feat(typescript-service-release): add notify-on-release email pipeline

Brings the email-monkey notify job into the public buildspace so PUBLIC
caller repos (e.g. photon-hq/spectrum-ts) can get release-notification
emails through plain `uses:` without needing the public->internal
App-token + REST-dispatch workaround.

Three coupled additions, atomic because notify needs release_type:

1. .github/blocks/determine-publish-version/action.yaml
   - new `release-type` output classifying the bump (major|minor|patch)
     against `previous-version`; strips any -rc.N suffix before comparing.

2. .github/blocks/generate-release-info/action.yaml
   - forwards `release_type` from the underlying version block.

3. .github/workflows/typescript-service-release.yaml
   - new `notify-on-release` input (default true).
   - new optional `TS_OAUTH_CLIENT_ID` / `TS_OAUTH_SECRET` secrets
     (Tailscale OAuth for ephemeral tailnet join as tag:ci).
   - `release-info` job exposes `release_type` for downstream jobs.
   - new `notify` job:
       resolves per-repo email-monkey URL (map of caller -> tailnet host;
       unknown callers exit cleanly), joins tailnet, POSTs
       {repo, version, releaseNotes, releaseType, serviceName} to
       email-monkey. Fires only on real major/minor releases.

Patch releases short-circuit; unknown callers short-circuit; missing
TS_OAUTH_* secrets fail loudly on the tailnet join step (intentional,
since you can't reach email-monkey without them).

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: yanxue06

.github/blocks/determine-publish-version/action.yaml

@@ -17,6 +17,9 @@ outputs:
   previous-version:
     description: 'The previous version before this release'
     value: ${{ steps.last-release.outputs.version }}
+  release-type:
+    description: 'The bump type relative to previous-version: major | minor | patch'
+    value: ${{ steps.classify.outputs.kind }}
 
 runs:
   using: 'composite'
@@ -102,3 +105,31 @@ runs:
         fi
         
         echo "Determined version: ${NEXT}"
+
+    - name: Classify Bump
+      id: classify
+      shell: bash
+      env:
+        PREV: ${{ steps.last-release.outputs.version }}
+        NEXT: ${{ steps.version.outputs.final }}
+      run: |
+        # Strip any pre-release suffix (e.g. -rc.5) before comparing.
+        prev_core="${PREV%%-*}"
+        next_core="${NEXT%%-*}"
+
+        IFS='.' read -r p_major p_minor p_patch <<< "$prev_core"
+        IFS='.' read -r n_major n_minor n_patch <<< "$next_core"
+
+        : "${p_major:=0}"; : "${p_minor:=0}"; : "${p_patch:=0}"
+        : "${n_major:=0}"; : "${n_minor:=0}"; : "${n_patch:=0}"
+
+        if [ "$n_major" -gt "$p_major" ]; then
+          kind="major"
+        elif [ "$n_minor" -gt "$p_minor" ]; then
+          kind="minor"
+        else
+          kind="patch"
+        fi
+
+        echo "kind=$kind" >> "$GITHUB_OUTPUT"
+        echo "Classified bump: $prev_core -> $next_core => $kind"

.github/blocks/generate-release-info/action.yaml

@@ -20,6 +20,9 @@ outputs:
   release_notes:
     description: 'AI-generated release notes in markdown'
     value: ${{ steps.ai-notes.outputs.final-message }}
+  release_type:
+    description: 'The bump type relative to previous-version: major | minor | patch'
+    value: ${{ steps.version-info.outputs.release-type }}
 
 runs:
   using: 'composite'

