Gate the pin-push publish through a single release-plan job

[ptr727]

Why

publish-release.yml's push trigger was branches: [main, develop], so a pin bump on either branch published. That contradicted the documented model in three places - WORKFLOW.md section 3 states outright that "the develop pin update is sync-only (the push trigger is main-only), so develop never auto-publishes", and both the D4 guarantee and its 5A audit row assert branches: [main]. In practice develop published a prerelease on every pin bump (07-09 through 07-18), so the contract and the implementation had disagreed for weeks.

What

Narrow the push trigger to branches: [main], which is what the contract already claimed.

Add publish-plan-task.yml, a single job that owns the release-gate decision. publish now gates on needs.plan.outputs.publish == 'true' rather than re-testing the event and ref in its own if:. The task publishes for a schedule, for a dispatch of main/develop, and for a push to main by the codegen App or Dependabot - so the tracker's auto-merged pin bump releases, while a hand-edited pin does not.

The actor allowlist was verified, not assumed: every push-triggered publish run on this repo carries actor=ptr727-codegen[bot].

Document it. The original change added a workflow and a gating mechanism with no contract update, which D9.5 treats as decorative by default. This adds:

• D4.9, the plan-job guarantee, including that the outputs are the strings 'true'/'false' so callers must compare explicitly
• a section 3 subsection covering the policy and the actor test
• an updated D4.1 (the guard moved off the job's own if:) and 5A audit row
• a glossary entry, a section 0 mention, and trace scenarios S18-S20

stable is intentionally unused here - inputs.branch already carries main-vs-develop - and D4.9 records that an unused output is expected of a task shared across repo types.

Known limitation

The actor allowlist is a hardcoded identity, so if that identity ever changes the gate closes silently: pin pushes stop publishing, nothing errors, and the weekly schedule keeps releasing, leaving "upstream ships up to a week late" as the only symptom. Raised upstream with a recommended fix (annotate a non-publishing pin push rather than skipping quietly).

Verification

• Merges cleanly onto current develop; develop merged in rather than rebased, per the no-force-push rule.
• Full lint gate green: actionlint, editorconfig-checker, markdownlint, cspell.
• Trigger confirmed as branches: [main] after the merge.

[Copilot]

Pull request overview

This PR updates the release publishing workflow for this Docker-only repo to gate push-triggered publishes through a centralized “plan” job, aligning publish behavior with the intended release model (only bot-authored upstream pin pushes to main publish; develop publishes via dispatch).

Changes:

• Add a reusable publish-plan-task.yml workflow that decides whether a run should publish and whether it targets the stable channel.
• Update publish-release.yml to call the plan workflow and gate the publish job on needs.plan.outputs.publish == 'true'.
• Narrow the push trigger for upstream pin changes to main only.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/publish-release.yml	Adds the plan gate and narrows push-triggered publishing to main only.
.github/workflows/publish-plan-task.yml	Introduces centralized publish/stable decision logic for publish workflows.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.