Add guarded release workflow

[williammartin]

Summary

• Add a maintainer-facing script/release command that validates a requested version and dispatches the release workflow from trunk.
• Add reusable release validation covering version format, duplicate tags/releases, release ordering, commit ancestry, and required checks.
• Publish releases from an exact, revalidated trunk commit after approval through the release environment.
• Restrict release publication to workflow-dispatch runs with a write-scoped job token.

Repository setup

Configure required reviewers for the release environment before using this workflow.

Validation

• script/validate-release v2.14.0
• ShellCheck
• zizmor

[williammartin]

This requires approval from an environment release but note that it doesn't block any user with write from just creating a tag. What we need to do is create a rule set that prevents tag creation, then register a specific github app that can bypass it and mint credentials for that app on release.

[Copilot]

Copilot review overview

🟡 Changes recommended

The workflow/scripts as written have concrete permission/error-handling and user-output issues that can cause failed runs or misleading behavior during release dispatch/validation.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Lite
Findings: 1 · 1 · 1

New issues introduced by this change (3)

Severity	Finding
	.github/​workflows/​release.yml — script/validate-release calls the branch-protection required-status-checks endpoint, which…
	script/​validate-release — The required-checks lookup will currently exit abruptly (because of set -e) if the…
	script/​release — The output of gh workflow run is not a run URL, so storing it in run_url and printing "Release…

What changed in this PR

This PR introduces a guarded, maintainer-driven release process for cli/go-gh, adding local scripts to validate and dispatch releases and a GitHub Actions workflow to revalidate and publish releases after environment approval.

Changes:

• Add script/validate-release to validate a candidate version against origin/trunk, tag/release existence, release ordering, commit ancestry, and required checks.
• Add script/release to run validation and dispatch the Release workflow from trunk.
• Add script/publish-release plus .github/workflows/release.yml to revalidate and publish the release after release environment approval with scoped permissions.

File	Description
script/​validate-release	Adds reusable release validation logic against origin/trunk, tags/releases, ancestry, and required checks.
script/​release	Adds maintainer-facing command to validate and dispatch the release workflow.
script/​publish-release	Adds workflow-only command to revalidate and create the GitHub release/tag.
.github/​workflows/​release.yml	Adds a two-job, environment-gated release workflow (validate → publish).

Suppressed comments (1)

.github/workflows/release.yml:46

• The release job overrides workflow-level permissions, so it also needs administration: read for the second validation pass to read branch protection required checks.

    permissions:
      checks: read # Reverify required checks after environment approval.
      contents: write # Create the release and its tag.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

The publishing guardrails are not fully enforced as written (workflow identity and write-scoped token verification need tightening) and the validate-release help text is currently misleading.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Lite
Findings: 2 · 1

New issues introduced by this change (3)

Severity	Finding
	script/​publish-release — This guard only checks that the run is a workflow_dispatch event, but the usage/error text says it…
	script/​publish-release — Using GET repos/{owner}/{repo} and checking .permissions.push is not a reliable way to verify…
	script/​validate-release — The usage text implies TARGET_SHA is used as the validation target, but the script always validates…

Issues resolved since last review (3)

Severity	Finding
	script/​release — The output of gh workflow run is not a run URL, so storing it in run_url and printing "Release… View resolved comment
	script/​validate-release — The required-checks lookup will currently exit abruptly (because of set -e) if the… View resolved comment
	.github/​workflows/​release.yml — script/validate-release calls the branch-protection required-status-checks endpoint, which… View resolved comment

[babakks]

LGTM, with a just a quick suggestion.

[Copilot]

Copilot review overview

🔵 Needs a closer look

It introduces a new release/publishing workflow and validation logic where small robustness issues can block or mis-route releases, so it warrants final human review before approval.

Review tier: Lite
Findings: 2

New issues introduced by this change (2)

Severity	Finding
	script/​release — This script only dispatches the release workflow, but it blocks users without .permissions.push…
	script/​validate-release — The release existence check relies on matching the human-readable error text "release not found"…

Issues resolved since last review (3)

Severity	Finding
	script/​validate-release — The usage text implies TARGET_SHA is used as the validation target, but the script always validates… View resolved comment
	script/​publish-release — Using GET repos/{owner}/{repo} and checking .permissions.push is not a reliable way to verify… View resolved comment
	script/​publish-release — This guard only checks that the run is a workflow_dispatch event, but the usage/error text says it… View resolved comment