From a4dbd43976002429f8c8d7fd2292ea436ca510bb Mon Sep 17 00:00:00 2001
From: Stanley Yuen <102275989+stanleyyconsensys@users.noreply.github.com>
Date: Fri, 28 Aug 2026 18:16:25 +0800
Subject: [PATCH 1/6] Initialize Release 9.0.0

---
 packages/bitcoin-wallet-snap/CHANGELOG.md | 10 +++++++++-
 packages/snap-networks-utils/CHANGELOG.md |  6 ++++++
 packages/solana-wallet-snap/CHANGELOG.md  | 14 ++++++++++++++
 packages/stellar-wallet-snap/CHANGELOG.md |  9 +++++++++
 packages/tron-wallet-snap/CHANGELOG.md    | 11 +++++++++++
 5 files changed, 49 insertions(+), 1 deletion(-)

diff --git a/packages/bitcoin-wallet-snap/CHANGELOG.md b/packages/bitcoin-wallet-snap/CHANGELOG.md
index 5908ee56..65fe825c 100644
--- a/packages/bitcoin-wallet-snap/CHANGELOG.md
+++ b/packages/bitcoin-wallet-snap/CHANGELOG.md
@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Uncategorized
+
+- refactor(snap-networks-utils): move util sources under `src/utils` ([#222](https://github.com/MetaMask/internal-snaps/pull/222))
+- refactor(bitcoin-wallet-snap): convert enums to `as const` objects ([#216](https://github.com/MetaMask/internal-snaps/pull/216))
+- fix: resolve `@metamask/snap-networks-utils` to source for typechecking ([#171](https://github.com/MetaMask/internal-snaps/pull/171))
+- chore: replace bitcoin logger with shared util class ([#142](https://github.com/MetaMask/internal-snaps/pull/142))
+- chore: update lint-build ci vars, add clean working dir check to release workflow ([#146](https://github.com/MetaMask/internal-snaps/pull/146))
+- chore: ts issues fixes ([#139](https://github.com/MetaMask/internal-snaps/pull/139))
+
 ### Fixed
 
 - Ensure certain errors are stringified correctly ([#179](https://github.com/MetaMask/internal-snaps/pull/179))
@@ -16,7 +25,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 
 - Fix `onKeyringRequest` responses to correctly return `Json` directly (v2 protocol) instead of v1's `{ pending: false, result }` envelope ([#100](https://github.com/MetaMask/internal-snaps/pull/100))
-
 - Bump `@metamask/utils` from `^11.9.0` to `^11.11.9` ([#161](https://github.com/MetaMask/internal-snaps/pull/161))
 
 ## [2.0.0] [DEPRECATED]
diff --git a/packages/snap-networks-utils/CHANGELOG.md b/packages/snap-networks-utils/CHANGELOG.md
index 80837ab9..f4002355 100644
--- a/packages/snap-networks-utils/CHANGELOG.md
+++ b/packages/snap-networks-utils/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Uncategorized
+
+- refactor(snap-networks-utils): move util sources under `src/utils` ([#222](https://github.com/MetaMask/internal-snaps/pull/222))
+- fix: resolve `@metamask/snap-networks-utils` to source for typechecking ([#171](https://github.com/MetaMask/internal-snaps/pull/171))
+- chore: ts issues fixes ([#139](https://github.com/MetaMask/internal-snaps/pull/139))
+
 ### Added
 
 - Add helpers `serialize`, `deserialize`, and `Serializable` for round-tripping `BigNumber`, `bigint`, `Uint8Array`, and `undefined` through snap state ([#197](https://github.com/MetaMask/internal-snaps/pull/197))
diff --git a/packages/solana-wallet-snap/CHANGELOG.md b/packages/solana-wallet-snap/CHANGELOG.md
index 91f8d49a..debb8794 100644
--- a/packages/solana-wallet-snap/CHANGELOG.md
+++ b/packages/solana-wallet-snap/CHANGELOG.md
@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Uncategorized
+
+- feat: move batch utils into shared pkg ([#211](https://github.com/MetaMask/internal-snaps/pull/211))
+- feat(solana-wallet-snap): use shareable permissions helpers in Solana snap ([#207](https://github.com/MetaMask/internal-snaps/pull/207))
+- feat: move buildUrl into shared util pkg ([#195](https://github.com/MetaMask/internal-snaps/pull/195))
+- test(solana-wallet-snap): use a non-zero TTL in the fiat cache test ([#194](https://github.com/MetaMask/internal-snaps/pull/194))
+- feat: move sanitize utils into shared pkg ([#191](https://github.com/MetaMask/internal-snaps/pull/191))
+- chore: move UrlStruct to shared lib ([#174](https://github.com/MetaMask/internal-snaps/pull/174))
+- fix: resolve `@metamask/snap-networks-utils` to source for typechecking ([#171](https://github.com/MetaMask/internal-snaps/pull/171))
+- chore: add safeMerge shared util ([#166](https://github.com/MetaMask/internal-snaps/pull/166))
+- fix: mocklogger types in solana snap ([#164](https://github.com/MetaMask/internal-snaps/pull/164))
+- chore: disable eslint rules `jest/no-mocks-import` for test file ([#163](https://github.com/MetaMask/internal-snaps/pull/163))
+- chore: replace solana logger with shared util ([#148](https://github.com/MetaMask/internal-snaps/pull/148))
+
 ### Changed
 
 - Extract Snap-owned assets domain logic into `SnapAssetsAdapter`; `AssetsService` is a thin facade that delegates metadata, market data, fetch, persist, and account asset reads through the adapter (no Core routing yet). ([#121](https://github.com/MetaMask/internal-snaps/pull/121))
diff --git a/packages/stellar-wallet-snap/CHANGELOG.md b/packages/stellar-wallet-snap/CHANGELOG.md
index 23fdc5a7..9d43d557 100644
--- a/packages/stellar-wallet-snap/CHANGELOG.md
+++ b/packages/stellar-wallet-snap/CHANGELOG.md
@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Uncategorized
+
+- feat: move batch utils into shared pkg ([#211](https://github.com/MetaMask/internal-snaps/pull/211))
+- feat(stellar-wallet-snap): use shareable permissions helpers in Stellar snap ([#212](https://github.com/MetaMask/internal-snaps/pull/212))
+- feat: move buildUrl into shared util pkg ([#195](https://github.com/MetaMask/internal-snaps/pull/195))
+- feat: move sanitize utils into shared pkg ([#191](https://github.com/MetaMask/internal-snaps/pull/191))
+- feat(stellar-wallet-snap): use shared safeMerge in Stellar snap ([#192](https://github.com/MetaMask/internal-snaps/pull/192))
+- feat(stellar-wallet-snap): use shared urlstruct ([#190](https://github.com/MetaMask/internal-snaps/pull/190))
+
 ### Added
 
 - Add `TrustlineExceedLimitException` for send simulation when a payment would exceed the destination trustline limit (previously a generic `TransactionValidationException`) ([#185](https://github.com/MetaMask/internal-snaps/pull/185))
diff --git a/packages/tron-wallet-snap/CHANGELOG.md b/packages/tron-wallet-snap/CHANGELOG.md
index bce5fc04..8902a0fc 100644
--- a/packages/tron-wallet-snap/CHANGELOG.md
+++ b/packages/tron-wallet-snap/CHANGELOG.md
@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Uncategorized
+
+- test(tron-wallet-snap): removed beforeEach from useCacheUntil tests ([#228](https://github.com/MetaMask/internal-snaps/pull/228))
+- test(tron-wallet-snap): remove before each usage in useCache ([#223](https://github.com/MetaMask/internal-snaps/pull/223))
+- feat: move batch utils into shared pkg ([#211](https://github.com/MetaMask/internal-snaps/pull/211))
+- feat(tron-wallet-snap): use shareable permissions helpers in Tron snap ([#204](https://github.com/MetaMask/internal-snaps/pull/204))
+- fix(tron-wallet-snap): balance from the AssetsController is in display format, not raw balance ([#196](https://github.com/MetaMask/internal-snaps/pull/196))
+- feat: move buildUrl into shared util pkg ([#195](https://github.com/MetaMask/internal-snaps/pull/195))
+- feat: move sanitize utils into shared pkg ([#191](https://github.com/MetaMask/internal-snaps/pull/191))
+- Revert "Release/9.0.0 (#184)" ([#184](https://github.com/MetaMask/internal-snaps/pull/184))
+
 ### Added
 
 - Add `CoreAssetsAdapter` and `mapControllerAsset` for AssetsController integration (wired unused until routing lands) ([#144](https://github.com/MetaMask/internal-snaps/pull/144))

