* ci(release): finalize-release — bump main + drop backport label after a stable ships
* ci(release): arm merge queue + request core-maintainer review on the bump PR
main enforces require_code_owner_review and the bump touches CODEOWNERS-owned
release manifests, so a bot approval can't merge it hands-free (unlike
backport-automerge / bake-plugin-previews-automerge, whose targets/diffs avoid
code-owner review). Open the PR, arm the squash merge queue (gh pr merge --auto,
proven on main by bake-plugin-previews-automerge), and request the
@nexu-io/core-maintainers review that the code-owner rule needs.
* ci(release): trigger finalize via workflow_run, not release:published
release-stable.yml promotes its own draft to published with gh release edit
using GITHUB_TOKEN, and a release event minted by GITHUB_TOKEN does not trigger
other workflows — so a release:published trigger would never fire. React to
release-stable completing instead (the backport-automerge / bake pattern), and
gate on the open-design-vX.Y.Z release actually being published (draft=false)
so dry-runs (metadata/prepublish) correctly no-op.
* ci(release): resolve version from latest published release, not head_branch
PerishCode review (blocking): release-stable supports building one ref while
dispatched from another via its `ref` input, so workflow_run.head_branch can be
the dispatch ref, not the built release branch — parsing it would miss-fire or
read the wrong version. Read the version from the latest published release
instead (release-stable marks it --latest), which is branch-independent. Drop
the head_branch job-if guard; the draft/prerelease/X.Y.Z guards + bump
idempotency keep dry-runs a clean no-op.
* test(release): pin finalize-release workflow topology
PerishCode review (blocking): .github/AGENTS.md asks cross-workflow behavior
changes to update the topology tests, not rely on YAML review alone. Add a
focused [P2] test in packaged-smoke-workflow.test.ts (alongside the backport /
bake automerge coverage) that pins finalize-release's trusted-consumer contract:
workflows: [release-stable] + success/dispatch gating, App-token use, version
resolved via gh release view (latest/tag) with NO workflow_run.head_branch
dependency, draft/prerelease/X.Y.Z + skip handling, forward-only synchronized
bump, core-maintainer review request, and SHA-pinned merge-queue arming.
---------
Co-authored-by: lefarcen <ontf116@gmail.com>
Marc Chan