Remove create-event trigger guard; tag push is sole release trigger (#297)

* fix(release): trigger only on v* tag push; drop unworkable UI-draft path

A draft release never creates a git tag, so no push/create event
fires and GitHub fires no release event for draft creation — the
`create`-triggered "UI draft" path could never run. Make `v*` tag
push the sole trigger, remove the trigger-guard job and the
check-release-trigger command it invoked, simplify the env/
concurrency/job conditionals, and always publish the draft as the
final atomic step. Relocate the shared releaseLookupError into
publishrelease.go. Update release.md and release-tooling.md.

https://claude.ai/code/session_014crGVw5Bwiv3nv4EoBimbz

* test(release): cover relocated releaseLookupError; drop dead Op default

Deleting triggerguard_test.go removed the only coverage of the
relocated releaseLookupError. Every caller now passes a non-empty
Op ("lookup"/"publish"), so drop the dead op=="" defaulting and add
a direct Error() test for the empty- and non-empty-body branches.
Also keep the publish-release command code span on one line in
release.md (Copilot review).

https://claude.ai/code/session_014crGVw5Bwiv3nv4EoBimbz

* ci(codecov): allow 0.2% project threshold for benign deletions

Deleting a well-covered file pulls the project-wide average
slightly toward the mean, failing the 0%-threshold project gate
even when no new code is undertested. patch keeps threshold 0%,
so genuinely undertested changed lines still fail.

https://claude.ai/code/session_014crGVw5Bwiv3nv4EoBimbz

* ci(codecov): fix invalid changes-status schema so config applies

The changes status block carried target/threshold, which Codecov's
schema rejects, so the entire codecov.yml was invalid and Codecov
silently fell back to its defaults — the project/patch thresholds
(and the new 0.2% project tolerance) never took effect. Reduce the
changes gate to the supported `enabled: true`; validated against
codecov.io/validate.

https://claude.ai/code/session_014crGVw5Bwiv3nv4EoBimbz

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: jeduden

.github/workflows/release.yml

@@ -4,67 +4,24 @@ on:
   push:
     tags:
       - "v*"
-  create:
 
 permissions:
   contents: read
 
 env:
-  VERSION: ${{ github.event_name == 'create' && github.event.ref || github.ref_name }}
+  VERSION: ${{ github.ref_name }}
 
-# Serialize only release-intent runs so two publish jobs cannot mint
-# OIDC tokens against the same registry at the same time. Ordinary
-# branch-creation `create` events get a per-run group and never queue
-# behind a real release. `cancel-in-progress: false` keeps the first
-# release going (cancelling mid-publish would leave the scoped
-# platform packages out of sync with the root package).
+# Serialize release runs so two publish jobs cannot mint OIDC tokens
+# against the same registry at the same time. `cancel-in-progress:
+# false` keeps the first release going (cancelling mid-publish would
+# leave the scoped platform packages out of sync with the root
+# package).
 concurrency:
-  group: >-
-    ${{
-      (github.event_name != 'create' ||
-      (github.event.ref_type == 'tag' && startsWith(github.event.ref, 'v'))) &&
-      'release' ||
-      format('release-nonrelease-{0}-{1}', github.run_id, github.run_attempt)
-    }}
+  group: release
   cancel-in-progress: false
 
 jobs:
-  trigger-guard:
-    # `on: create` also fires for branch creation. Skip the whole job
-    # (checkout + setup-go + go run) for create events that are not a
-    # v* tag; downstream jobs gate on should_run and skip in turn.
-    if: >-
-      github.event_name != 'create' ||
-      (github.event.ref_type == 'tag' && startsWith(github.event.ref, 'v'))
-    runs-on: ubuntu-latest
-    outputs:
-      should_run: ${{ steps.decide.outputs.should_run }}
-      create_release_is_draft: ${{ steps.decide.outputs.create_release_is_draft }}
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
-        with:
-          go-version-file: go.mod
-          cache: false
-      - name: Decide whether this trigger should publish
-        id: decide
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          CREATE_REF_TYPE: ${{ github.event.ref_type }}
-          RELEASE_TAG: ${{ env.VERSION }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        # The runtime logic lives in mdsmith-release per
-        # docs/development/release-tooling.md. The step itself stays a
-        # fixed one-liner so no event payload is interpolated into an
-        # inline shell script (zizmor template-injection finding).
-        run: go run ./cmd/mdsmith-release check-release-trigger
-
   build:
-    needs: [trigger-guard]
-    if: &release_trigger_ok >-
-      needs.trigger-guard.outputs.should_run == 'true'
     strategy:
       matrix:
         include:
@@ -115,15 +72,13 @@ jobs:
           path: ${{ env.bin }}
 
