[snake14]

Description

Makes the weekly release safer to leave running.

CI gate. A new version isn't released while a push CI run on the branch's head has failed, or is still running after ci-wait-minutes (default and maximum 45). The version is skipped, any earlier version being resumed is still finished, and then the run fails so the hold is seen. Runs that can't be read are held the same way. The newest run of each workflow decides, so rerunning a failed one clears it. A head with no push runs, such as a merge made with GITHUB_TOKEN, is released. A new skip-ci-check input releases anyway, for a run by hand when the failure is a false positive. The README's caller example passes it through from a dispatch input, and the job timeout goes from 20 to 90 minutes to cover the wait.

require-approver-token. When set, the run fails before releasing if approver-token is empty, so a secret that was renamed, removed or not passed doesn't go unnoticed. The step only sees whether the token is set, not the token.

Branch sweep. A maintained branch without the dispatched workflow file is skipped with a notice instead of failing the sweep. A workflow-file missing from the default branch still fails, since that means the input is wrong.

Smaller fixes. A warning when the release replaces a date set by hand on the changelog entry. Waiting for held runs on the release date PR now counts polls instead of timing against SECONDS, which fixes an intermittent failure in the late-runs test.

Issue No

Related to #36

Steps to Replicate the Issue

1. Merge a version bump whose push CI then fails, and let the weekly release run.
2. Expected: the version isn't released until CI passes, or someone releases it deliberately.
3. Actual: it is tagged and published regardless.

Checklist

• [✔] Tested locally or on demo2/demo3?
• [✔] New test case added/updated?
• [NA] Are all newly added texts included via translation?
• [NA] Are text sanitized properly? (Eg use of v-text v/s v-html for vue)
• [NA] Version bumped?
• [✔] I have understood, reviewed, and tested all AI outputs before use
• [✔] All AI instructions respect security, IP, and privacy rules
• [✔] Documentation updated?

[lachiebol]

In general looks good, just curious.

Should we check the head is the same after 120 seconds as well?

I see we have this, but afterwards, we wait 120 seconds and then approve, so there's a gap where changes could be added and subsequently approved

merge_plugin_release_date_pr.sh

head_sha=$(gh pr view "$pr" --json headRefOid --jq .headRefOid)
if [[ "$head_sha" != "$tagged_sha" ]]; then
    leave_open "its head is not the commit tagged $VERSION."
fi

I see we have --match-head-commit "$head_sha" so the script won't automatically merge, but someone could merge themself if it's been approved

[snake14]

Thanks @lachiebol, good catch. The head is now re-checked after the wait, and the approval is pinned to the tagged commit with commit_id, so a push during the wait is neither approved nor merged. Please re-review.

[lachiebol]

LGTM