ci: fix alpha release train gate (#276)

## Summary
- Fix `release-alpha-train` so it uses `always()` and then explicitly
requires `detect-alpha-release` and `ci-success` to succeed before
publishing.
- Keep the release-plan guard aligned so future workflow edits must
preserve the explicit gate, including the guard being scoped to the
`release-alpha-train` job block.
- Add coverage for the main-branch skip case and the false-positive
workflow match case.

## Validation
- Observed [`ci` run
27441077450](https://github.com/zitadel/nextgen/actions/runs/27441077450):
CI/smoke gates passed, `detect-alpha-release` found release-relevant
package files, but `release-alpha-train` was skipped.
- PR CI run
[`27444586592`](https://github.com/zitadel/nextgen/actions/runs/27444586592)
passed. `release-alpha-train` is skipped there as expected for pull
requests.
- `corepack pnpm install --frozen-lockfile`
- `corepack pnpm nx test @zitadel/cli`
- `corepack pnpm nx test @zitadel/cli --
tests/unit/scripts/check-alpha-release-plan.test.ts`
- `corepack pnpm nx lint @zitadel/source --skip-nx-cache`
- `go test -v -tags spanner_integration -timeout=10m
./internal/api/integration_test -run TestListFlowDefinitions -count=1`
- `corepack pnpm run check -- --only release`
- `git diff --check`

## Release notes / changeset
- Empty changeset added: `.changeset/fix-alpha-release-gate.md`.
- No package API or runtime behavior changes in this PR. The expected
release impact is that the next main CI run can execute the
already-versioned alpha train instead of inheriting the intentional
`changeset-check` skip.

## Notes
- The linked run's head commit has `@zitadel/cli` at `0.1.0-alpha.3`,
while npm still reports the `alpha` dist-tag at `0.1.0-alpha.2`, so that
run did not publish alpha.3.
- I also corrected the existing `v0.1.0-alpha.2` GitHub Release metadata
to `prerelease=true` and `latest=false` after observing it was marked as
a normal latest release.
- `release-alpha-train` still uses the 8-core Depot runner because the
same job can proceed from npm publishing into QEMU/Buildx plus
GoReleaser. If we want to optimize runner size later, the clean split is
npm publishing on 4-core and GoReleaser on 8-core.

Author: fforootd

.changeset/fix-alpha-release-gate.md

@@ -0,0 +1,2 @@
+---
+---

.github/workflows/ci.yml

@@ -795,7 +795,7 @@ jobs:
           NODE
 
   release-alpha-train:
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.detect-alpha-release.outputs.should_release == 'true'
+    if: always() && github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.detect-alpha-release.result == 'success' && needs.ci-success.result == 'success' && needs.detect-alpha-release.outputs.should_release == 'true'
     runs-on: depot-ubuntu-24.04-8
     needs: [detect-alpha-release, ci-success]
     permissions:

apps/cli/tests/unit/scripts/check-alpha-release-plan.test.ts

@@ -25,6 +25,11 @@ const publicPackageNames = [
   "@zitadel/sdk-angular",
 ];
 
+const releaseJobCondition =
+  "    if: always() && github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.detect-alpha-release.result == 'success' && needs.ci-success.result == 'success' && needs.detect-alpha-release.outputs.should_release == 'true'";
+const inheritedSkipReleaseJobCondition =
+  "    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.detect-alpha-release.outputs.should_release == 'true'";
+
 beforeAll(async () => {
   checkAlphaReleasePlanModule = (await import(
     new URL("../../../../../scripts/check-alpha-release-plan.mjs", import.meta.url).href
@@ -128,6 +133,34 @@ describe("check-alpha-release-plan script", () => {
     ).rejects.toThrow("post-npm alpha train steps must not be gated only on Changesets publishing");
   });
 
+  it("rejects a release job condition that can inherit intentional main-branch skips", async () => {
+    const { cwd, statusPath } = await fixtureRepo({
+      ciWorkflow: validCiWorkflow().replace(
+        releaseJobCondition,
+        inheritedSkipReleaseJobCondition,
+      ),
+    });
+
+    await expect(
+      checkAlphaReleasePlanModule.checkAlphaReleasePlan({ cwd, statusPath }),
+    ).rejects.toThrow("must explicitly require release relevance and a successful CI gate");
+  });
+
+  it("rejects a release job condition that only appears on a different job", async () => {
+    const { cwd, statusPath } = await fixtureRepo({
+      ciWorkflow: validCiWorkflow()
+        .replace(releaseJobCondition, inheritedSkipReleaseJobCondition)
+        .replace(
+          "  ci-success:\n    steps:",
+          ["  ci-success:", releaseJobCondition, "    steps:"].join("\n"),
+        ),
+    });
+
+    await expect(
+      checkAlphaReleasePlanModule.checkAlphaReleasePlan({ cwd, statusPath }),
+    ).rejects.toThrow("must explicitly require release relevance and a successful CI gate");
+  });
+
   it("rejects a legacy standalone release workflow", async () => {
     const { cwd, statusPath } = await fixtureRepo({
       legacyReleaseWorkflow: "name: release-npm\n",
@@ -200,7 +233,7 @@ function validCiWorkflow(): string {
     "      - run: |",
     '          const allowedSkipped = new Set(["changeset-check"]);',
     "  release-alpha-train:",
-    "    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.detect-alpha-release.outputs.should_release == 'true'",
+    releaseJobCondition,
     "    needs: [detect-alpha-release, ci-success]",
     "    permissions:",
     "      contents: write",

scripts/check-alpha-release-plan.mjs

@@ -145,10 +145,11 @@ export async function validateReleaseTooling(cwd, readFileFn = readFileDefault)
     "release-alpha-train:",
     "ci.yml must contain the alpha release train job",
   );
-  assertContains(
+  assertJobContains(
     ciWorkflow,
-    "if: github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.detect-alpha-release.outputs.should_release == 'true'",
-    "release-alpha-train must only run on release-relevant main pushes",
+    "release-alpha-train",
+    "    if: always() && github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.detect-alpha-release.result == 'success' && needs.ci-success.result == 'success' && needs.detect-alpha-release.outputs.should_release == 'true'",
+    "release-alpha-train must explicitly require release relevance and a successful CI gate",
   );
   assertContains(
     ciWorkflow,
@@ -234,6 +235,31 @@ function assertContains(input, expected, message) {
   }
 }
 
+function assertJobContains(input, jobName, expected, message) {
+  const block = workflowJobBlock(input, jobName);
+  if (!block || !block.includes(expected)) {
+    throw new Error(message);
+  }
+}
+
+function workflowJobBlock(input, jobName) {
+  const headerPattern = new RegExp(`^  ${escapeRegExp(jobName)}:\\s*$`, "m");
+  const header = headerPattern.exec(input);
+  if (!header) {
+    return undefined;
+  }
+
+  const nextJobPattern = /^ {2}[A-Za-z0-9_-]+:\s*$/gm;
+  nextJobPattern.lastIndex = header.index + header[0].length;
+  const nextJob = nextJobPattern.exec(input);
+  const end = nextJob ? nextJob.index : input.length;
+  return input.slice(header.index, end);
+}
+
+function escapeRegExp(input) {
+  return input.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
 function assertNotContains(input, expected, message) {
   if (input.includes(expected)) {
     throw new Error(message);