Finding
The source-only publish-release.yml caller gates publish only on the plan output:
needs: [plan, validate]
if: ${{ needs.plan.outputs.publish == 'true' }}A job-level if replaces the implicit success gate. The job waits for validate, but it can still run after validation fails.
Expected
Publishing requires both a positive plan and successful validation. Encode the success condition in the canonical workflow and validate the fail-closed path.
Evidence
Finding
The source-only
publish-release.ymlcaller gatespublishonly on the plan output:A job-level
ifreplaces the implicit success gate. The job waits forvalidate, but it can still run after validation fails.Expected
Publishing requires both a positive plan and successful validation. Encode the success condition in the canonical workflow and validate the fail-closed path.
Evidence
2ab4e2a(2.0.383)audit run 2026-08-19T15:38:59Z | hub 2ab4e2a | branch override resync/hub-20260818