ci: 3-stage release workflow (prepare / review / publish)

[nebasuke]

Summary

• Restructures release.yaml into a 3-stage pipeline: build → prepare & review → publish
• Adds a review gate that validates the release bundle (binary count, SHA256 checksum verification, size audit) before publish
• Adds per-job least-privilege permissions with a permissions: {} baseline
• Adds SHA256 checksums for all release binaries
• Bundles all artifacts into a single tarball between stages for atomic handoff
• Pins publish-unit-test-result-action to v2.23.0 to fix transitive pinning (the previous commit hash resolved to an unpinned version)

Release workflow stages

1. Stage 0 — Build: label-check → prepare-matrix → build (5-platform matrix) + get-previous-release
2. Stage 1 — Prepare: downloads all build artifacts, creates universal macOS binary, generates SHA256 checksums, bundles into tarball
3. Stage 2 — Review: extracts bundle, lists contents, validates binary count, verifies checksums, displays sizes
4. Stage 3 — Publish: changelog, attestation (tag-only), GitHub Release (non-PR), dry-run summary (PR-only), then deploy-docs + check-install-script (tag-only)

Safety on PR

Requires ci:release label. Runs the full pipeline as a dry-run:

• Attestation: skipped (github.ref_type != 'tag')
• softprops publish: skipped (github.event_name == 'pull_request')
• deploy-docs / check-install-script: skipped (github.ref_type != 'tag')
• Environment gate: empty on PR (no manual approval needed)

Test plan

• Add ci:release label and verify the full pipeline runs end-to-end as dry-run
• Confirm no GitHub release is created
• Verify bundle contents and SHA256 checksums in review job logs
• Manual release: see https://github.com/NomicFoundation/solx/releases/tag/60c83f6

[Copilot]

Pull request overview

This PR restructures the release workflow into a 3-stage pipeline (build → prepare/review → publish) with enhanced security, validation, and dry-run capabilities for pull requests. The changes introduce per-job least-privilege permissions, SHA256 checksum generation and verification, artifact bundling between stages, and a review gate before publishing. It also enables PR dry-runs with the ci:release label to test the full release pipeline without creating actual releases.

Changes:

• Restructured workflow into 3 stages: build (multi-platform matrix), prepare (bundle artifacts + checksums), review (validate bundle), and publish (create release)
• Added permissions: {} baseline with per-job least-privilege permissions
• Enabled pull request dry-runs with ci:release label requirement
• Updated publish-unit-test-result-action to v2.23.0 (pinned commit)

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 11 comments.

File	Description
.github/workflows/release.yaml	Complete workflow restructure with 3-stage pipeline, label-gated PR support, SHA256 checksums, bundle validation, and environment-based gates
.github/actions/rust-unit-tests/action.yml	Updated publish-unit-test-result-action pins to v2.23.0 for all platforms (Linux, macOS, Windows)

Comments suppressed due to low confidence (1)

.github/workflows/release.yaml:96

• The conditional logic on lines 90-96 attempts to access github.event.inputs.* values even when the event is not workflow_dispatch. For pull_request events, these inputs will be undefined/null, which could cause the bash test expressions [ ${{ github.event.inputs.release_windows_amd64 }} != true ] to fail with syntax errors due to empty expansion.

Consider restructuring to only access inputs when the event is workflow_dispatch, or use github.event.inputs.release_windows_amd64 || true to provide a default value.

          if [ '${{ github.event_name }}' = 'workflow_dispatch' ] && [ ${GITHUB_REF_TYPE} != tag ]; then
            [ ${{ github.event.inputs.release_windows_amd64 }} != true ] && WINDOWS=
            [ ${{ github.event.inputs.release_macos_amd64 }} != true ] && MACOS_AMD64=
            [ ${{ github.event.inputs.release_macos_arm64 }} != true ] && MACOS_ARM64=
            [ ${{ github.event.inputs.release_linux_amd64_gnu }} != true ] && LINUX_AMD64_GNU=
            [ ${{ github.event.inputs.release_linux_arm64_gnu }} != true ] && LINUX_ARM64_GNU=
          fi

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[nebasuke]

Manual release here: https://github.com/NomicFoundation/solx/releases/tag/60c83f6