chore: add CI preflight gate to release workflow

[jflowers]

Summary

Adds a CI preflight gate to the release workflow, preventing publication of release binaries from commits that haven't passed CI checks.

Closes #65

Changes

• Trigger: Replace push.tags: v* with workflow_dispatch (manual trigger with tag input)
• Preflight job: 7 validation steps before GoReleaser runs:
  1. Branch validation (main-only)
  2. Tag format (vMAJOR.MINOR.PATCH)
  3. Tag uniqueness (with idempotent re-run support)
  4. Semver ordering
  5. CI status via Checks API (build-and-test + MegaLinter)
  6. Unreleased commits
  7. Tag creation (annotated)
• Permissions: Per-job permissions (least privilege) instead of workflow-level
• Recovery: Idempotent re-runs for partial failure (preflight passes, GoReleaser fails)
• Documentation: AGENTS.md CI/CD section updated

How to Release (after merge)

gh workflow run release.yml -f tag=v0.X.Y

Or use the GitHub Actions "Run workflow" UI button.

Reference

• Adopts the proven preflight pattern from unbound-force/unbound-force
• OpenSpec artifacts at openspec/changes/release-ci-gate/

[em-redhat]

PR Review: #69 — chore: add CI preflight gate to release workflow

CI Status

Check	Status	Classification
build-and-test	PASS	N/A
MegaLinter	PASS	N/A

Walkthrough

File	Change	Focus
.github/workflows/release.yml	Replace push-tag trigger with workflow_dispatch + preflight job (7 validation steps), per-job permissions, concurrency control, RELEASE_TAG env var	ci-cd
AGENTS.md	Update CI/CD section to reflect new release trigger and preflight gate	documentation
openspec/changes/release-ci-gate/.openspec.yaml	Add OpenSpec metadata	documentation
openspec/changes/release-ci-gate/proposal.md	Add change proposal	documentation
openspec/changes/release-ci-gate/design.md	Add design document with decisions and risk analysis	documentation
openspec/changes/release-ci-gate/specs/release-preflight.md	Add detailed spec with Given/When/Then scenarios	documentation
openspec/changes/release-ci-gate/tasks.md	Add task breakdown (all completed)	documentation

Summary

Well-structured PR that replaces the fire-and-forget push.tags release trigger with a gated workflow_dispatch flow. The preflight job adds 7 validation steps (branch, tag format, uniqueness, semver ordering, CI status, unreleased commits, tag creation) before GoReleaser runs. The implementation follows the proven pattern from unbound-force/unbound-force and properly handles idempotent re-runs. OpenSpec artifacts are thorough with clear design decisions and risk analysis. All GITHUB_REF_NAME references have been correctly replaced with the RELEASE_TAG env var.

Alignment

• No issues found. The implementation precisely matches the spec requirements, the linked issue #65, and the stated design decisions.

Security

• [LOW] RELEASE_TAG is derived from ${{ inputs.tag }} and used in shell contexts, but the tag format validation step (^v[0-9]+\.[0-9]+\.[0-9]+$) effectively sanitizes the input before downstream steps. No action needed.
• Actions are pinned to full commit SHAs with version comments. Secrets accessed via ${{ secrets.* }} only. No hardcoded credentials.

Constitution Compliance

• I. Composability First: PASS
• II. Autonomous Collaboration: N/A
• III. Observable Quality: PASS — preflight produces auditable output at each step
• IV. Testability: N/A — CI-only change, no new Go packages
• Spec-First Development: PASS — OpenSpec artifacts present and thorough
• Documentation Gate: PASS — AGENTS.md updated

Verdict

COMMENT — No blocking findings. This PR is ready to be approved once the branch is updated with the base branch (main). Rebase or merge main into the PR branch so CI runs against the latest base, then this can be approved.

This review was generated by /review-pr (AI-assisted).