   vscode:
-    needs: [trigger-guard]
     runs-on: ubuntu-latest
     # VSCE_PAT and OVSX_PAT are long-lived publisher tokens — see
     # docs/development/release.md for why the `release` environment
     # gates them and what reviewer rules the maintainer should set
     # on it.
     if: &release_repo_trigger_ok >-
-      github.repository == 'jeduden/mdsmith' &&
-      needs.trigger-guard.outputs.should_run == 'true'
+      github.repository == 'jeduden/mdsmith'
     environment: release
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -231,7 +186,7 @@ jobs:
           path: editors/vscode/mdsmith-*.vsix
 
   npm:
-    needs: [trigger-guard, build]
+    needs: [build]
     runs-on: ubuntu-latest
     # See docs/development/release.md for the canonical description
     # of `if:`, `environment:`, OIDC Trusted Publishing scope, and
@@ -309,7 +264,7 @@ jobs:
         run: npm publish --access public --provenance
 
   pypi:
-    needs: [trigger-guard, build]
+    needs: [build]
     runs-on: ubuntu-latest
     # See docs/development/release.md for the canonical PyPI Trusted
     # Publisher config (workflow + environment scope) and the
@@ -352,7 +307,7 @@ jobs:
           packages-dir: python/dist
 
   release:
-    needs: [trigger-guard, build, vscode]
+    needs: [build, vscode]
     runs-on: ubuntu-latest
     # See docs/development/release.md for the rationale on `if:`,
     # `environment:`, and the OIDC + attestations permission set.
@@ -420,10 +375,10 @@ jobs:
             --bundle checksums.txt.bundle \
             checksums.txt
       - name: Upload assets to draft release
-        # Always create/update the release as a draft so every asset
-        # uploads while the release is still mutable. With immutable
-        # releases enforced, uploading to an already-published
-        # release is rejected — the publish must be the final step.
+        # Create the release as a draft so every asset uploads while
+        # the release is still mutable. With immutable releases
+        # enforced, uploading to an already-published release is
+        # rejected — the publish must be the final step.
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
@@ -435,14 +390,10 @@ jobs:
             checksums.txt
             checksums.txt.bundle
       - name: Publish release
-        # Path A (tag push): create_release_is_draft == 'false', so
-        # flip the fully-populated draft to published as the final
-        # atomic step — the result is an immutable release. Path B
-        # (maintainer's UI-created draft): create_release_is_draft ==
-        # 'true', so the release is left as a draft for manual
-        # review and publish. Runtime logic lives in mdsmith-release
-        # per docs/development/release-tooling.md.
-        if: needs.trigger-guard.outputs.create_release_is_draft == 'false'
+        # Flip the fully-populated draft to published as the final
+        # atomic step, yielding an immutable release. Runtime logic
+        # lives in mdsmith-release per
+        # docs/development/release-tooling.md.
         env:
           RELEASE_TAG: ${{ env.VERSION }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -453,8 +404,7 @@ jobs:
     # — the npm and PyPI registries can take ~60s to surface a fresh
     # publish, so the channel-specific install commands re-run if the
     # registry briefly returns the previous version.
-    needs: [trigger-guard, npm, pypi, release]
-    if: needs.trigger-guard.outputs.should_run == 'true'
+    needs: [npm, pypi, release]
     strategy:
       fail-fast: false
       matrix:
@@ -525,18 +475,9 @@ jobs:
     runs-on: ubuntu-latest
     container: ${{ matrix.container }}
     steps:
-      # The mise channel resolves the binary off the public GitHub
-      # release (ubi backend). On the UI-draft path the release is
-      # left as a draft, so its assets are not publicly downloadable
-      # and mise cannot resolve them — skip mise there. npm/pip are
-      # registry-backed and unaffected by the GitHub release state.
       - name: Install
-        if: &smoke_channel_active >-
-          matrix.channel != 'mise' ||
-          needs.trigger-guard.outputs.create_release_is_draft == 'false'
         run: ${{ matrix.install }}
       - name: Verify version
-        if: *smoke_channel_active
         run: |
           got=$(${{ matrix.run }})
           want="mdsmith ${VERSION}"
@@ -557,7 +498,7 @@ jobs:
     # boundary for Pages; the per-repo Pages settings choose
     # GitHub Actions as the source.
     name: Deploy mdsmith.dev to GitHub Pages
-    needs: [trigger-guard, build]
+    needs: [build]
     if: *release_repo_trigger_ok
     runs-on: ubuntu-latest
     permissions:

cmd/mdsmith-release/main.go

@@ -13,7 +13,6 @@
 //	mdsmith-release build-wheels <artifacts-dir> <out-dir>
 //	mdsmith-release sync-docs <src-dir> <dst-dir>
 //	mdsmith-release build-website [--no-fix] [src-dir] [dst-dir]
-//	mdsmith-release check-release-trigger
 //	mdsmith-release publish-release
 //	mdsmith-release check-secret-rotations
 //	mdsmith-release record-rotation <ENTRY_TITLE> <YYYY-MM-DD>
@@ -44,7 +43,6 @@ Commands:
   sync-docs <src> <dst>           Snapshot docs/ into a Hugo content tree.
   build-website [--no-fix] [src] [dst]
                                   mdsmith fix (unless --no-fix) + sync-docs.
-  check-release-trigger           Emit release trigger guard outputs.
   publish-release                 Flip the tag's draft release to published.
   check-secret-rotations          Open GitHub issues for secrets due for rotation.
   record-rotation <title> <date>  Update lastRotated in a per-secret rotation file.
@@ -81,8 +79,6 @@ func run(args []string) int {
 		return runSyncDocs(root, rest)
 	case "build-website":
 		return runBuildWebsite(root, rest)
-	case "check-release-trigger":
-		return runCheckReleaseTrigger(root, rest)
 	case "publish-release":
 		return runPublishRelease(root, rest)
 	case "check-secret-rotations":

cmd/mdsmith-release/main_test.go

@@ -59,7 +59,6 @@ func TestRunRejectsBadArity(t *testing.T) {
 		{"build-wheels without args", []string{"build-wheels"}},
 		{"build-wheels with one arg", []string{"build-wheels", "art"}},
 		{"build-website with three positionals", []string{"build-website", "a", "b", "c"}},
-		{"check-release-trigger with extra arg", []string{"check-release-trigger", "extra"}},
 	}
 	for _, c := range cases {
 		assert.Equal(t, 2, run(c.args), c.name)
@@ -98,7 +97,7 @@ func TestReportFlagParseErrNilReturnsContinue(t *testing.T) {
 func TestSubcommandHelpExitsZero(t *testing.T) {
 	for _, sub := range []string{
 		"stamp", "check", "build-npm", "build-wheels",
-		"sync-docs", "build-website", "check-release-trigger",
+		"sync-docs", "build-website",
 	} {
 		assert.Equal(t, 0, run([]string{sub, "--help"}), "%s --help", sub)
 	}
@@ -109,7 +108,7 @@ func TestSubcommandHelpExitsZero(t *testing.T) {
 func TestSubcommandRejectsUnknownFlag(t *testing.T) {
 	for _, sub := range []string{
 		"stamp", "check", "build-npm", "build-wheels",
-		"sync-docs", "build-website", "check-release-trigger",
+		"sync-docs", "build-website",
 	} {
 		assert.Equal(t, 2, run([]string{sub, "--bogus"}), "%s --bogus", sub)
 	}