From 5f0adb3e943a7253898da120ab5ee024e7904465 Mon Sep 17 00:00:00 2001
From: Stanley Yuen <102275989+stanleyyconsensys@users.noreply.github.com>
Date: Fri, 28 Aug 2026 18:17:01 +0800
Subject: [PATCH 2/6] Update Release 9.0.0

---
 package.json                              |  2 +-
 packages/bitcoin-wallet-snap/CHANGELOG.md | 10 +---------
 packages/snap-networks-utils/CHANGELOG.md |  6 ------
 packages/solana-wallet-snap/CHANGELOG.md  | 14 --------------
 packages/stellar-wallet-snap/CHANGELOG.md |  5 ++++-
 packages/stellar-wallet-snap/package.json |  2 +-
 packages/tron-wallet-snap/CHANGELOG.md    | 11 -----------
 7 files changed, 7 insertions(+), 43 deletions(-)

diff --git a/package.json b/package.json
index 389acfa9..bf25d39f 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@metamask/internal-snaps-monorepo",
-  "version": "8.0.0",
+  "version": "9.0.0",
   "private": true,
   "description": "Monorepo for first-party snaps",
   "repository": {
diff --git a/packages/bitcoin-wallet-snap/CHANGELOG.md b/packages/bitcoin-wallet-snap/CHANGELOG.md
index 65fe825c..5908ee56 100644
--- a/packages/bitcoin-wallet-snap/CHANGELOG.md
+++ b/packages/bitcoin-wallet-snap/CHANGELOG.md
@@ -7,15 +7,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Uncategorized
-
-- refactor(snap-networks-utils): move util sources under `src/utils` ([#222](https://github.com/MetaMask/internal-snaps/pull/222))
-- refactor(bitcoin-wallet-snap): convert enums to `as const` objects ([#216](https://github.com/MetaMask/internal-snaps/pull/216))
-- fix: resolve `@metamask/snap-networks-utils` to source for typechecking ([#171](https://github.com/MetaMask/internal-snaps/pull/171))
-- chore: replace bitcoin logger with shared util class ([#142](https://github.com/MetaMask/internal-snaps/pull/142))
-- chore: update lint-build ci vars, add clean working dir check to release workflow ([#146](https://github.com/MetaMask/internal-snaps/pull/146))
-- chore: ts issues fixes ([#139](https://github.com/MetaMask/internal-snaps/pull/139))
-
 ### Fixed
 
 - Ensure certain errors are stringified correctly ([#179](https://github.com/MetaMask/internal-snaps/pull/179))
@@ -25,6 +16,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 
 - Fix `onKeyringRequest` responses to correctly return `Json` directly (v2 protocol) instead of v1's `{ pending: false, result }` envelope ([#100](https://github.com/MetaMask/internal-snaps/pull/100))
+
 - Bump `@metamask/utils` from `^11.9.0` to `^11.11.9` ([#161](https://github.com/MetaMask/internal-snaps/pull/161))
 
 ## [2.0.0] [DEPRECATED]
diff --git a/packages/snap-networks-utils/CHANGELOG.md b/packages/snap-networks-utils/CHANGELOG.md
index f4002355..80837ab9 100644
--- a/packages/snap-networks-utils/CHANGELOG.md
+++ b/packages/snap-networks-utils/CHANGELOG.md
@@ -7,12 +7,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Uncategorized
-
-- refactor(snap-networks-utils): move util sources under `src/utils` ([#222](https://github.com/MetaMask/internal-snaps/pull/222))
-- fix: resolve `@metamask/snap-networks-utils` to source for typechecking ([#171](https://github.com/MetaMask/internal-snaps/pull/171))
-- chore: ts issues fixes ([#139](https://github.com/MetaMask/internal-snaps/pull/139))
-
 ### Added
 
