ci(service-lifecycle): trigger on release.yml; devlog for the bot-PR toggle

[lidge-jun]

Summary

• service-lifecycle.yml now also triggers on .github/workflows/release.yml (push and pull_request), and release.yml's service gate regex lists the same path. A release-branch commit that touched only release.yml ([WRONG BRANCH] release: carry the release.yml permissions fix onto main for v2.40.0 #3263/[WRONG BRANCH] release: carry the release.yml permissions fix onto preview for v2.40.0-preview.20260902 #3264 for v2.40.0) produced no lifecycle run, so the gate dead-ended and both dispatches needed a manual workflow_dispatch.
• devlog/_plan/260902_windows_ci_release/080_release_automation_followups.md: provenance of the repository toggle "Allow GitHub Actions to create and approve pull requests" (never on — GitHub default, three dated false readings, no disabling commit/devlog/chat), the least-privilege decision, and the applied change via REST (read-back true). That toggle is a repository setting, not a file in this PR.

Verification

• bun test tests/ci-workflows.test.ts 135 pass — it pins that the PR and push path lists match and that every push path satisfies the release gate regex.
• bun run privacy:scan green.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults (GitHub Actions: widens a trigger only; no permission or secret change. The repo toggle's security note is in 080.)

Summary by CodeRabbit

• Bug Fixes
  • Release workflow changes now trigger the required service validation before publishing.
  • Service lifecycle checks now run when release workflow configuration changes, including release-branch updates.
• Documentation
  • Added planning documentation covering release automation follow-ups and repository workflow configuration.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T10:57:17.832454Z	b84eafc	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[lidge-jun]

Owner admin merge, user-authorized (release-train follow-ups). Workflow trigger widening + devlog; ci-workflows 135 pass locally.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 05cce0e4-275a-4967-9d20-cf5b6b5fb244

📥 Commits

Reviewing files that changed from the base of the PR and between 7424719 and b84eafc.

📒 Files selected for processing (3)

• .github/workflows/release.yml
• .github/workflows/service-lifecycle.yml
• devlog/_plan/260902_windows_ci_release/080_release_automation_followups.md

---

📝 Walkthrough

Walkthrough

The Service lifecycle workflow now runs when .github/workflows/release.yml changes. The release gate also requires that lifecycle run. A planning document records the related repository permission decision and workflow path-filter issue.

Changes

Release lifecycle gating

Layer / File(s)	Summary
Align workflow triggers and release gate .github/workflows/service-lifecycle.yml, .github/workflows/release.yml	The pull_request and push path filters include .github/workflows/release.yml at lines 17–20 and 31–34. The release gate includes the same path in its grep -Eq pattern at line 268.
Record release automation follow-ups devlog/_plan/260902_windows_ci_release/080_release_automation_followups.md	The document records the repository workflow-permission history and decision at lines 1–42. It also records the Service lifecycle path-filter gap and the matching trigger and gate updates at lines 44–51.

Estimated code review effort: 2 (Simple) | ~10 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/release-automation-followups

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}