Combine publish release workflow

Author: earthtojake

.github/workflows/check-builds.yml

@@ -4,11 +4,9 @@ on:
   workflow_dispatch:
   pull_request:
     branches:
-      - build-test
       - main
   push:
     branches:
-      - build-test
       - main
 
 jobs:

.github/workflows/check-version.yml

@@ -5,13 +5,9 @@ on:
   pull_request:
     branches:
       - dev
-      - build-test
-      - main
   push:
     branches:
       - dev
-      - build-test
-      - main
 
 jobs:
   check-version:

.github/workflows/prepare-release.yml

@@ -110,12 +110,12 @@ jobs:
             gh pr edit "$branch" \
               --repo "$GITHUB_REPOSITORY" \
               --title "Release $VERSION" \
-              --body "Bumps repo-owned release metadata to $VERSION. Merging this PR lets the production branch builder materialize generated outputs and the release-tag workflow create the GitHub tag and draft release."
+              --body "Bumps repo-owned release metadata to $VERSION. Merging this PR lets the Publish workflow materialize generated outputs, create the GitHub tag, and open a draft release."
           else
             gh pr create \
               --repo "$GITHUB_REPOSITORY" \
               --base "$BASE_BRANCH" \
               --head "$branch" \
               --title "Release $VERSION" \
-              --body "Bumps repo-owned release metadata to $VERSION. Merging this PR lets the production branch builder materialize generated outputs and the release-tag workflow create the GitHub tag and draft release."
+              --body "Bumps repo-owned release metadata to $VERSION. Merging this PR lets the Publish workflow materialize generated outputs, create the GitHub tag, and open a draft release."
           fi

.github/workflows/build-test-branch.yml .github/workflows/publish.yml.github/workflows/build-test-branch.yml renamed to .github/workflows/publish.yml

@@ -1,22 +1,37 @@
-name: Build Test Branch
+name: Publish
 
 on:
   push:
     branches:
       - dev
   workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Validate and show publish actions without pushing branch, tag, or release.
+        required: true
+        default: false
+        type: boolean
+      publish:
+        description: Publish the GitHub Release instead of leaving it as a draft.
+        required: true
+        default: false
+        type: boolean
+      create_release:
+        description: Create the GitHub Release after pushing the tag.
+        required: true
+        default: true
+        type: boolean
 
 permissions:
-  actions: write
   contents: write
 
 concurrency:
-  group: build-test-branch
+  group: publish-${{ github.ref_name }}
   cancel-in-progress: false
 
 jobs:
-  build-test:
-    name: Bundle build-test
+  publish:
+    name: Build And Tag
     runs-on: ubuntu-latest
 
     steps:
@@ -26,20 +41,17 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Configure build-test push credentials
-        id: push-token
+      - name: Configure publish credentials
         env:
           BUILD_TEST_PUSH_TOKEN: ${{ secrets.BUILD_TEST_PUSH_TOKEN }}
           GH_TOKEN: ${{ github.token }}
         run: |
           if [ -n "$BUILD_TEST_PUSH_TOKEN" ]; then
             git remote set-url origin "https://x-access-token:${BUILD_TEST_PUSH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
-            echo "Using BUILD_TEST_PUSH_TOKEN for build-test push."
-            echo "uses_build_test_push_token=true" >> "$GITHUB_OUTPUT"
+            echo "Using BUILD_TEST_PUSH_TOKEN for publish push."
           else
             git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
-            echo "Using GITHUB_TOKEN for build-test push."
-            echo "uses_build_test_push_token=false" >> "$GITHUB_OUTPUT"
+            echo "Using GITHUB_TOKEN for publish push."
           fi
 
       - name: Set up Python
@@ -54,6 +66,7 @@ jobs:
 
       - name: Fetch release comparison refs
         run: |
+          git fetch --tags origin
           git fetch --no-tags origin \
             main:refs/remotes/origin/main \
             build-test:refs/remotes/origin/build-test
@@ -88,33 +101,39 @@ jobs:
         run: scripts/test/test.sh
 