 - Add helpers `serialize`, `deserialize`, and `Serializable` for round-tripping `BigNumber`, `bigint`, `Uint8Array`, and `undefined` through snap state ([#197](https://github.com/MetaMask/internal-snaps/pull/197))
diff --git a/packages/solana-wallet-snap/CHANGELOG.md b/packages/solana-wallet-snap/CHANGELOG.md
index debb8794..91f8d49a 100644
--- a/packages/solana-wallet-snap/CHANGELOG.md
+++ b/packages/solana-wallet-snap/CHANGELOG.md
@@ -7,20 +7,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Uncategorized
-
-- feat: move batch utils into shared pkg ([#211](https://github.com/MetaMask/internal-snaps/pull/211))
-- feat(solana-wallet-snap): use shareable permissions helpers in Solana snap ([#207](https://github.com/MetaMask/internal-snaps/pull/207))
-- feat: move buildUrl into shared util pkg ([#195](https://github.com/MetaMask/internal-snaps/pull/195))
-- test(solana-wallet-snap): use a non-zero TTL in the fiat cache test ([#194](https://github.com/MetaMask/internal-snaps/pull/194))
-- feat: move sanitize utils into shared pkg ([#191](https://github.com/MetaMask/internal-snaps/pull/191))
-- chore: move UrlStruct to shared lib ([#174](https://github.com/MetaMask/internal-snaps/pull/174))
-- fix: resolve `@metamask/snap-networks-utils` to source for typechecking ([#171](https://github.com/MetaMask/internal-snaps/pull/171))
-- chore: add safeMerge shared util ([#166](https://github.com/MetaMask/internal-snaps/pull/166))
-- fix: mocklogger types in solana snap ([#164](https://github.com/MetaMask/internal-snaps/pull/164))
-- chore: disable eslint rules `jest/no-mocks-import` for test file ([#163](https://github.com/MetaMask/internal-snaps/pull/163))
-- chore: replace solana logger with shared util ([#148](https://github.com/MetaMask/internal-snaps/pull/148))
-
 ### Changed
 
 - Extract Snap-owned assets domain logic into `SnapAssetsAdapter`; `AssetsService` is a thin facade that delegates metadata, market data, fetch, persist, and account asset reads through the adapter (no Core routing yet). ([#121](https://github.com/MetaMask/internal-snaps/pull/121))
diff --git a/packages/stellar-wallet-snap/CHANGELOG.md b/packages/stellar-wallet-snap/CHANGELOG.md
index 9d43d557..df9e82e9 100644
--- a/packages/stellar-wallet-snap/CHANGELOG.md
+++ b/packages/stellar-wallet-snap/CHANGELOG.md
@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.0]
+
 ### Uncategorized
 
 - feat: move batch utils into shared pkg ([#211](https://github.com/MetaMask/internal-snaps/pull/211))
@@ -32,5 +34,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Initial package release ([#181](https://github.com/MetaMask/internal-snaps/pull/181))
 
-[Unreleased]: https://github.com/MetaMask/internal-snaps/compare/@metamask/stellar-wallet-snap@0.1.0...HEAD
+[Unreleased]: https://github.com/MetaMask/internal-snaps/compare/@metamask/stellar-wallet-snap@0.2.0...HEAD
+[0.2.0]: https://github.com/MetaMask/internal-snaps/compare/@metamask/stellar-wallet-snap@0.1.0...@metamask/stellar-wallet-snap@0.2.0
 [0.1.0]: https://github.com/MetaMask/internal-snaps/releases/tag/@metamask/stellar-wallet-snap@0.1.0
diff --git a/packages/stellar-wallet-snap/package.json b/packages/stellar-wallet-snap/package.json
index 3fd217df..4ac4f4bc 100644
--- a/packages/stellar-wallet-snap/package.json
+++ b/packages/stellar-wallet-snap/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@metamask/stellar-wallet-snap",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "A Stellar wallet Snap",
   "keywords": [
     "Ethereum",
diff --git a/packages/tron-wallet-snap/CHANGELOG.md b/packages/tron-wallet-snap/CHANGELOG.md
index 8902a0fc..bce5fc04 100644
--- a/packages/tron-wallet-snap/CHANGELOG.md
+++ b/packages/tron-wallet-snap/CHANGELOG.md
@@ -7,17 +7,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Uncategorized
-
-- test(tron-wallet-snap): removed beforeEach from useCacheUntil tests ([#228](https://github.com/MetaMask/internal-snaps/pull/228))
-- test(tron-wallet-snap): remove before each usage in useCache ([#223](https://github.com/MetaMask/internal-snaps/pull/223))
-- feat: move batch utils into shared pkg ([#211](https://github.com/MetaMask/internal-snaps/pull/211))
-- feat(tron-wallet-snap): use shareable permissions helpers in Tron snap ([#204](https://github.com/MetaMask/internal-snaps/pull/204))
-- fix(tron-wallet-snap): balance from the AssetsController is in display format, not raw balance ([#196](https://github.com/MetaMask/internal-snaps/pull/196))
-- feat: move buildUrl into shared util pkg ([#195](https://github.com/MetaMask/internal-snaps/pull/195))
-- feat: move sanitize utils into shared pkg ([#191](https://github.com/MetaMask/internal-snaps/pull/191))
-- Revert "Release/9.0.0 (#184)" ([#184](https://github.com/MetaMask/internal-snaps/pull/184))
-
 ### Added
 
