SEP-1212: Split release CI into prep + rc1 steps for pre-RC1 internal QA day

[yyyyyyyan]

Summary

Split the Release GitHub Actions workflow into two dispatches so the GAS team can validate a SHA-tagged internal-registry image during a 1-day internal QA window before rc1 publishes to Docker Hub.

• New release_type: prep (Day 27) — cmd_prep + make release-prep create release/vX.Y.Z from main HEAD, fire the rule SEP-79: Add environment to the inventory #16 Jira version-create webhook, open the main → vX.Y+1.0.dev0 dev-bump PR, build the wheel, and trigger Jenkins with pushImageDocker=false (SHA-tagged internal-registry image only). No version bump, no tag.
• cmd_rc(RC=1) made idempotent against a prior prep — probes origin for the existing release branch and switches into an after-prep path: syncs non-destructively to origin/{branch} (refuses to reset when local is ahead), re-fires the rule SEP-79: Add environment to the inventory #16 webhook (rule is naturally idempotent), and gates the dev-bump PR call on origin/main's actual pyproject.toml version. The fresh-from-main path is bit-for-bit unchanged (AC Basic inventory #6).
• make trigger-jenkins parameterised with PUSH_IMAGE_DOCKER (default true). Deviation from the AC's literal wording (trigger-jenkins-internal SHA=<sha> or MODE=internal): chose this variable-on-existing-target approach as a finer-grained third path. Pre-approved in the implementation plan.
• Workflow YAML adds prep to the choices, validates rc_number must be empty for prep, and dispatches to make release-prep.
• 22 new unit tests cover cmd_prep happy path + preconditions + ordering + head-sha → Jenkins, cmd_rc after-prep idempotency (webhook re-fire, dev-bump skip-when-main-bumped, error-when-PR-unmerged, non-destructive sync, refuse-when-local-ahead, abort-on-rev-list-failure, still-bumps-and-tags), _remote_branch_exists exit-code switch (0 / 2 / 128), and prep argparse plumbing.

The workflow doc (release-process.md) is documented separately and synced to Notion — the file is gitignored locally and does not ship in this PR.

Tested

• N/A — pure CI tooling. Tested via pytest tests/scripts/test_release.py -v (57 tests pass), make -n release-prep VERSION=0.99.0, make -n trigger-jenkins TAG=abc PUSH_IMAGE_DOCKER=false, and python3 scripts/release.py --help. The real integration test is the next release cycle's Day 27 dispatch by the release manager.

Checklist

• New/modified functions have type hints and rST docstrings
• New tests added for new features or bug fixes
• Database migrations generated if models changed (make makemigrations) (N/A — no model changes)
• User-facing changes documented (README, inline help, UI text) (N/A — release process change, documented in the workflow doc)
• Configuration changes documented with examples

[Copilot]

Pull request overview

Splits the Release GitHub Actions workflow into a Day-27 prep step and the existing Day-28 rc1 step so the GAS team can validate a SHA-tagged internal-registry image during an internal QA window before rc1 publishes to Docker Hub. The split factors out scope-lock side effects (release branch creation, Jira version-create webhook, dev-bump PR) into prep, keeps rc1 idempotent against a prior prep via remote-branch probing, and parametrises make trigger-jenkins with PUSH_IMAGE_DOCKER.

Changes:

• New cmd_prep + make release-prep + prep argparse subcommand triggering an internal-only Jenkins build tagged by HEAD SHA.
• cmd_rc(RC=1) made idempotent against a prior prep: probes origin, syncs non-destructively, re-fires the webhook, gates the dev-bump PR on origin/main's pyproject.toml.
• make trigger-jenkins accepts PUSH_IMAGE_DOCKER (defaults to true); workflow YAML adds prep choice and validates rc_number empty for prep.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
scripts/release.py	Adds cmd_prep, _remote_branch_exists, after-prep helpers, and dev-bump idempotency for cmd_rc.
tests/scripts/test_release.py	Adds 22 unit tests covering prep happy path, preconditions, ordering, and cmd_rc after-prep idempotency / probes.
Makefile	Adds release-prep target and parameterises trigger-jenkins with PUSH_IMAGE_DOCKER (default true).
.github/workflows/release.yml	Adds prep choice, validates rc_number is empty for prep, dispatches make release-prep.

[yyyyyyyan]

Code review

Found 1 issue:

1. The module docstring at the top of scripts/release.py still lists only rc and stable under Subcommands: — the newly-added prep subcommand is missing. Updating the docstring keeps the module header consistent with the actual CLI surface.

SEP/scripts/release.py

Lines 17 to 38 in 8a0b5dc

	"""Release SEP — cut an RC or promote to stable.
	Owns the preconditions, version-bump, tagging, GitHub release, and Jenkins
	trigger for ``make release-rc`` and ``make release-stable``. Both Makefile
	targets are thin shims that forward ``VERSION`` / ``RC`` to this script.
	Subcommands:
	- ``rc``: cut release candidate ``vX.Y.ZrcN`` from ``main`` (RC=1) or the
	existing ``release/vX.Y.Z`` branch (RC>1). When RC=1, dispatches the Jira
	``version-create`` automation webhook (via ``scripts/post_jira_webhook.py``)
	before the long-running build / push steps to lock the
	``fixVersion=sep-next`` scope early.
	- ``stable``: promote ``release/vX.Y.Z`` to stable ``vX.Y.Z`` and create a
	dev-version-bump PR on ``main``. The Jira ``version-released`` automation
	webhook is dispatched from the ``trigger-jenkins`` Makefile rule, gated on
	the same ``JENKINS_*`` env vars that gate the build trigger itself.
	All webhook dispatch is best-effort: ``scripts/post_jira_webhook.py`` exits
	non-zero on failure with a redacted warning on stderr, and the "Next steps"
	output always carries the manual reminder.
	"""