ci(release): detach non-blocking E2E (#11031)

* ci(release): detach non-blocking E2E

* test(release): pin E2E dispatch retries

.github/workflows/e2e.yml

@@ -1,5 +1,7 @@
 name: E2E
 
+run-name: E2E ${{ inputs.ref || github.ref }}
+
 on:
   workflow_call:
     inputs:

.github/workflows/release-cut.yml

@@ -777,7 +777,7 @@ jobs:
             echo "## Release E2E Signal"
             echo ""
             echo "- Terminal rendering golden is release-blocking."
-            echo "- Full E2E is diagnostic/non-blocking release evidence."
+            echo "- Full E2E runs separately after publication and cannot change the release result."
             echo "- Terminal rendering release evidence is diagnostic/non-blocking."
             echo ""
             echo "Publishing behavior is controlled by the existing job dependencies; this summary does not change release gating."
@@ -807,15 +807,6 @@ jobs:
 
           node config/scripts/create-draft-release.mjs "$TAG"
 
-  # Why: tag-scoped E2E gives release visibility, but the suite is flaky enough
-  # that publish-release must not depend on it.
-  e2e:
-    needs: cut
-    if: needs.cut.outputs.should_release == 'true'
-    uses: ./.github/workflows/e2e.yml
-    with:
-      ref: refs/tags/${{ needs.cut.outputs.tag }}
-
   terminal-rendering-golden:
     needs: cut
     if: needs.cut.outputs.should_release == 'true'
@@ -1930,6 +1921,32 @@ jobs:
             --prerelease="$prerelease" \
             --repo "$GITHUB_REPOSITORY"
 
+  post-release-e2e:
+    needs:
+      - cut
+      - publish-release
+    if: ${{ needs.cut.outputs.tag != '' }}
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+    steps:
+      - name: Dispatch tag-scoped E2E
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ needs.cut.outputs.tag }}
+        run: |
+          for attempt in 1 2 3; do
+            if gh workflow run e2e.yml \
+              --repo "$GITHUB_REPOSITORY" \
+              --ref "$TAG" \
+              --raw-field "ref=refs/tags/$TAG"; then
+              echo "Dispatched post-release E2E for $TAG."
+              exit 0
+            fi
+            [[ "$attempt" -eq 3 ]] || sleep "$((attempt * 5))"
+          done
+          echo "::warning::Failed to dispatch post-release E2E for $TAG after 3 attempts."
+
   homebrew-bump-published-rc-draft:
     needs:
       - cut

config/scripts/release-e2e-dispatch-contract.test.mjs

@@ -0,0 +1,37 @@
+import { readFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+
+const projectDir = resolve(import.meta.dirname, '../..')
+const releaseWorkflow = parse(
+  readFileSync(join(projectDir, '.github/workflows/release-cut.yml'), 'utf8')
+)
+const e2eWorkflow = parse(readFileSync(join(projectDir, '.github/workflows/e2e.yml'), 'utf8'))
+
+describe('release E2E dispatch contract', () => {
+  it('dispatches tag-scoped E2E only after publication', () => {
+    const dispatchJob = releaseWorkflow.jobs['post-release-e2e']
+    const dispatchStep = dispatchJob.steps.find((step) => step.name === 'Dispatch tag-scoped E2E')
+
+    expect(releaseWorkflow.jobs.e2e).toBeUndefined()
+    expect(dispatchJob.needs).toEqual(['cut', 'publish-release'])
+    expect(dispatchJob.if).toBe("${{ needs.cut.outputs.tag != '' }}")
+    expect(dispatchJob.permissions.actions).toBe('write')
+    expect(dispatchStep.env.TAG).toBe('${{ needs.cut.outputs.tag }}')
+    expect(dispatchStep.run).toContain('gh workflow run e2e.yml')
+    expect(dispatchStep.run).toContain('--ref "$TAG"')
+    expect(dispatchStep.run).toContain('--raw-field "ref=refs/tags/$TAG"')
+    expect(dispatchStep.run).toContain('for attempt in 1 2 3')
+    expect(dispatchStep.run).toContain('[[ "$attempt" -eq 3 ]] || sleep')
+    expect(dispatchStep.run).toContain('::warning::Failed to dispatch post-release E2E')
+  })
+
+  it('keeps detached E2E identifiable and manually dispatchable by ref', () => {
+    const refInput = e2eWorkflow.on.workflow_dispatch.inputs.ref
+
+    expect(e2eWorkflow['run-name']).toBe('E2E ${{ inputs.ref || github.ref }}')
+    expect(refInput.type).toBe('string')
+    expect(refInput.required).toBe(false)
+  })
+})