ci: remove the release candidate workflows

[devin-ai-integration]

Summary

Deletes release-candidate.yml and the publish_candidates.yml reusable workflow it called. Neither has been run since the candidate flow was split out of release.yml in #1483 (2026-06-25); the last RC published through the old combined workflow was e2b@2.24.1-connections.1189.0 on 2026-05-26, and the last PyPI RC was e2b==2.0.0rc2 (2025-08).

release.yml keeps its release-${{ github.ref }} concurrency group and the main-only preflight check; only the comments pointing at the candidate workflow are dropped. publish_packages.yml (now running in the deployment environment, #1850) is unaffected.

Follow-up (PyPI)

The trusted publishers registered for publish_candidates.yml on the e2b, e2b-code-interpreter and e2b-desktop PyPI projects (see #1828) no longer have a workflow behind them and can be removed. Since the remaining publish_packages.yml publishers are now the only ones, they can also be tightened to require the deployment environment.

Link to Devin session: https://app.devin.ai/sessions/a59b5e364c484ced9524a652f80a49f9
Open in Devin Desktop: https://app.devin.ai/desktop/session/a59b5e364c484ced9524a652f80a49f9?variant=devin
Requested by: @mishushakov

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[changeset-bot]

⚠️ No Changeset found

Latest commit: 62f34bc

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

TASTE.md compliance: checked all changed lines against the SDK design principles (parity T-1–T-2, API shape T-3–T-25, streaming T-26–T-30, lifecycle T-31–T-36, template builder T-37–T-43, timeouts T-44–T-48, configuration T-49–T-53, package structure T-54–T-56, errors T-57–T-61). The PR only removes the release-candidate.yml and publish_candidates.yml workflows and adjusts comments in release.yml — no SDK public API surface is touched. No violations found.

[github-actions]

Package Artifacts

Built from f6ceda7. Download artifacts from this workflow run.

JS SDK (e2b@2.49.1-devin-1788959880-remove-candidate-workflows.0):

npm install ./e2b-2.49.1-devin-1788959880-remove-candidate-workflows.0.tgz

CLI (@e2b/cli@2.19.1-devin-1788959880-remove-candidate-workflows.0):

npm install ./e2b-cli-2.19.1-devin-1788959880-remove-candidate-workflows.0.tgz

Code Interpreter JS SDK (@e2b/code-interpreter@2.8.1-devin-1788959880-remove-candidate-workflows.0):

npm install ./e2b-code-interpreter-2.8.1-devin-1788959880-remove-candidate-workflows.0.tgz

Desktop JS SDK (@e2b/desktop@2.4.1-devin-1788959880-remove-candidate-workflows.0):

npm install ./e2b-desktop-2.4.1-devin-1788959880-remove-candidate-workflows.0.tgz

Python SDK (e2b==2.49.0+devin.1788959880.remove.candidate.workflows):

pip install ./e2b-2.49.0+devin.1788959880.remove.candidate.workflows-py3-none-any.whl

Code Interpreter Python SDK (e2b-code-interpreter==2.10.0+devin.1788959880.remove.candidate.workflows):

pip install ./e2b_code_interpreter-2.10.0+devin.1788959880.remove.candidate.workflows-py3-none-any.whl

Desktop Python SDK (e2b-desktop==2.5.0+devin.1788959880.remove.candidate.workflows):

pip install ./e2b_desktop-2.5.0+devin.1788959880.remove.candidate.workflows-py3-none-any.whl

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[claude]

Looks good — straightforward removal of dead CI workflows plus trimming the comments that referenced them.

What was reviewed: deletion of publish_candidates.yml and release-candidate.yml, and the comment-only edits in release.yml (concurrency comment and ref-check comment). Checked for dangling references to the deleted workflow filenames anywhere in the repo (workflows, docs, config) — none found. Confirmed release.yml's actual concurrency group and ref-check logic are unchanged, only comments were trimmed.

Extended reasoning...

Overview

This PR deletes two GitHub Actions workflows (publish_candidates.yml, a reusable workflow_call job publishing RC versions of the JS/Python/CLI packages, and release-candidate.yml, the workflow_dispatch entry point that invoked it) and makes a purely cosmetic edit to release.yml, removing two comments that referenced the now-deleted workflow. No functional code in release.yml changed — the concurrency: release-${{ github.ref }} key and the main-branch-only ref check remain byte-for-byte identical aside from comment text.

Security risks

None. This is a net reduction in CI attack surface (removing a workflow with id-token: write used for OIDC-based trusted publishing to npm/PyPI). No secrets, permissions, or auth logic are added or modified.

Level of scrutiny

Low. This is a mechanical deletion of unused files plus a two-line comment trim. I verified there are no remaining references to the deleted workflow filenames anywhere in the repository (no other workflow calls them, no docs/scripts reference them), so nothing is left dangling. The PR description's claim that these workflows haven't run since mid-2026 is consistent with them being safe to remove, though I did not independently verify that historical claim (not verifiable from the diff alone, and not load-bearing for correctness of the change).

Other factors

No changeset needed per CLAUDE.md since this touches only .github/workflows/ and not the public surface of packages/cli, packages/js-sdk, or packages/python-sdk. No tests are applicable since no product/SDK code changed. The PR body itself flags a sensible follow-up (removing now-orphaned PyPI trusted publishers) as out of scope for this change, which is fine to leave as a separate follow-up.