       - name: Commit bundle artifacts
-        id: commit
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git add -A
           if git diff --cached --quiet; then
             echo "No bundle artifact changes to commit."
-            echo "committed=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
           git commit -m "Bundle artifacts for ${GITHUB_SHA}"
-          echo "committed=true" >> "$GITHUB_OUTPUT"
 
       - name: Push build-test branch
+        if: ${{ github.event_name != 'workflow_dispatch' || inputs.dry_run == false }}
         run: git push --force-with-lease origin HEAD:build-test
 
-      - name: Dispatch build-test checks
-        if: steps.push-token.outputs.uses_build_test_push_token != 'true'
+      - name: Show dry-run build-test push
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}
+        run: echo "Would push HEAD to build-test."
+
+      - name: Create release tag and GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
+          INPUT_DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false }}
+          INPUT_PUBLISH: ${{ github.event_name == 'workflow_dispatch' && inputs.publish || false }}
+          INPUT_CREATE_RELEASE: ${{ github.event_name != 'workflow_dispatch' || inputs.create_release }}
         run: |
-          for workflow in test.yml check-builds.yml check-version.yml release-tag.yml; do
-            curl --fail --show-error --silent \
-              -X POST \
-              -H "Authorization: Bearer $GH_TOKEN" \
-              -H "Accept: application/vnd.github+json" \
-              -H "X-GitHub-Api-Version: 2022-11-28" \
-              "https://api.github.com/repos/${GITHUB_REPOSITORY}/actions/workflows/${workflow}/dispatches" \
-              -d '{"ref":"build-test"}'
-          done
+          args=(--target HEAD --skip-existing-version)
+          if [ "$INPUT_DRY_RUN" = "true" ]; then
+            args+=(--dry-run)
+          fi
+          if [ "$INPUT_PUBLISH" = "true" ]; then
+            args+=(--publish)
+          fi
+          if [ "$INPUT_CREATE_RELEASE" != "true" ]; then
+            args+=(--skip-release)
+          fi
+          scripts/release/publish-github-release.sh "${args[@]}"

.github/workflows/release-tag.yml

@@ -5,12 +5,10 @@ on:
   pull_request:
     branches:
       - dev
-      - build-test
       - main
   push:
     branches:
       - dev
-      - build-test
       - main
 
 jobs:

.github/workflows/test.yml

@@ -16,15 +16,12 @@ Use `main` as the production clone/release branch only.
 Normal development work targets `dev` and should not bump release metadata. To
 start a release, run the `Prepare Release` workflow from `dev`; it creates a
 `release/<version>` branch, updates repo-owned version files, and opens a PR
-back to `dev`. After that PR merges, the production-branch builder bundles the
-symlinked checkout into real generated outputs and pushes the result to
-`build-test` for now, later `main`.
-
-The `Release Tag` workflow runs from that production branch. It checks the
-production layout, creates the semver git tag from the repo-owned version, and
-opens a draft GitHub Release. Use `scripts/release/bump-version.sh` and
-`scripts/release/publish-github-release.sh` only as local/manual fallbacks for
-the GitHub workflows.
+back to `dev`. After that PR merges, the `Publish` workflow bundles the
+symlinked checkout into real generated outputs, validates and tests that
+production layout, pushes the result to `build-test` for now, later `main`, then
+creates the semver git tag and draft GitHub Release. Use
+`scripts/release/bump-version.sh` and `scripts/release/publish-github-release.sh`
+only as local/manual fallbacks for the GitHub workflows.
 
