fix(release): pin composite refs to v1.21.0

[bedatty]

GitHub Actions Shared Workflows

---

Description

Pins the three @develop composite action references in release.yml to the stable @v1.21.0 tag:

• src/config/release-tag-snapshot@develop → @v1.21.0
• src/config/release-tag-check@develop → @v1.21.0
• src/config/backmerge-pr@develop → @v1.21.0

These composites were introduced in #176 and are now included in the v1.21.0 release.

Affected workflow: release.yml (reusable)

Type of Change

• fix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)

Breaking Changes

None.

Testing

• YAML syntax validated locally
• Verified all existing inputs still work with default values
• Confirmed no secrets or tokens are printed in logs
• Checked that unrelated workflows are not affected

Caller repo / workflow run: N/A — ref-only change, no behavioral difference

Related Issues

Follow-up to #176

Summary by CodeRabbit

• Chores
  • Enhanced internal build and release workflow configuration to ensure more reliable and consistent deployment processes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 7e1fb8f5-58e6-4538-8e54-4acf8fad6c05

📥 Commits

Reviewing files that changed from the base of the PR and between 4851bfe and 9659774.

📒 Files selected for processing (1)

• .github/workflows/release.yml

---

Walkthrough

GitHub Actions workflow updated to pin three reusable actions to version v1.21.0 instead of tracking the develop branch. Affected actions: release-tag-snapshot, release-tag-check, and backmerge-pr. No other step logic or configuration changed.

Changes

Cohort / File(s)	Summary
GitHub Actions Dependencies .github/workflows/release.yml	Pinned three reusable action references from develop branch to @v1.21.0: release-tag-snapshot, release-tag-check, and backmerge-pr.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title accurately describes the main change: pinning composite action references to v1.21.0 in the release workflow.
Description check	✅ Passed	Description follows the template with all required sections completed: clear description of changes, correct type selection, testing checklist marked, and related issues noted.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/pin-release-composite-refs-v1.21.0

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[lerian-studio]

🔍 Lint Analysis

Check	Files Scanned	Status
YAML Lint	1 file(s)	✅ success
Action Lint	1 file(s)	✅ success
Pinned Actions	1 file(s)	✅ success
Markdown Link Check	no changes	⏭️ skipped
Spelling Check	1 file(s)	✅ success
Shell Check	1 file(s)	✅ success
README Check	1 file(s)	✅ success
Composite Schema	no changes	⏭️ skipped

---

_{🔍 View full scan logs}

[lerian-studio]

🛡️ CodeQL Analysis Results

Languages analyzed: actions

✅ No security issues found.

---

_{🔍 View full scan logs | 🛡️ Security tab}