 - Add `CoreAssetsAdapter` and `mapControllerAsset` for AssetsController integration (wired unused until routing lands) ([#144](https://github.com/MetaMask/internal-snaps/pull/144))

From b646aa53c9dab13ec4dec8d459c3e2c9f706bc0a Mon Sep 17 00:00:00 2001
From: Stanley Yuen <102275989+stanleyyconsensys@users.noreply.github.com>
Date: Fri, 28 Aug 2026 18:27:23 +0800
Subject: [PATCH 3/6] chore: Update Release 9.0.0

---
 .github/workflows/lint-build-test.yml           |  7 +++++--
 .github/workflows/main.yml                      | 14 ++++++++++++++
 packages/stellar-wallet-snap/snap.manifest.json |  2 +-
 3 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/lint-build-test.yml b/.github/workflows/lint-build-test.yml
index 7b8a879e..eaaedfa0 100644
--- a/.github/workflows/lint-build-test.yml
+++ b/.github/workflows/lint-build-test.yml
@@ -182,8 +182,11 @@ jobs:
           name: package-dist-${{ github.sha }}
           # Glob discards the path before the first wildcard (`packages/`), so
           # the artifact root is `<package>/dist/...`. Download into `packages/`
-          # to restore `packages/<package>/dist/...`.
-          path: packages/*/dist
+          # to restore `packages/<package>/dist/...`. Include post-build
+          # manifests so is-release can run a strict dirty check.
+          path: |
+            packages/*/dist
+            packages/*/snap.manifest.json
           retention-days: 1
 
   test-scripts:
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 9a4f80b9..a6f98feb 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -125,6 +125,20 @@ jobs:
         uses: MetaMask/action-is-release@v2
         with:
           commit-starts-with: ${{ vars.RELEASE_COMMIT_PREFIX }}
+      - name: Restore build artifacts
+        if: steps.is-release.outputs.IS_RELEASE == 'true'
+        uses: actions/download-artifact@v8
+        with:
+          name: package-dist-${{ github.sha }}
+          path: packages
+      - name: Require clean working directory
+        if: steps.is-release.outputs.IS_RELEASE == 'true'
+        shell: bash
+        run: |
+          if ! git diff --exit-code; then
+            echo "Working tree dirty at end of job"
+            exit 1
+          fi
 
   publish-release:
     name: Publish release
diff --git a/packages/stellar-wallet-snap/snap.manifest.json b/packages/stellar-wallet-snap/snap.manifest.json
index 4c877cf2..fae72c6a 100644
--- a/packages/stellar-wallet-snap/snap.manifest.json
+++ b/packages/stellar-wallet-snap/snap.manifest.json
@@ -1,5 +1,5 @@
 {
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Manage Stellar using MetaMask",
   "proposedName": "Stellar",
   "repository": {

From 0f88cfa9ad7221f25af9db523c2195f58111c884 Mon Sep 17 00:00:00 2001
From: Stanley Yuen <102275989+stanleyyconsensys@users.noreply.github.com>
Date: Fri, 28 Aug 2026 20:27:12 +0800
Subject: [PATCH 4/6] chore: update

---
 .github/actions/check-release/action.yml      |  5 +++
 .../action.yml                                | 37 ++++++++++++-----
 .github/workflows/lint-build-test.yml         |  2 +-
 .github/workflows/main.yml                    | 40 ++++++++++++-------
 4 files changed, 58 insertions(+), 26 deletions(-)

diff --git a/.github/actions/check-release/action.yml b/.github/actions/check-release/action.yml
index cb85f57d..a8090c62 100644
--- a/.github/actions/check-release/action.yml
+++ b/.github/actions/check-release/action.yml
@@ -6,6 +6,11 @@ inputs:
     description: "Validate that the release commit starts with a string in this comma-separated list. Use '[version]' to refer to the current release version."
     required: true
 
+outputs:
+  IS_RELEASE_PR:
+    description: Whether this pull request is a release PR.
+    value: ${{ steps.is-release.outputs.IS_RELEASE }}
+
 runs:
   using: composite
   steps:
diff --git a/.github/actions/require-clean-working-directory/action.yml b/.github/actions/require-clean-working-directory/action.yml
index d5149b31..5eb67cfc 100644
--- a/.github/actions/require-clean-working-directory/action.yml
+++ b/.github/actions/require-clean-working-directory/action.yml
@@ -1,21 +1,36 @@
 name: Require clean working directory
 description: Fail if the working tree is dirty, ignoring snap.manifest.json shasum-only drift.
 
