chore(ci): run full E2E suites in tag-staging workflow

.github/workflows/e2e-desktop.yml

@@ -4,12 +4,18 @@ on:
   push:
     branches: [main]
   workflow_dispatch:
+  workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref to checkout (tag, branch, or SHA)'
+        required: false
+        type: string
 
 jobs:
   changes:
     name: Detect Changes
-    # Skip change detection for workflow_dispatch (always run)
-    if: github.event_name != 'workflow_dispatch'
+    # Only run change detection for push events (skip for workflow_dispatch and workflow_call)
+    if: github.event_name == 'push'
     runs-on: ubuntu-latest
     outputs:
       desktop: ${{ steps.filter.outputs.desktop }}
@@ -43,7 +49,7 @@ jobs:
     if: >-
       always() && !cancelled() &&
       (
-        github.event_name == 'workflow_dispatch' ||
+        github.event_name != 'push' ||
         needs.changes.outputs.desktop == 'true'
       )
     runs-on: ${{ matrix.os }}
@@ -68,6 +74,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.sha }}
 
       # --- Install FUSE driver (needed for both build and test) ---
 

.github/workflows/e2e.yml

@@ -4,6 +4,12 @@ on:
   push:
     branches: [main]
   workflow_dispatch:
+  workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref to checkout (tag, branch, or SHA)'
+        required: false
+        type: string
 
 jobs:
   e2e:
@@ -51,6 +57,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.sha }}
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4

.github/workflows/tag-staging.yml

@@ -9,14 +9,9 @@ on:
         type: string
 
 jobs:
-  tag-staging:
-    name: Create Staging Tag
+  validate-tag:
+    name: Validate Release Tag
     runs-on: ubuntu-latest
-    environment: staging-approval
-    permissions:
-      contents: write
-    outputs:
-      staging_tag: ${{ steps.rc.outputs.staging_tag }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -30,40 +25,37 @@ jobs:
             echo "::error::Tag '${RELEASE_TAG}' does not exist"
             exit 1
           fi
+          echo "Tag ${RELEASE_TAG} validated"
 
-      - name: Verify E2E tests passed
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          RELEASE_TAG: ${{ inputs.release_tag }}
-        run: |
-          COMMIT_SHA=$(git rev-parse "refs/tags/${RELEASE_TAG}")
-          echo "Checking test status for commit ${COMMIT_SHA}"
+  web-e2e:
+    name: Web E2E
+    needs: validate-tag
+    uses: ./.github/workflows/e2e.yml
+    with:
+      ref: ${{ inputs.release_tag }}
+    secrets: inherit
 
-          # Web E2E runs on every push to main — must exist and pass
-          E2E_CONCLUSION=$(gh run list --workflow=e2e.yml --branch=main --limit=10 \
-            --json headSha,conclusion --jq "[.[] | select(.headSha == \"${COMMIT_SHA}\")][0].conclusion")
-          if [ -z "$E2E_CONCLUSION" ]; then
-            echo "::error::No E2E test run found for ${RELEASE_TAG} (${COMMIT_SHA})"
-            exit 1
-          fi
-          if [ "$E2E_CONCLUSION" != "success" ]; then
-            echo "::error::E2E Tests did not pass for ${RELEASE_TAG} (conclusion: ${E2E_CONCLUSION})"
-            exit 1
-          fi
-          echo "Web E2E: passed"
+  desktop-e2e:
+    name: Desktop E2E
+    needs: validate-tag
+    uses: ./.github/workflows/e2e-desktop.yml
+    with:
+      ref: ${{ inputs.release_tag }}
+    secrets: inherit
 
-          # Desktop E2E may be skipped if no desktop files changed — only block if it ran and failed
-          DESKTOP_CONCLUSION=$(gh run list --workflow=e2e-desktop.yml --branch=main --limit=10 \
-            --json headSha,conclusion --jq "[.[] | select(.headSha == \"${COMMIT_SHA}\")][0].conclusion")
-          if [ -n "$DESKTOP_CONCLUSION" ] && [ "$DESKTOP_CONCLUSION" != "success" ]; then
-            echo "::error::Desktop E2E Tests did not pass for ${RELEASE_TAG} (conclusion: ${DESKTOP_CONCLUSION})"
-            exit 1
-          fi
-          if [ -z "$DESKTOP_CONCLUSION" ]; then
-            echo "Desktop E2E: no run for this commit (skipped — no desktop changes)"
-          else
-            echo "Desktop E2E: passed"
-          fi
+  tag-staging:
+    name: Create Staging Tag
+    needs: [web-e2e, desktop-e2e]
+    runs-on: ubuntu-latest
+    environment: staging-approval
+    permissions:
+      contents: write
+    outputs:
+      staging_tag: ${{ steps.rc.outputs.staging_tag }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Calculate next RC number
         id: rc