fix(release): run post-release backmerge after changelog commit

[bedatty]

Move the post-release backmerge (backmerge_source -> backmerge_target) out of the publish_release matrix job into a dedicated 'backmerge' job that depends on generate_changelog.

Previously the backmerge ran inline in publish_release, which completes before the separate generate_changelog job commits CHANGELOG.md to main. As a result main->develop was backmerged without the changelog, leaving develop missing it. The backmerge-sync composite fetches origin/ fresh, so ordering the job after the changelog commit guarantees the changelog is carried into the target branch.

Also wires the new job into the notify job's failed-job reporting.

GitHub Actions Shared Workflows

---

Description

Type of Change

• feat: New workflow or new input/output/step in an existing workflow
• fix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)
• perf: Performance improvement (e.g. caching, parallelism, reduced steps)
• refactor: Internal restructuring with no behavior change
• docs: Documentation only (README, docs/, inline comments)
• ci: Changes to self-CI (workflows under .github/workflows/ that run on this repo)
• chore: Dependency bumps, config updates, maintenance
• test: Adding or updating tests
• BREAKING CHANGE: Callers must update their configuration after this PR

Breaking Changes

None.

Testing

• YAML syntax validated locally
• Triggered a real workflow run on a caller repository using @this-branch or the beta tag
• Verified all existing inputs still work with default values
• Confirmed no secrets or tokens are printed in logs
• Checked that unrelated workflows are not affected

Caller repo / workflow run:

Related Issues

Closes #

[coderabbitai]

Summary by CodeRabbit

• Bug Fixes

  • Improved post-release branch synchronization to ensure changelog updates are included.
  • Prevented backmerge operations from running before all release tasks are complete.

• Release Process

  • Release status notifications now identify backmerge failures separately.
  • Improved coordination between publishing, tagging, changelog generation, and branch synchronization.

Walkthrough

The release workflow moves post-release backmerge into a dedicated gated job after changelog generation, then updates notification dependencies and failure reporting to include backmerge status.

Changes

Release backmerge flow

Layer / File(s)	Summary
Dedicated backmerge execution .github/workflows/release.yml	Removes inline backmerge execution and adds a gated job that checks out the repository, imports GPG credentials, and runs backmerge-sync after release and changelog processing.
Backmerge notification reporting .github/workflows/release.yml	Makes notify wait for the backmerge job and reports “Backmerge” when it fails.

Estimated code review effort: 4 (Complex) | ~45 minutes

Suggested labels: workflow, size/XL

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the workflow fix: moving post-release backmerge after changelog generation.
Description check	✅ Passed	The description covers the change, rationale, type of change, and breaking changes; testing and related issues are incomplete but non-critical.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/backmerge-after-changelog

---

_{Comment @coderabbitai help to get the list of available commands.}

[lerian-studio]

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
PR Size	✅ success	no
Auto Labels	✅ success	no
PR Metadata	✅ success	no

---

_{🔍 View workflow run}

[lerian-studio]

🔍 Lint Analysis

Check	Files Scanned	Status
YAML Lint	1 file(s)	✅ success
Action Lint	1 file(s)	✅ success
Pinned Actions	1 file(s)	✅ success
Markdown Link Check	no changes	⏭️ skipped
Spelling Check	1 file(s)	✅ success
Shell Check	1 file(s)	✅ success
README Check	1 file(s)	✅ success
Composite Schema	no changes	⏭️ skipped
Deployment Matrix	no changes	⏭️ skipped

---

_{🔍 View full scan logs}

[lerian-studio]

🛡️ CodeQL Analysis Results

Languages analyzed: actions

✅ No security issues found.

---

_{🔍 View full scan logs | 🛡️ Security tab}

[coderabbitai]

Warning

CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.

Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.

👉 Steps to fix this

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Around line 515-525: Update the actions/create-github-app-token step with id
app-token to request only contents: write and pull-requests: write via the
corresponding permission inputs. Preserve the actions/checkout configuration,
including its token and persist-credentials behavior, so backmerge-sync can
continue direct pushes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 8973a56d-b02b-4910-815b-1aeebc516a31

📥 Commits

Reviewing files that changed from the base of the PR and between 6f98c5b and 2f255e9.

📒 Files selected for processing (1)

• .github/workflows/release.yml