docs: add .codereview baseline (#163) #65

	name: Auto Release

	# On push to main, decide whether to cut a release and mint the tag. Identity
	# (tag prefix + version file) comes from packaging/identity.yml. The release gate
	# (Go-code paths + feat/fix commit) and the version.txt + GITHUB_RUN_NUMBER tag
	# scheme are handled by the shared reusable workflow; this caller wires triggers
	# and secrets.
	on:
	push:
	branches: [main]
	workflow_dispatch:
	inputs:
	dry-run:
	description: "Compute the tag but do not push it"
	type: boolean
	default: true

	# The tag push uses the dedicated TAP_GITHUB_TOKEN via a credential helper, not
	# GITHUB_TOKEN — so the pushed tag retriggers release.yml.
	permissions:
	contents: read

	jobs:
	auto-release:
	uses: open-cli-collective/.github/.github/workflows/auto-release.yml@v1
	with:
	# push is live (false); workflow_dispatch honors the checkbox. Compare
	# against both true and 'true' because a workflow_dispatch boolean input
	# may surface as a real boolean or the string "true" depending on context.
	dry-run: ${{ github.event_name == 'workflow_dispatch' && (inputs.dry-run == true \|\| inputs.dry-run == 'true') }}
	secrets:
	tag-token: ${{ secrets.TAP_GITHUB_TOKEN }}

Provide feedback