fix: restore automatic release approvals

[nicholls73]

Summary

• automatically create a versioned Release run when Release Please updates the release PR
• make automatic runs wait for the protected release environment approval
• retain Actions > Release > Run workflow as a fallback where the manual request counts as approval
• serialize approval and publish work so stale waiting runs are replaced without cancelling an active publish
• document both release paths

Result

Automatic: merge -> Release vX.Y.Z -> wait for approval
Manual fallback: Run workflow -> release starts immediately

Testing

• YAML parse for both workflows
• embedded Bash syntax check
• release output fixture check
• pnpm lint
• pnpm build
• pnpm test (128 passed, 1 skipped)
• git diff --check

Summary by CodeRabbit

• New Features

  • Added an approval step before publishing releases.
  • Automated prepared releases now trigger the release workflow with the correct version.
  • Added safeguards to prevent publishing mismatched release versions.
  • Manual release workflows remain supported as a fallback.

• Documentation

  • Updated release guidance to explain the automated and manual release processes.

[coderabbitai]

📝 Walkthrough

Walkthrough

The release workflow now starts from prepared-release dispatches or manual runs. Prepared releases include the extracted version. An approval job gates publishing, validates the version, and uses dedicated publish concurrency. The documentation describes both release paths.

Changes

Release automation

Layer / File(s)	Summary
Dispatch prepared release .github/workflows/ci.yml	The prepare-release job sends a prepared-release repository dispatch with the release version after release-please creates a pull request.
Route release approval .github/workflows/release.yml	The workflow accepts dispatched and manual events. It names the run and approval environment based on the event, then applies approval concurrency.
Publish after approval .github/workflows/release.yml, CONTRIBUTING.md	The release job validates the dispatched version and waits for approval. The publish job uses queued release-publish concurrency. The release instructions describe automated approval and manual fallback flows.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• nicholls73/openbrain#85: Both update release documentation for approval-gated workflows.
• nicholls73/openbrain#104: Both modify the prepare-release job and release approval flow.
• nicholls73/openbrain#105: Both modify the dispatch and approval wiring in the release workflow.

Sequence Diagram(s)

sequenceDiagram
  participant PrepareRelease as prepare-release job
  participant GitHub as GitHub repository
  participant ReleaseWorkflow as release workflow
  participant ApprovalJob as approval job
  participant ReleaseJob as release job
  participant PublishJob as publish job

  PrepareRelease->>GitHub: Dispatch prepared-release with version
  GitHub->>ReleaseWorkflow: Start versioned release run
  ReleaseWorkflow->>ApprovalJob: Request environment approval
  ApprovalJob->>ReleaseJob: Complete approval
  ReleaseJob->>ReleaseJob: Verify dispatched version
  ReleaseJob->>PublishJob: Start release publishing
  PublishJob->>PublishJob: Use release-publish concurrency

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: restoring automatic release approvals for the release workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/restore-automatic-release-approval

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Around line 22-28: Move the release-publish concurrency configuration from the
release job to workflow scope so it covers both release and publish jobs.
Preserve the release-publish group name and cancel-in-progress: false behavior,
ensuring later workflow runs wait while either job is publishing.
- Around line 2-8: After the Find release candidate step, add a
repository_dispatch-only validation comparing
github.event.client_payload.version with steps.candidate.outputs.version; fail
the workflow when either value is empty or they differ. Keep workflow_dispatch
exempt, and retain the existing post-merge check unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 55946d31-6926-4177-bcdb-1a9cda067067

📥 Commits

Reviewing files that changed from the base of the PR and between 709020d and f0bce2e.

📒 Files selected for processing (3)

• .github/workflows/ci.yml
• .github/workflows/release.yml
• CONTRIBUTING.md

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Around line 26-28: Update the workflow validation configuration used for
.github/workflows/release.yml so it recognizes the valid GitHub Actions
concurrency setting queue: max, including both reported locations. Keep queue:
max unchanged unless the release workflow intentionally permits canceling
pending runs; prefer upgrading or configuring the validator/schema to support
this syntax.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d7dd6983-8747-4be9-9c52-494d24b6949b

📥 Commits

Reviewing files that changed from the base of the PR and between f0bce2e and 60dade9.

📒 Files selected for processing (1)

• .github/workflows/release.yml