Refactor: Call the shared release workflow

[ModeSevenIndustrialSolutions]

Why

tag-push.yaml here duplicated a validate-then-promote job graph that 96
repositories each carried their own copy of. This replaces it with a thin
caller delegating to the
release reusable in generic-workflows,
pinned to
v0.0.4
(007258a132e4ba5358a20a5c0a902fa04de3a045).

Renamed to release.yaml

The name describes the outcome rather than the trigger, and sits beside the
release-drafter.yaml that creates the draft this workflow publishes.

Behaviour changes to be aware of

The caller passes no inputs, so it adopts the reusable's defaults in full —
the release-gating policy and the runner-hardening defaults.

1. Gating. Repositories that enforced only the versioning scheme, signature
and pre-release checks gain four gates:

Gate	Effect
enforce_increment	Tag must exceed the highest existing comparable tag
require_branch	Tag commit must be reachable from the default branch
require_recent	Tag object must be under three minutes old
require_latest	Tag must point at the current tip of the default branch

Tags that are stale, raised off the default branch, or not at its tip now fail
rather than produce a faulty immutable release. This is the intended
organisation-wide default; it had simply not been rolled out everywhere. Eight
repositories already carried all eight gates — for those, nothing tightens.

2. Runner hardening. 14 repositories still ran harden-runner in audit
mode and move to block. Every one of those 14 also lacks the
harden-runner-block-action allow-list loader, while all 82 on block have
it — they are stragglers on an older template, not deliberate opt-outs. After
this conversion all 96 run an identical workflow, so the egress profile is
uniform and already proven by the 82 running these exact steps under block.

3. Concurrency. Six repositories used a global group
(${{ github.workflow }}), serialising all releases; they move to the
estate-standard per-tag group (${{ github.workflow }}-${{ github.ref }}).
Distinct tags are independent work, and the reusable serialises itself per-tag
as well.

mark_latest defaults to true, matching the latest: true the old promote
step passed.

Tag deletions

Deleting a tag also fires this push event. The reusable already guards its
own jobs with if: ${{ !github.event.deleted }}, but the caller carries the
guard too so that — exactly as before — no run starts at all.

Validation

The reusable and this caller pattern were exercised end-to-end in
test-release-process,
the repository built to test the organisation's release tooling: a signed tag
push validated against the full gate set and promoted its draft release. This
generated caller passes actionlint and yamllint against this repository's
own configuration.

Review note

The caller keeps its own concurrency block. That is safe: the reusable
serialises under generic-workflows-release-${{ github.ref }}, a literal
prefix that cannot collide with the caller's own group.

timeout-minutes is deliberately absent — GitHub does not permit it on a job
that calls a reusable workflow (actionlint rejects it). The reusable sets its
own timeouts of 2, 5 and 5 minutes on its three jobs.

[Copilot]

🟡 Human review recommended

It changes the repository’s release publication path and tightens gating via an external reusable workflow, which warrants a final human check before relying on it for releases.

Pull request overview

Refactors the repository’s tag-driven release automation by replacing the previously duplicated “validate then promote” job graph with a thin caller that delegates to the organization’s shared reusable release workflow in lfreleng-actions/generic-workflows (pinned to b80a5a8…, v0.0.3). This centralizes release gating and promotion behavior and aligns this repo with the org-wide default release policy.

Changes:

• Replaced the in-repo “fat” tag-push workflow implementation with a reusable-workflow call.
• Renamed the workflow file from tag-push.yaml to release.yaml while keeping tag-push triggering and concurrency serialization.

File summaries

File	Description
.github/workflows/tag-push.yaml	Removes the duplicated validate/publish implementation previously maintained locally.
.github/workflows/release.yaml	Adds a thin tag-push caller that invokes the shared reusable release workflow pinned to v0.0.3.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[Copilot]

🟡 Not ready to approve

The pinned generic-workflows version used in code (v0.0.4) does not match the PR description (v0.0.3), which must be aligned for an accurate review of the adopted behavior/gates.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Review details

Suppressed comments (1)

.github/workflows/release.yaml:45

• The PR description says this workflow is pinned to generic-workflows v0.0.3 (commit b80a5a8374fa54986ec542617efaa35e93515af6), but the caller actually uses commit 007258a132e4ba5358a20a5c0a902fa04de3a045 (v0.0.4). This mismatch makes it hard to review the exact gate set/behavior being adopted—please align the PR description and the pinned ref (either update the description to v0.0.4 or pin the workflow back to v0.0.3).

    uses: lfreleng-actions/generic-workflows/.github/workflows/release.yaml@007258a132e4ba5358a20a5c0a902fa04de3a045  # v0.0.4

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[tykeal]

🤖 Dependamerge
Approved this pull request ✅