+inputs:
+  skip-shasum-diff:
+    description: "Skip shasum-only diff check for snap.manifest.json"
+    required: false
+    default: true
+
 runs:
   using: composite
   steps:
     - name: Require clean working directory
       shell: bash
       run: |
-        # mm-snap rewrites source.shasum during yarn build. Ignore shasum-only
-        # drift so CI doesn't require restamping manifests after each build.
-        # Other manifest fields and all other files still fail the check.
-        # publish-release keeps a strict dirty check so npm publish stays valid.
-        if ! git diff --exit-code -- ':!packages/*/snap.manifest.json'; then
-          echo "Working tree dirty at end of job"
-          exit 1
-        fi
-        if ! git diff --exit-code -I '"shasum":' -- 'packages/*/snap.manifest.json'; then
-          echo "Working tree dirty at end of job (non-shasum snap.manifest.json changes)"
-          exit 1
+        if [[ "${{ inputs.skip-shasum-diff }}" == "true" ]]; then
+          echo "Skipping shasum-only diff check for snap.manifest.json"
+
+          # mm-snap rewrites source.shasum during yarn build. Ignore shasum-only
+          # drift so CI doesn't require restamping manifests after each build.
+          # Other manifest fields and all other files still fail the check.
+          # publish-release keeps a strict dirty check so npm publish stays valid.
+          if ! git diff --exit-code -- ':!packages/*/snap.manifest.json'; then
+            echo "Working tree dirty at end of job"
+            exit 1
+          fi
+          if ! git diff --exit-code -I '"shasum":' -- 'packages/*/snap.manifest.json'; then
+            echo "Working tree dirty at end of job (non-shasum snap.manifest.json changes)"
+            exit 1
+          fi
+        else
+          if ! git diff --exit-code; then
+            echo "Working tree dirty at end of job"
+            exit 1
+          fi
         fi
diff --git a/.github/workflows/lint-build-test.yml b/.github/workflows/lint-build-test.yml
index eaaedfa0..afcffec2 100644
--- a/.github/workflows/lint-build-test.yml
+++ b/.github/workflows/lint-build-test.yml
@@ -183,7 +183,7 @@ jobs:
           # Glob discards the path before the first wildcard (`packages/`), so
           # the artifact root is `<package>/dist/...`. Download into `packages/`
           # to restore `packages/<package>/dist/...`. Include post-build
-          # manifests so is-release can run a strict dirty check.
+          # manifests so require-clean-release-pr can run a strict dirty check.
           path: |
             packages/*/dist
             packages/*/snap.manifest.json
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index a6f98feb..8487d944 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -104,15 +104,40 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+    outputs:
+      IS_RELEASE_PR: ${{ steps.check-release.outputs.IS_RELEASE_PR }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
       - name: Check release
+        id: check-release
         if: github.event_name != 'push'
         uses: ./.github/actions/check-release
         with:
           commit-starts-with: ${{ vars.RELEASE_COMMIT_PREFIX }}
 
+  require-clean-release-pr:
+    name: Require clean working directory on release PR
+    needs:
+      - check-release
+      - lint-build-test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        if: needs.check-release.outputs.IS_RELEASE_PR == 'true'
+        uses: actions/checkout@v7
+      - name: Restore build artifacts
+        if: needs.check-release.outputs.IS_RELEASE_PR == 'true'
+        uses: actions/download-artifact@v8
+        with:
+          name: package-dist-${{ github.sha }}
+          path: packages
+      - name: Require clean working directory
+        if: needs.check-release.outputs.IS_RELEASE_PR == 'true'
+        uses: ./.github/actions/require-clean-working-directory
+        with:
+          skip-shasum-diff: false
+
   is-release:
     name: Determine whether this is a release merge commit
     needs: lint-build-test
@@ -125,20 +150,6 @@ jobs:
         uses: MetaMask/action-is-release@v2
         with:
           commit-starts-with: ${{ vars.RELEASE_COMMIT_PREFIX }}
-      - name: Restore build artifacts
-        if: steps.is-release.outputs.IS_RELEASE == 'true'
-        uses: actions/download-artifact@v8
-        with:
-          name: package-dist-${{ github.sha }}
-          path: packages
-      - name: Require clean working directory
-        if: steps.is-release.outputs.IS_RELEASE == 'true'
-        shell: bash
-        run: |
-          if ! git diff --exit-code; then
-            echo "Working tree dirty at end of job"
-            exit 1
-          fi
 
