[Andreas-Garcia]

Summary

A reviewed version bump on main can now produce one annotated release tag on the exact push commit. A merge without a bump and initial adoption of an untagged current version produce no tag.

Changes

• Define an explicit version, mirror, changelog, tag-prefix and expected-publication contract; validate the complete current state even without a bump.
• Add a reusable push workflow with credential-free validation and a separate runner that executes only pinned shared code with a repository-scoped, Contents-write App token, revoked by the action post step.
• Create tag refs atomically, dereference annotated tags for retries, and fail on conflicting commits or API errors. Independent push events do not share a concurrency group that could discard pending bumps.
• Add a caller example and adoption/recovery documentation. Leave package publishers and OIDC identities in their existing workflows. No repository is activated by this PR.
• Keep release preparation on a PR branch and refuse the script's legacy manual publication once the CI contract exists.

Test plan

• 26 Python tests passed: missing/invalid policy, activation, stable SemVer, complete no-bump validation, TOML/JSON sources, dummy root manifest, coordinated mirrors, changelog content, ancestry, event commits preceding main, annotated/lightweight retries, concurrent ref creation, two bumps, missing token and API/network errors.
• Existing release.sh shell tests passed; actionlint, shellcheck and git diff --check passed.
• Intent: change. Review depth: deep because of App credentials, permissions, provenance and concurrency. Independent final review covers 4a86c5e..d15f217; no actionable correctness findings. Reviewer independently reran all 26 tests, actionlint and shellcheck.
• No live App tag, GitHub Release, package publication or deployment was run. Installation scope, separate immutable tag protections, organization secrets, repository-specific publisher recovery and any required after-merge checks remain adopter prerequisites. In particular, live validation must cover Contents-only tagging of an older event SHA after a later workflow-file change; permissions are not widened speculatively.

Compatibility and recovery

Callers pin a full merged workflow SHA and name the App secret explicitly. Policy activation/changes and bumps must be separate pushes. Existing publishers retain their own credentials. On failure, retry the same event/tag and verify required artifacts; never move an existing tag or create a second bump to recover.

[Copilot]

Copilot was unable to review this pull request due to rate limiting. Please try again later. See Usage limits for GitHub Copilot for details.