sdk auto-release: invoke publish.yml via workflow_call (#172)

GitHub Actions deliberately does not trigger downstream workflows
on events created by a workflow's default GITHUB_TOKEN, to prevent
recursive loops. So when auto-release-on-version-bump used
`gh release create` to publish a Release, the `release: published`
event silently did NOT trigger publish.yml. v3.8.2 sat with a
Release object but never published to npm/PyPI.

Fix: explicitly invoke publish.yml via workflow_call from
auto-release, after the Release is created. publish.yml grows a
workflow_call trigger alongside `release: published`, accepting a
`tag` input. Every reference to `github.event.release.tag_name` is
now `${{ inputs.tag || github.event.release.tag_name }}` so both
trigger paths work.

The release env approval gate still applies (workflow_call propagates
the env protection). The OIDC publishing model is unchanged.

Author: LarsenCundric

.github/workflows/auto-release-on-version-bump.yml

@@ -32,6 +32,10 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write   # required to create the Release/tag
+    outputs:
+      should_release: ${{ steps.detect.outputs.should_release }}
+      version: ${{ steps.detect.outputs.version }}
+      tag: v${{ steps.detect.outputs.version }}
 
     steps:
       - name: Checkout (full history for range-aware diff)
@@ -225,3 +229,15 @@ jobs:
             exit 0
           fi
           echo "Created Release v${VERSION}. publish.yml takes over from here."
+
+  publish:
+    name: Publish (via release env approval gate)
+    needs: detect-and-release
+    if: needs.detect-and-release.outputs.should_release == 'true'
+    uses: ./.github/workflows/publish.yml
+    with:
+      tag: ${{ needs.detect-and-release.outputs.tag }}
+    secrets: inherit
+    permissions:
+      contents: read
+      id-token: write   # required for OIDC publishing (cascades to the called workflow)

.github/workflows/publish.yml

@@ -4,12 +4,18 @@ name: publish
 # Release runs are serialized via the concurrency group below so two simultaneous
 # release publishes can't race on registry uploads.
 concurrency:
-  group: publish-${{ github.event.release.tag_name || github.run_id }}
+  group: publish-${{ inputs.tag || github.event.release.tag_name || github.run_id }}
   cancel-in-progress: false
 
 on:
   release:
     types: [published]
+  workflow_call:
+    inputs:
+      tag:
+        description: 'Release tag to publish (e.g. v3.8.3)'
+        required: true
+        type: string
 
 # Default permissions: read-only. Individual jobs override what they need.
 permissions:
@@ -27,7 +33,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.release.tag_name }}
+          ref: ${{ inputs.tag || github.event.release.tag_name }}
           fetch-depth: 0
 
       - name: Verify release environment is protected (fail-closed)
@@ -56,7 +62,7 @@ jobs:
       - name: Extract release tag and verify version coherence
         id: version
         env:
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          RELEASE_TAG: ${{ inputs.tag || github.event.release.tag_name }}
         run: |
           set -euo pipefail
           # Strip optional leading 'v'.
@@ -136,7 +142,7 @@ jobs:
       - name: Record approver from deployment review log
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          RELEASE_TAG: ${{ inputs.tag || github.event.release.tag_name }}
           TARGET_VERSION: ${{ needs.preflight.outputs.version }}
         run: |
           set -euo pipefail
@@ -164,7 +170,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.release.tag_name }}
+          ref: ${{ inputs.tag || github.event.release.tag_name }}
 
       - name: Install uv
         uses: astral-sh/setup-uv@v6
@@ -193,7 +199,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.release.tag_name }}
+          ref: ${{ inputs.tag || github.event.release.tag_name }}
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4