release: split publish and release workflows

Author: brianmhunt

…thub/workflows/github-release-repair.yml .github/workflows/github-release.yml.github/workflows/github-release-repair.yml renamed to .github/workflows/github-release.yml .github/workflows/github-release-repair.yml renamed to .github/workflows/github-release.yml

@@ -66,6 +66,9 @@ jobs:
     if: needs.prepare-release.outputs.has_changesets == 'false'
     runs-on: ubuntu-latest
 
+    outputs:
+      release_version: ${{ steps.version.outputs.version }}
+
     permissions:
       contents: read
       id-token: write
@@ -88,6 +91,10 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Determine release version
+        id: version
+        run: echo "version=$(node -p 'require(\"./builds/reference/package.json\").version')" >> "$GITHUB_OUTPUT"
+
       - name: Build all packages
         run: make
 
@@ -99,39 +106,23 @@ jobs:
         # publishing from GitHub Actions.
         run: npx changeset publish
 
-  github-release:
-    name: Create GitHub Release
+  dispatch-github-release:
+    name: Dispatch GitHub Release Workflow
     needs: [prepare-release, publish]
     if: needs.prepare-release.outputs.has_changesets == 'false' && needs.publish.result == 'success'
     runs-on: ubuntu-latest
 
     permissions:
-      contents: write
+      actions: write
 
     steps:
-      - name: Checkout code
-        # actions/checkout v6.0.2
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
-        with:
-          persist-credentials: false
-
-      - name: Determine release version
-        id: version
-        run: echo "version=$(node -p 'require(\"./builds/reference/package.json\").version')" >> "$GITHUB_OUTPUT"
-
-      - name: Create GitHub release if missing
+      - name: Dispatch GitHub release workflow
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VERSION: ${{ steps.version.outputs.version }}
+          VERSION: ${{ needs.publish.outputs.release_version }}
         run: |
-          tag="v${VERSION}"
-          if gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
-            echo "GitHub release $tag already exists; skipping."
-            exit 0
-          fi
-
-          gh release create "$tag" \
+          gh workflow run github-release.yml \
             --repo "$GITHUB_REPOSITORY" \
-            --target "$GITHUB_SHA" \
-            --title "TKO ${VERSION}" \
-            --generate-notes
+            --ref "$GITHUB_REF_NAME" \
+            -f version="$VERSION" \
+            -f target_sha="$GITHUB_SHA"

.github/workflows/release.yml

@@ -106,8 +106,8 @@ GitHub Actions workflows (`.github/workflows/`):
 | `test-headless.yml` | PRs | Matrix test (Chrome, Firefox, jQuery) |
 | `lint-and-typecheck.yml` | PRs | Prettier + ESLint + tsc (combined) |
 | `publish-check.yml` | PRs | Verify packages are publishable |
-| `release.yml` | Push to main | Changeset version PRs + npm publish + GitHub release |
-| `github-release-repair.yml` | Manual | Recreate or repair a GitHub release/tag boundary after publish |
+| `release.yml` | Push to main | Changeset version PRs + npm publish + dispatch GitHub release workflow |
+| `github-release.yml` | Manual + post-publish dispatch | Create or repair a GitHub release/tag boundary after publish |
 | `deploy-docs.yml` | Push to main | Deploy tko.io to GitHub Pages |
 | `codeql-analysis.yml` | Weekly + main push | Security scanning |
 
@@ -128,8 +128,8 @@ This creates a changeset file in `.changeset/` that gets committed with your PR.
 2. If unreleased changesets exist, the action opens a "Version Packages" PR
 3. Review the PR (it bumps versions and updates changelogs)
 4. Merge it to publish to npm via GitHub Actions OIDC trusted publishing
-5. After a successful publish, CI creates the matching GitHub Release and tag
-6. If release creation ever needs repair after publish, run `github-release-repair.yml` with the version and merged commit SHA
+5. After a successful publish, CI dispatches `github-release.yml` to create the matching GitHub Release and tag
+6. If release creation ever needs repair after publish, run `github-release.yml` manually with the version and merged commit SHA
 
 Avoid manual workstation publishes. If release CI is unavailable, fix the
 workflow or npm trusted publisher configuration rather than bypassing it with a

AGENTS.md

@@ -55,8 +55,8 @@ It's available as `@tko/build.knockout`, and over CDN:
 | $ `make test` | Run all tests with electron. See below. |
 | $ `make test-headless` | Run all tests with chromium. See below. |
 | $ `npx changeset add` | Add a changeset for package behavior changes in your PR |
-| Release workflow | On merge to `main`, CI opens or updates a version PR; when that version PR is merged and there are no remaining changesets, CI publishes from GitHub Actions via npm trusted publishing and creates the matching GitHub Release |
-| GitHub release repair | Manual workflow to recreate the GitHub Release/tag boundary if publish succeeded but release creation needs a retry |
+| Release workflow | On merge to `main`, CI opens or updates a version PR; when that version PR is merged and there are no remaining changesets, CI publishes from GitHub Actions via npm trusted publishing and dispatches the GitHub release workflow |
+| GitHub release workflow | Manual or post-publish workflow to create or repair the GitHub Release/tag boundary |
 | $ `make test-coverage` | Run all tests and create a code coverage report |
 
 Checkout the `Makefile` for more commands that can be executed with `make {command}`.

README.md

@@ -71,10 +71,10 @@ to npm.
 - Builds all packages and runs tests
 - If unreleased changesets exist, opens/updates a version PR
 - If version PR is merged, publishes to npm
-- After a successful publish, creates the matching GitHub Release and tag
+- After a successful publish, dispatches `github-release.yml` to create the matching GitHub Release and tag
 - Uses npm trusted publishing via GitHub Actions OIDC
 - Requires trusted publisher configuration for the public `@tko/*` packages on npm
-- Includes a manual `github-release-repair.yml` workflow for rerunnable release/tag repair if GitHub release creation ever needs a retry after publish
+- Includes a manual `github-release.yml` workflow for rerunnable release/tag repair if GitHub release creation ever needs a retry after publish
 
 ---