.github/workflows/typescript-service-release.yaml

@@ -62,6 +62,11 @@ on:
         required: false
         default: false
         description: "Opt in to Blacksmith Linux runners (blacksmith-4vcpu-ubuntu-2404). Requires the Blacksmith GitHub App installed on the caller org. Defaults to ubuntu-latest."
+      notify-on-release:
+        type: boolean
+        required: false
+        default: true
+        description: "Send a release-notification email via email-monkey on major/minor bumps. The endpoint URL is resolved per calling repo inside the notify job; an unknown caller skips the notify job entirely."
     secrets:
       OPENAI_API_KEY:
         required: true
@@ -75,6 +80,12 @@ on:
       APP_PRIVATE_KEY:
         required: false
         description: "GitHub App private key for pushing to protected branches and triggering downstream workflows"
+      TS_OAUTH_CLIENT_ID:
+        required: false
+        description: "Tailscale OAuth client ID (scope: auth_keys, tag owner of tag:ci) — used by the notify job to join the tailnet ephemerally"
+      TS_OAUTH_SECRET:
+        required: false
+        description: "Tailscale OAuth client secret matching TS_OAUTH_CLIENT_ID"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -104,6 +115,7 @@ jobs:
     outputs:
       version: ${{ steps.generate.outputs.version }}
       release_notes: ${{ steps.generate.outputs.release_notes }}
+      release_type: ${{ steps.generate.outputs.release_type }}
     steps:
       - uses: actions/checkout@v5
         with:
@@ -175,3 +187,101 @@ jobs:
           publish-command: ${{ inputs.publish-command }}
           dry-run: ${{ inputs.dry-run }}
           npm-token: ${{ secrets.NPM_TOKEN }}
+
+  notify:
+    needs: [check-labels, release-info, github-release, npm-publish]
+    # Only fire on real releases of feature/breaking bumps. Patch releases never email.
+    # The notify job itself short-circuits if github.repository isn't in the
+    # per-repo URL map below, so unknown callers skip cleanly with no error.
+    if: >-
+      always() &&
+      (fromJSON(needs.check-labels.outputs.labels).release || inputs.release) &&
+      needs.release-info.result == 'success' &&
+      needs.github-release.result == 'success' &&
+      (needs.npm-publish.result == 'success' || needs.npm-publish.result == 'skipped') &&
+      inputs.notify-on-release &&
+      contains(fromJSON('["major","minor"]'), needs.release-info.outputs.release_type)
+    runs-on: ${{ inputs.use-blacksmith && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    permissions:
+      contents: read
+    steps:
+      # Per-repo email-monkey URL map. Add new repos here as we onboard them.
+      # An empty url means "this caller isn't wired up yet" and the job exits 0.
+      #
+      # URL format: MagicDNS hostname assigned by the Tailscale K8s operator
+      # when the Service is created with loadBalancerClass: tailscale. By
+      # convention we name the Service `email-monkey` so the hostname is
+      # `email-monkey.<tailnet>.ts.net`. Port 80 on the tailnet is fine —
+      # Tailscale itself encrypts every hop end-to-end.
+      - name: Resolve email-monkey URL
+        id: monkey
+        env:
+          REPO: ${{ github.repository }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          case "$REPO" in
+            photon-hq/spectrum-ts)
+              echo "url=http://email-monkey/notify-release" >> "$GITHUB_OUTPUT"
+              ;;
+            *)
+              echo "::notice::No email-monkey URL configured for $REPO; skipping notify."
+              echo "url=" >> "$GITHUB_OUTPUT"
+              ;;
+          esac
+
+      - name: Join Tailnet
+        if: steps.monkey.outputs.url != ''
+        uses: tailscale/github-action@v3
+        with:
+          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
+          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
+          tags: tag:ci
+          version: latest
+
+      - name: POST to email-monkey
+        if: steps.monkey.outputs.url != ''
+        env:
+          EMAIL_MONKEY_URL: ${{ steps.monkey.outputs.url }}
+          SERVICE_NAME: ${{ inputs.service-name }}
+          REPO: ${{ github.repository }}
+          VERSION: ${{ needs.release-info.outputs.version }}
+          RELEASE_NOTES: ${{ needs.release-info.outputs.release_notes }}
+          RELEASE_TYPE: ${{ needs.release-info.outputs.release_type }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          # Auth: TAILSCALE-ONLY. email-monkey is only reachable from this
+          # runner because the Tailscale ACL allows `tag:ci` to reach it.
+          # No application-layer auth headers needed.
+
+          # NOTE: do not send `tag` here. email-monkey derives the release tag
+          # and marker tag from `version` alone to guarantee one canonical
+          # format across every caller. Adding fields here will not change that.
+          BODY="$(jq -nc \
+            --arg repo "$REPO" \
+            --arg version "$VERSION" \
+            --arg releaseNotes "$RELEASE_NOTES" \
+            --arg releaseType "$RELEASE_TYPE" \
+            --arg serviceName "$SERVICE_NAME" \
+            '{repo:$repo, version:$version, releaseNotes:$releaseNotes, releaseType:$releaseType, serviceName:$serviceName}')"
+
+          echo "POSTing to $EMAIL_MONKEY_URL (release_type=$RELEASE_TYPE, version=$VERSION)"
+
+          HTTP_CODE="$(curl --silent --show-error \
+            --output /tmp/email-monkey.out \
+            --write-out '%{http_code}' \
+            --max-time 60 \
+            --request POST "$EMAIL_MONKEY_URL" \
+            --header "Content-Type: application/json" \
+            --data "$BODY")"
+
+          echo "email-monkey response ($HTTP_CODE):"
+          cat /tmp/email-monkey.out || true
+          echo
+
+          if [ "$HTTP_CODE" -ge 400 ]; then
+            echo "::error::email-monkey returned HTTP $HTTP_CODE"
+            exit 1
+          fi