   publish-release:
     name: Publish release
@@ -178,6 +189,7 @@ jobs:
       - analyse-code
       - check-release
       - lint-build-test
+      - require-clean-release-pr
     outputs:
       passed: ${{ steps.set-output.outputs.passed }}
     steps:

From c0f9bf72a87cf48ba706ffa55b15b1fc0535fbda Mon Sep 17 00:00:00 2001
From: Stanley Yuen <102275989+stanleyyconsensys@users.noreply.github.com>
Date: Fri, 28 Aug 2026 20:33:40 +0800
Subject: [PATCH 5/6] chore: update

---
 .github/actions/check-release/action.yml                   | 2 +-
 .github/actions/require-clean-working-directory/action.yml | 4 +++-
 .github/workflows/main.yml                                 | 2 ++
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/actions/check-release/action.yml b/.github/actions/check-release/action.yml
index a8090c62..adbc0fa0 100644
--- a/.github/actions/check-release/action.yml
+++ b/.github/actions/check-release/action.yml
@@ -8,7 +8,7 @@ inputs:
 
 outputs:
   IS_RELEASE_PR:
-    description: Whether this pull request is a release PR.
+    description: "Whether this pull request is a release PR."
     value: ${{ steps.is-release.outputs.IS_RELEASE }}
 
 runs:
diff --git a/.github/actions/require-clean-working-directory/action.yml b/.github/actions/require-clean-working-directory/action.yml
index 5eb67cfc..884b5ae5 100644
--- a/.github/actions/require-clean-working-directory/action.yml
+++ b/.github/actions/require-clean-working-directory/action.yml
@@ -12,8 +12,10 @@ runs:
   steps:
     - name: Require clean working directory
       shell: bash
+      env:
+        SKIP_SHASUM_DIFF: ${{ inputs.skip-shasum-diff }}
       run: |
-        if [[ "${{ inputs.skip-shasum-diff }}" == "true" ]]; then
+        if [[ "$SKIP_SHASUM_DIFF" == "true" ]]; then
           echo "Skipping shasum-only diff check for snap.manifest.json"
 
           # mm-snap rewrites source.shasum during yarn build. Ignore shasum-only
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 8487d944..04485798 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -122,6 +122,8 @@ jobs:
       - check-release
       - lint-build-test
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout repository
         if: needs.check-release.outputs.IS_RELEASE_PR == 'true'

From 09a4954606b65a2b9994b37a9682faf0db8979d6 Mon Sep 17 00:00:00 2001
From: Stanley Yuen <102275989+stanleyyconsensys@users.noreply.github.com>
Date: Fri, 28 Aug 2026 20:35:50 +0800
Subject: [PATCH 6/6] fix: lint

---
 .github/actions/check-release/action.yml                   | 2 +-
 .github/actions/require-clean-working-directory/action.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/actions/check-release/action.yml b/.github/actions/check-release/action.yml
index adbc0fa0..4a28b0f7 100644
--- a/.github/actions/check-release/action.yml
+++ b/.github/actions/check-release/action.yml
@@ -8,7 +8,7 @@ inputs:
 
 outputs:
   IS_RELEASE_PR:
-    description: "Whether this pull request is a release PR."
+    description: 'Whether this pull request is a release PR.'
     value: ${{ steps.is-release.outputs.IS_RELEASE }}
 
 runs:
diff --git a/.github/actions/require-clean-working-directory/action.yml b/.github/actions/require-clean-working-directory/action.yml
index 884b5ae5..fdb9cd9c 100644
--- a/.github/actions/require-clean-working-directory/action.yml
+++ b/.github/actions/require-clean-working-directory/action.yml
@@ -3,7 +3,7 @@ description: Fail if the working tree is dirty, ignoring snap.manifest.json shas
 
 inputs:
   skip-shasum-diff:
-    description: "Skip shasum-only diff check for snap.manifest.json"
+    description: 'Skip shasum-only diff check for snap.manifest.json'
     required: false
     default: true