ci: drive releases with release-please and Communique notes

.github/workflows/release-please.yml

@@ -0,0 +1,91 @@
+name: Release Please
+
+# Maintains the single release PR (version bump + Communique-written
+# CHANGELOG section) and, when that PR merges, creates the tag + GitHub
+# Release and dispatches the tag-driven Release pipeline.
+#
+# Runs release-please as a library (src/tools/release-please-runner.ts)
+# instead of googleapis/release-please-action because the stock action cannot
+# use a custom changelog generator, and this repo's changelog entries come
+# from Communique.
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: release-please-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  actions: write
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Check out main
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          ref: main
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up mise
+        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+        with:
+          install_args: --locked
+
+      - name: Install CI dependencies
+        run: mise run bootstrap-ci
+
+      - name: Run release-please with Communique notes
+        id: release_please
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          COMMUNIQUE_MODEL: ${{ vars.COMMUNIQUE_MODEL }}
+        run: npx tsx src/tools/release-please-runner.ts
+
+      # Tags created with the workflow token never trigger `push: tags`
+      # workflows, so start the Release pipeline (quality gates, verified
+      # tarball, GitHub Release assets, npm publish) explicitly. The
+      # `!cancelled()` guard matters: the runner writes the release outputs
+      # before it rebuilds the release PR notes, so a notes failure (e.g. an
+      # LLM outage) still dispatches the pipeline for the tag it just created
+      # — a rerun could not recover that, because the merged release PR is
+      # already labeled `autorelease: tagged`.
+      - name: Dispatch the Release pipeline for created releases
+        if: ${{ !cancelled() && steps.release_please.outputs.releases_created == 'true' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAGS: ${{ steps.release_please.outputs.release_tags }}
+        run: |
+          set -euo pipefail
+          read -ra tags <<< "$RELEASE_TAGS"
+          for tag in "${tags[@]}"; do
+            gh workflow run release.yml --field "tag=$tag"
+          done
+
+      # Branch pushes made with the workflow token never trigger
+      # `pull_request` workflows, so dispatch the checks explicitly — the
+      # dispatched runs report against the branch head SHA and satisfy the
+      # release PR's required status checks.
+      - name: Dispatch checks onto the release PR branch
+        if: ${{ !cancelled() && steps.release_please.outputs.prs_created == 'true' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_BRANCHES: ${{ steps.release_please.outputs.pr_branches }}
+        run: |
+          set -euo pipefail
+          read -ra branches <<< "$PR_BRANCHES"
+          for branch in "${branches[@]}"; do
+            gh workflow run ci.yml --ref "$branch"
+            gh workflow run validate-skills.yml --ref "$branch"
+          done

.github/workflows/release.yml

@@ -361,17 +361,22 @@ jobs:
           CHECKSUM_FILENAME: ${{ needs.prepare-release.outputs.checksum_filename }}
         run: |
           set -euo pipefail
-          create_flags=()
+          # Applied on both paths: under the release-please flow the release
+          # already exists (created at release-PR merge), so the edit path is
+          # the normal route and must keep prereleases off the Latest badge
+          # just like the create path does.
+          release_flags=()
           if [[ "$PACKAGE_VERSION" == *-* ]]; then
-            create_flags+=(--prerelease --latest=false)
+            release_flags+=(--prerelease --latest=false)
           fi
 
           if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
             gh release edit \
               "$RELEASE_TAG" \
               --repo "$GITHUB_REPOSITORY" \
               --title "$RELEASE_TITLE" \
-              --notes-file "$RELEASE_NOTES_FILE"
+              --notes-file "$RELEASE_NOTES_FILE" \
+              "${release_flags[@]}"
             gh release upload \
               "$RELEASE_TAG" \
               "$RELEASE_DIR/$TARBALL_FILENAME" \
@@ -387,7 +392,7 @@ jobs:
               --verify-tag \
               --title "$RELEASE_TITLE" \
               --notes-file "$RELEASE_NOTES_FILE" \
-              "${create_flags[@]}"
+              "${release_flags[@]}"
           fi
 
   publish-npm: