Source-only publisher: reference publish-release.yml cannot express the validation gate the spec requires

[ptr727]

Context

Financial-Modeling#14 (the hub-authored source-release standup) sets as acceptance criteria that the source-only publisher reuses the repo's reusable validation workflow (validate-task.yml) as a pre-release validation job, so a manual dispatch cannot cut a release from a ref that fails lint/tests/docs. Copilot review on Financial-Modeling#15 enforced that criterion.

The template's own reference .github/workflows/publish-release.yml carries no validation gate (assert-ref -> NBGV -> release). Root cause is structural: the template's PR validation is inlined in test-pull-request.yml (Lint sources job + aggregator) — there is no reusable workflow_call validation task in the template for its publisher to needs:. So the reference implementation cannot express the gate the spec requires, and a downstream repo that follows the spec (Financial-Modeling did: a validate job uses: ./.github/workflows/validate-task.yml + publish.needs: [validate]) necessarily diverges from the verbatim carry.

Suggested fix

Factor the template's PR validation into a reusable validate-task.yml (on: workflow_call), called by both:

• test-pull-request.yml (unchanged behavior; the aggregator still produces Check pull request workflow status job), and
• publish-release.yml — a validate job the publish job needs:.

Then the source-only reference publisher carries the gate, the spec and the reference agree, and downstream carries are verbatim again (the fleet's carry-without-modification invariant holds).

Downstream state

Financial-Modeling#15 ships the gated form now (per the #14 criteria); once the template aligns, the next re-sync is a byte-for-byte carry.

References

ptr727/Financial-Modeling#14 · ptr727/Financial-Modeling#15 · related robustness items: #313

[ptr727]

Addendum from the downstream review (Financial-Modeling#15): once the publisher gains the validate gate, the publish checkout must pin github.sha (the dispatch-time commit the gate validated) instead of github.ref_name (a moving pointer) — otherwise a commit landing on the branch between dispatch and checkout is released unvalidated (TOCTOU). NBGV classification is unaffected: GITHUB_REF still names the dispatched branch. The reference publisher's current ref: ${{ github.ref_name }} has the same nondeterminism even ungated ("publish whatever the tip is when the runner starts" vs "publish the commit I dispatched") and is worth pinning regardless.