_sample_1", which would have made the preview exercise the permalink fallback and render a releases.sh link. Repointed at a third-party-looking changelog URL so the sample is representative.
• Digest emails are the only email surface that links releases. Staleness/recommendation/alert/auth templates link admin, source, or token URLs and are unaffected.
• Left alone, flagged: web/src/app/collections/[slug]/digest/[week]/page.tsx:161 still emits /release/* paths in schema.org mentions. That's structured-data metadata pointing at a canonical permalink, which is defensible — not an email link.
• Test coverage: the two assertions that pinned the old /release/ URLs now assert the upstream URL, plus a new test covering both fallback rungs.

Checklist

• PR title follows Conventional Commits
• bun run check passes
• bun test passes (workers/api: 1931 pass, 0 fail)
• Schema changes: n/a
• Wire-protocol changes: n/a — url and webUrl already exist on ReleaseLatestItem
• Docs updated if behavior changed — emails.md shell conventions

[changeset-bot]

⚠️ No Changeset found

Latest commit: 5ddac10

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (2)

• coderabbit:review
• review

🚫 Excluded labels (none allowed) (1)

• wip

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2aac124b-95c5-42a3-8fd0-b58ce9ac3d9f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}