ci: gate releases behind explicit promotion

[bobtista]

Summary

Stops releases from publishing automatically on every push to main. Releases now run only from a v*.*.* tag or a manual workflow_dispatch with an explicit ref and SemVer version.

Changes

• Triggers: v*.*.* tags or manual dispatch with ref + version inputs; the push: [main] trigger is removed.
• New promote job: verifies the promoted ref is a commit on main, the version is valid SemVer, and a successful CI push run exists for that exact SHA.
• All build jobs check out the pinned promoted SHA instead of whatever the branch head is at run time.
• Versions come from the tag/dispatch input instead of 0.0.<run_number>.
• Release-time test runs (Windows and Linux) and asset smoke checks before publishing; artifact uploads fail on missing files.
• Changelog generation excludes the tag being released (on tag-triggered runs the new tag would otherwise be picked as the previous tag, emptying the changelog).
• target_commitish pins dispatch-created tags to the promoted SHA instead of the default branch head.

Why via development

This targets development rather than main because development rewrote release.yml (#226, #238); landing here means the Alpha 4 merge commit (#229) carries the gated workflow, so pushing that merge to main cannot fire the old auto-release. Until #229 merges, nothing else should be merged directly to main — its current workflow still auto-publishes.

Interaction with #300

The two Inject Secrets steps are kept as-is; #300 removes them. Whichever lands second has a trivial rebase (the steps just drop out).

Testing

• YAML validated locally.
• The first real exercise is the Alpha 4 tag promotion itself, which is the intended first use.

Fixes #311

Greptile Summary

The release workflow now requires explicit promotion and validates releases before publishing.

• Replaces automatic main-branch releases with tag and manual-dispatch triggers.
• Verifies the promoted commit belongs to main and has successful CI.
• Pins build and release jobs to the promoted SHA and supplied SemVer.
• Adds release tests, asset smoke checks, ancestry-aware changelog generation, and restricted job permissions.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Adds an explicit, read-only promotion gate and makes release builds, validation, changelog generation, and publication operate on the validated commit and version.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    Trigger[Version tag or manual dispatch] --> Promote[Validate ref, SemVer, and successful CI]
    Promote --> Windows[Build and test Windows assets]
    Promote --> Linux[Build and test Linux assets]
    Windows --> Release[Create GitHub prerelease]
    Linux --> Release
    Release --> Assets[Publish artifacts and changelog]

Loading

_{Reviews (3): Last reviewed commit: "ci: harden release promotion validation" | Re-trigger Greptile}

[coderabbitai]

Warning

Review limit reached

@bobtista, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 59 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 26b2fb19-29db-4f3e-bb57-6416b044ed1a

📥 Commits

Reviewing files that changed from the base of the PR and between a783b36 and 44544fa.

📒 Files selected for processing (1)

• .github/workflows/release.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 file)

• .github/workflows/release.yml

Previous Review Summaries (2 snapshots, latest commit a8864c5)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit a8864c5)

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	1
WARNING	0
SUGGESTION	0

Issue Details (click to expand)

CRITICAL

File	Line	Issue
.github/workflows/release.yml	81	Promotion action uses mutable reference - pin actions/github-script@v7 to commit SHA

Files Reviewed (1 file)

• .github/workflows/release.yml - 1 issue

---

Note: Two previous WARNING issues have been resolved by this commit:

• SemVer validation accepts malformed versions (fixed with improved regex)
• Previous tag selection ignores commit ancestry (fixed with --merged HEAD flag)

Fix these issues in Kilo Cloud

Previous review (commit 1f6ee7e)

Status: 3 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	1
WARNING	2
SUGGESTION	0

Issue Details (click to expand)

CRITICAL

File	Line	Issue
.github/workflows/release.yml	77	Promotion action uses mutable reference - pin actions/github-script@v7 to commit SHA

WARNING

File	Line	Issue
.github/workflows/release.yml	68	SemVer validation accepts malformed versions like 1.0.0-.
.github/workflows/release.yml	333	Previous tag selection ignores commit ancestry when promoting older commits

Files Reviewed (1 file)

• .github/workflows/release.yml - 3 issues

---

Note: Issues were previously reported by other reviewers and are documented above for completeness. No new issues found in this review cycle.

---

_{Reviewed by glm-4.7 · Input: 39.3K · Output: 4.2K · Cached: 441.6K}