 ## Repo Map
 

AGENTS.md

@@ -180,16 +180,15 @@ scripts/release/bump-version.sh patch --no-commit
 scripts/release/check-version.sh --incremented-from origin/main
 ```
 
-`build-test` and release branches must be installable from a plain checkout, so
-they contain generated production outputs instead of symlinks. The build-test
-automation bundles `dev`, validates the production layout, and pushes the
-generated result to `build-test`. Treat those generated outputs as CI products,
-not edit targets.
-
-PRs opened against `dev` must keep release metadata internally consistent. The
-release-tag workflow runs on the production branch, checks the bundled layout,
-creates the semver tag from `plugins/cad/VERSION`, and opens a draft GitHub
-Release with generated notes. Enable repository tag rulesets for
+`build-test` and `main` production branches must be installable from a plain
+checkout, so they contain generated production outputs instead of symlinks. The
+`Publish` workflow bundles `dev`, validates and tests the production layout,
+pushes the generated result to `build-test`, then creates the semver tag from
+`plugins/cad/VERSION` and opens a draft GitHub Release with generated notes.
+Treat generated outputs as CI products, not edit targets.
+
+PRs opened against `dev` must keep release metadata internally consistent.
+Enable repository tag rulesets for
 `[0-9]*.[0-9]*.[0-9]*` before publishing from `main`, and enable immutable
 releases once the production flow is trusted.
 

CONTRIBUTING.md

@@ -110,24 +110,24 @@ scripts/release/bump-version.sh patch --dry-run
 scripts/release/bump-version.sh patch --no-commit
 ```
 
-Use `scripts/release/publish-github-release.sh` only from a production branch or
-the `Release Tag` workflow. It creates the semver git tag from
-`plugins/cad/VERSION` and creates a draft GitHub Release with generated notes.
+Use `scripts/release/publish-github-release.sh` only from the `Publish`
+workflow or as a manual production-branch fallback. It creates the semver git
+tag from `plugins/cad/VERSION` and creates a draft GitHub Release with
+generated notes.
 `scripts/release/create-github-release.sh` remains as a manual all-in-one
 fallback, but the workflow path is preferred.
 
 ## CI
 
 | Workflow | Branches/events | Purpose |
 | -------- | --------------- | ------- |
-| `test.yml` | pushes to `dev`, `build-test`, `main`; PRs to those branches | Runs the broad code test wrapper. |
-| `check-version.yml` | pushes to `dev`, `build-test`, `main`; PRs to those branches | Verifies repo-owned release metadata is internally consistent. |
+| `test.yml` | pushes to `dev` and `main`; PRs to those branches | Runs the broad code test wrapper. |
+| `check-version.yml` | pushes to `dev`; PRs targeting `dev`; manual dispatch | Verifies repo-owned release metadata is internally consistent before release publishing. |
 | `check-symlinks.yml` | pushes to `dev`; PRs targeting `dev` | Verifies the development checkout keeps generated-copy paths symlinked to source. |
-| `check-builds.yml` | pushes to `build-test` and `main`; PRs targeting those branches | Verifies production branches contain bundled generated outputs instead of symlinks. |
+| `check-builds.yml` | pushes to `main`; PRs targeting `main`; manual dispatch | Verifies production branches contain bundled generated outputs instead of symlinks. |
 | `prepare-release.yml` | manual dispatch from `dev` | Bumps version metadata on `release/<version>` and opens a release PR back to `dev`. |
-| `build-test-branch.yml` | pushes to `dev`; manual dispatch | Temporary release builder that bundles `dev` and pushes production output to `build-test`; this will target `main` once trusted. |
-| `release-tag.yml` | pushes to `build-test`; manual dispatch | Temporary production release workflow that tags the bundled commit and creates a draft GitHub Release; this will target `main` once trusted. |
+| `publish.yml` | pushes to `dev`; manual dispatch | Bundles `dev`, validates and tests the production layout, pushes `build-test`, then creates or verifies the semver tag and draft GitHub Release. This will target `main` once trusted. |
 
 In short: `dev` is the editable symlink branch, `build-test` is the temporary
-production-output proving branch, and `main` is the eventual production branch
-for user clones and published releases.
+production-output branch written by `Publish`, and `main` is the eventual
+production branch for user clones and published releases.

scripts/README.md

@@ -13,8 +13,8 @@ Usage:
   scripts/release/bump-version.sh --check-incremented-from REF
 
 First-class release bump wrapper. By default, a bump writes version metadata
-only. Release tags are created by the GitHub release-tag workflow from a
-production branch.
+only. Release tags are created by the GitHub Publish workflow after production
+outputs are bundled.
 
 Common options:
   --dry-run          Show planned edits and git actions without changing files.