- release-cut.yml: require `^v[0-9]` tag shape when picking "latest
stable" from GitHub releases. Previously only `-rc.*` was excluded, so
publishing `mobile-v0.0.1` made it the latest stable, `strip_pre()`
reduced it to `mobile`, `Number("mobile")` → NaN → 0, and a patch-bump
produced `v0.0.1` (run 25304336767).
- homebrew-bump.yml: drop the blanket `release.published` trigger and
add tag-shape guards. Any published release in this repo (including
mobile) would otherwise fire the tap bump. Workflow_call from the
desktop pipeline is the only intended path now.
- Inline create-release / build / publish-release / e2e / homebrew-bump
jobs from release.yml into release-cut.yml, and delete release.yml.
Co-authored-by: Orca <help@stably.ai>
Two bugs surfaced on the v1.3.26 release:
1. release.yml's new `Trigger Homebrew cask bump` step failed with
HTTP 403 "Resource not accessible by integration". The publish-release
job's permissions block only listed `contents: write`, but
POST /actions/workflows/:id/dispatches requires `actions: write` on the
scoped-down GITHUB_TOKEN. Added the permission.
2. Even when the bump workflow does run, its `gh pr merge --auto` was
silently no-op'ing against the homebrew-orca tap, leaving bump PRs
open. `--auto` only activates when there's a required check or
branch-protection rule to wait on; the tap intentionally has neither.
Switched to a direct squash-merge so the tap stays hands-free as
originally intended.
Co-authored-by: Orca <help@stably.ai>
Neil
