release.yml

name: release

# Refactor (iter217/issue-217):
# Old pattern: release.yml 保留 tag/release mutation,无法可靠读本地 runtime fact,绕过 release-gate decider-only 边界
# New principle: controller-only publication:新增 ReleasePublishPreflight+ReleasePublisher 替代 workflow 发布权;release.yml 降为 read-only preview(contents:read,禁 gh release create)。严格按 plan 'Concrete plan' 逐条改。

on:
  workflow_dispatch:

permissions:
  contents: read
  checks: read

jobs:
  preview:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ github.sha }}

      - name: Verify required release checks
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO_SLUG: ${{ github.repository }}
          REF: ${{ github.sha }}
        run: |
          python3 skills/consensus-loop/scripts/consensus-rnd-cli release-required-checks \
            --repo "$GH_REPO_SLUG" \
            --ref "$REF" \
            --since-minutes 120 \
            --wait-seconds 180 \
            --json

      - name: Read committed manifest version
        run: |
          python3 .github/scripts/bump_version.py --check --read-version