Add the validate-release entry gate and re-vendor github-release

[ptr727]

DRIFT  interface: .github/workflows/build-release-task.yml missing required job 'validate-release'
DRIFT  verbatim: .github/workflows/build-release-task.yml job 'github-release' differs from the canonical and matches no past hub revision - the repo modified fixed content, review it

This one is not only a carry gap. WORKFLOW.md in this repo already specified both halves and the workflow implemented neither:

• Section 4: "the get-version, validate-release, and github-release jobs ... these job bodies should not need per-repo edits."
• D2.2 Release branch matches version classification: "the gate fails loudly if the default branch carries a prerelease suffix or a non-default branch carries none ... skipped on smoke."
• Scenarios S1, S4, and S10 all name validate-release by job name.

So the contract named a job that did not exist, and the required check could never have caught S10.

validate-release

The version check moves out of a step inside github-release into its own job that gates every build. Two behavior changes follow:

• It fails before anything is built. The old inline step ran in github-release, after the executable and Docker builds had already completed, so a mis-classified version cost a full build before it was caught.
• It gains the arm the inline step never had. The old step only guarded main carrying a prerelease suffix. The canonical also fails a non-main branch whose version carries no prerelease suffix, which is the develop-classified-public-and-published-as-stable case. That is the second half of D2.2, previously unimplemented.

Smoke exits the check early, since a detached PR head always versions as prerelease and would otherwise trip the main arm. build-executable and build-docker both gain it in needs and in their result guard.

github-release

Re-vendored from the canonical. It now normalizes equal to it under the audit's own three rules (EOL, action pin, needs:), verified with the same regexes spec/audit.py uses. The repo keeps its newer Dependabot pins (checkout v7.0.1, action-gh-release v3.0.2) and its pruned needs list, which is exactly what that normalization exists to allow.

Substantive changes it carries:

• expect_release_assets (new input, default true): gates the artifact download and drives fail_on_unmatched_files, so a repo with no file-producing target can still cut a tag-only release. This repo ships the executable 7z, so both callers keep the default and behavior here is unchanged.
• The artifact delete loop moves from a || echo tail to an if ! guard, so a failed delete cannot be mistaken for a successful one.

Verification

• actionlint (rhysd/actionlint, which bundles shellcheck for the run: blocks) exits 0.
• editorconfig-checker exits 0; workflow YAML stays LF.
• The github-release region normalizes byte-equal to the canonical under the audit's rules.
• Both callers (publish-release.yml, test-pull-request.yml) take the expect_release_assets default, so neither needed a change.

Part of the conformance sweep against the hub baseline (audit run 2026-08-01T14:29:05Z | hub 6501479).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 44.96%. Comparing base (30434d0) to head (37313b2).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop      #29   +/-   ##
========================================
  Coverage    44.96%   44.96%           
========================================
  Files           25       25           
  Lines         3398     3398           
  Branches       259      259           
========================================
  Hits          1528     1528           
  Misses        1824     1824           
  Partials        46       46           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR updates the reusable release orchestrator workflow to better match the repo’s documented release contract in WORKFLOW.md, adding an explicit entry gate for branch/version classification and re-aligning the github-release job body with the canonical shape.

Changes:

• Add a validate-release entry-gate job to fail fast when the branch’s expected prerelease/stable classification does not match SemVer2.
• Add an expect_release_assets input to support tag-only releases by conditionally skipping artifact download and relaxing unmatched-files failure behavior.
• Re-vendor and adjust the github-release job’s release-create and artifact-cleanup behavior (including a safer delete loop).

Suppressed comments (1)

.github/workflows/build-release-task.yml:110

• Same as build-executable: if validate-release is skipped on smoke (per WORKFLOW.md D2.2), this job should allow needs.validate-release.result == 'skipped' or smoke builds will be blocked.

    needs: [get-version, validate, validate-release]
    if: ${{ !cancelled() && needs.get-version.result == 'success' && needs.validate-release.result == 'success' && (needs.validate.result == 'success' || needs.validate.result == 'skipped') }}
    uses: ./.github/workflows/build-docker-task.yml