* [move-flow] Add hardened release pipeline
Drive cross-platform move-flow releases from
.github/workflows/move-flow-release.yaml, wrapping the shared
binary-release.yaml workflow.
Pre-flight job: validates the version input, rejects skip_checks on a
real release, resolves the requested ref to a single source SHA and pins
every platform build to it, and gates real releases on reachability from
origin/main or release-* plus a tag/release collision check.
Publish-plugin job: downloads the prebuilt Linux binary, regenerates the
Claude Code plugin, and opens or refreshes a PR against aptos-labs/aptos-ai.
It skips cleanly when the publisher PAT is absent.
aptos-move-flow is not published to crates.io (its dependencies are
path-only workspace crates), so Cargo.toml sets publish = false and the
crate is distributed via GitHub Releases and cargo install --git.
build_binary_release.sh resolves the aptos-move-flow crate path, since
its directory name does not match the crate name.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Modify dry_run parameter description
Updated the description for the dry_run parameter.
* Clean up CHANGELOG.md by removing old entries
Removed outdated release notes and version history.
* [move-flow] Harden release workflow
Keep the release path self-contained and ensure real releases build from validated refs, publish plugin artifacts safely, and create tags at the resolved source commit.
* [move-flow] Reduce aptos-core workflow to source-tag preparation
Move binary builds, GitHub Releases, and plugin publishing to aptos-ai so
aptos-core only validates and creates the move-flow-v<version> source tag.
Create the tag via the GitHub API and run the release gates during dry runs.
* [move-flow] Keep dry-run path read-only
Split the source-tag workflow into a read-only validate job and a
write-scoped create-tag job that only runs on real releases, so dry runs
never hold a contents:write token.
* [move-flow] Resolve PLUGIN_TREE to an absolute path
Validate and copy the plugin tree using an absolute path so a relative
PLUGIN_TREE keeps working after the script cd's into the aptos-ai repo.
* [move-flow] Gate source tag on main only
Decouple move-flow releases from aptos-core node releases: require the
release commit to be reachable from origin/main and drop the
aptos-release-v* reachability path.
---------
Co-authored-by: zwxxb <zwxxb@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
