Dispatch verification for published releases

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @udx/devops

.github/workflows/publish-release.yml

@@ -6,6 +6,7 @@ on:
       - production
 
 permissions:
+  actions: write
   contents: write
 
 concurrency:
@@ -104,6 +105,19 @@ jobs:
             --title "Rabbit Automation Action $RELEASE_TAG" \
             --notes-file "$RELEASE_NOTES"
 
+      - name: Start release verification
+        if: steps.release.outputs.publish == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ steps.release.outputs.tag }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          gh workflow run release.yml \
+            --repo "$GITHUB_REPOSITORY" \
+            --ref "$GITHUB_REF_NAME" \
+            -f release_tag="$RELEASE_TAG"
+
       - name: Notify Rabbit support
         if: steps.release.outputs.publish == 'true'
         env:
@@ -116,7 +130,7 @@ jobs:
           payload="$(jq -nc \
             --arg tag "$RELEASE_TAG" \
             --arg url "$RELEASE_URL" \
-            '{text: ("Rabbit Automation Action " + $tag + " is published. Marketplace action: open " + $url + ", wait for Verify release to pass, then publish to the GitHub Marketplace. Verify the listing and complete the caller canary before moving v1.")}')"
+            '{text: (":rocket: Rabbit Automation Action *" + $tag + "* is published.\n" + $url + "\n\nNext:\n• Wait for *Verify release* to pass.\n• Publish it in GitHub Marketplace (Deployment, Security).\n• Verify the listing and complete the caller canary before moving `v1`.")}')"
           curl --fail-with-body --silent --show-error \
             --request POST \
             --header 'Content-type: application/json' \

.github/workflows/release.yml

@@ -4,6 +4,12 @@ on:
   release:
     types:
       - published
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: Published semantic tag to verify
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -16,7 +22,7 @@ jobs:
       - name: Validate semantic release tag
         shell: bash
         env:
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          RELEASE_TAG: ${{ github.event.release.tag_name || inputs.release_tag }}
         run: |
           set -euo pipefail
           if [[ ! "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
@@ -27,7 +33,7 @@ jobs:
       - name: Checkout release
         uses: actions/checkout@v7
         with:
-          ref: ${{ github.event.release.tag_name }}
+          ref: ${{ github.event.release.tag_name || inputs.release_tag }}
 
       - name: Install yq
         shell: bash

.rabbit/repo.yaml

@@ -9,7 +9,7 @@ branches:
     rules: {}
   - name: chore/publish-versioned-releases
     rules: {}
-  - name: dependabot/github_actions/actions/upload-artifact-7
+  - name: fix/dispatch-release-verification
     rules: {}
   - name: fix/gcp-credential-mount
     rules: {}
@@ -78,11 +78,17 @@ workflows:
         branches:
           - production
     permissions:
+      actions: write
       contents: write
   - path: .github/workflows/release.yml
     triggers:
       release:
         types:
           - published
+      workflow_dispatch:
+        inputs:
+          release_tag:
+            required: true
+            type: string
     permissions:
       contents: read

docs/releasing.md

@@ -15,7 +15,9 @@ The action is released from `production`. Patch releases are immutable
 The `Publish release` workflow runs after every `production` push. It does
 nothing unless that push changes the `package.json` version; then it runs
 `make test`, refuses to reuse an existing tag, and publishes that GitHub
-release from the merged commit. The `Verify release` workflow then validates the published tag.
+release from the merged commit. It explicitly dispatches `Verify release` for
+the published tag, because release events created with `GITHUB_TOKEN` do not
+start other workflows.
 After the GitHub release is created, `#rabbit-support` receives the Marketplace
 handoff through `SLACK_WEBHOOK_RABBIT_SUPPORT`; the message directs the
 operator to wait for verification before publishing to Marketplace.