fix: recover releases from verified merged PRs

[jasonmadigan]

Release preparation currently uses a topic branch covered by maintenance-branch protection, and the Release workflow's manual dispatch is skipped by its PR-only condition. Fork release PR events also lack the publication secret.

Use a separate preparation branch prefix and add recovery from a merged release PR number, dispatched from main. Publication verifies the PR's target, merge commit, branch tip, required checks, Makefile version and existing tag. It uses tooling from main and pushes only the intended tag; existing releases are reported without republishing. The guide now covers full commit SHAs, reviewed backport PRs, maintenance branches and recovery.

Validation: 11 PR-resolution tests and 7 publication tests pass using mocked GitHub responses and temporary local Git repositories. ShellCheck, actionlint and git diff --check pass. A dedicated workflow runs the release-tool tests. Live publication has not been exercised; existing maintenance branches can use the dispatch path once this lands on main.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}