Make server releases immutable-safe

[marcelveldt]

What does this implement/fix?

GitHub releases currently become public before their exact assets, multi-architecture image, and downstream updates are verified.

• Freeze one source commit and prepare exact draft assets and image before publication.
• Verify release immutability, attestations, tag, assets, and OCI digest before promoting aliases.
• Replace the legacy privileged token with narrowly scoped GitHub App tokens and document recovery and rollout.

Related issue (if applicable):

• Depends on Use bot tokens for automated releases models#326

Types of changes

• Bugfix (non-breaking change which fixes an issue) — bugfix
• New feature (non-breaking change which adds functionality) — new-feature
• Enhancement to an existing feature — enhancement
• New music/player/metadata/plugin provider — new-provider
• Breaking change (fix or feature that would cause existing functionality to not work as expected) — breaking-change
• Refactor (no behaviour change) — refactor
• Documentation only — documentation
• Maintenance / chore — maintenance
• CI / workflow change — ci
• Dependencies bump — dependencies

Checklist

• The code change is tested and works locally.
• pre-commit run --all-files passes.
• pytest passes, and tests have been added/updated under tests/ where applicable.
• For changes to shared models, the companion PR in music-assistant/models is linked.
• For changes affecting the UI, the companion PR in music-assistant/frontend is linked.
• I have read and complied with the project's AI Policy for any AI-assisted contributions.
• I have raised a PR against the documentation repository targeting the main or beta branch as appropriate.

[Copilot]

Pull request overview

This PR hardens the server release automation by freezing an exact source commit, validating immutability/attestations/assets/image digests before publishing, and replacing the legacy privileged token flow with narrowly scoped GitHub App tokens.

Changes:

• Added scripts/release_workflow.py (and tests) to centralize release-tag/version, asset, OCI manifest, and add-on changelog verification/update logic in Python.
• Updated the release workflow to build/verify an exact multi-arch image tag first, publish an immutable release only after validation, and only then promote rolling image aliases + downstream updates.
• Updated the release-notes generator/action + tests to compare against an exact head SHA instead of a moving branch name.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/test_generate_release_notes.py	Updates tests to reflect SHA-based comparisons for release note generation.
tests/scripts/test_release_workflow.py	Adds focused tests for the new immutable-safe release workflow helper behaviors and workflow pinning/token removal.
scripts/release_workflow.py	New helper CLI/library for release channel/version decisions, asset verification, OCI manifest verification, and add-on changelog updates.
.github/workflows/release.yml	Major rework to freeze a source SHA, verify draft/assets/image, publish immutably, then promote aliases and downstream updates using scoped tokens.
.github/workflows/RELEASE_WORKFLOW_GUIDE.md	Rewrites the guide to document the new immutable-safe release process and recovery/rollout steps.
.github/workflows/RELEASE_NOTES_GENERATION.md	Updates documentation to describe SHA-based comparisons and the tag-based previous-tag selection rules.
.github/workflows/auto-release.yml	Refactors auto-release to resolve channel branch + source SHA first, compute versions from tags, then call the reusable release workflow.
.github/actions/generate-release-notes/generate_notes.py	Switches “between tags” logic to compare against a fixed SHA rather than a branch name.
.github/actions/generate-release-notes/action.yml	Updates composite action interface to accept head-sha and a checkout path, and pins setup-python.

Comments suppressed due to low confidence (1)

.github/workflows/release.yml:996

• [PROBLEM] actions/create-github-app-token is given repositories: ${{ github.repository }} (owner/repo) while other steps pass bare repo names (e.g. repositories: home-assistant-addon), which is likely to break token minting because owner is already set separately.

          repositories: ${{ github.repository }}

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.