Refactor: Call the shared release workflow

[ModeSevenIndustrialSolutions]

Why

tag-push.yaml here duplicated a validate-then-promote job graph that 96
repositories each carried their own copy of. This replaces it with a thin
caller delegating to the
release reusable in generic-workflows,
pinned to
v0.0.4
(007258a132e4ba5358a20a5c0a902fa04de3a045).

Renamed to release.yaml

The name describes the outcome rather than the trigger, and sits beside the
release-drafter.yaml that creates the draft this workflow publishes.

Behaviour changes to be aware of

The caller passes no inputs, so it adopts the reusable's defaults in full —
the release-gating policy and the runner-hardening defaults.

1. Gating. Repositories that enforced only the versioning scheme, signature
and pre-release checks gain four gates:

Gate	Effect
enforce_increment	Tag must exceed the highest existing comparable tag
require_branch	Tag commit must be reachable from the default branch
require_recent	Tag object must be under three minutes old
require_latest	Tag must point at the current tip of the default branch

Tags that are stale, raised off the default branch, or not at its tip now fail
rather than produce a faulty immutable release. This is the intended
organisation-wide default; it had simply not been rolled out everywhere. Eight
repositories already carried all eight gates — for those, nothing tightens.

2. Runner hardening. 14 repositories still ran harden-runner in audit
mode and move to block. Every one of those 14 also lacks the
harden-runner-block-action allow-list loader, while all 82 on block have
it — they are stragglers on an older template, not deliberate opt-outs. After
this conversion all 96 run an identical workflow, so the egress profile is
uniform and already proven by the 82 running these exact steps under block.

3. Concurrency. Six repositories used a global group
(${{ github.workflow }}), serialising all releases; they move to the
estate-standard per-tag group (${{ github.workflow }}-${{ github.ref }}).
Distinct tags are independent work, and the reusable serialises itself per-tag
as well.

mark_latest defaults to true, matching the latest: true the old promote
step passed.

Tag deletions

Deleting a tag also fires this push event. The reusable already guards its
own jobs with if: ${{ !github.event.deleted }}, but the caller carries the
guard too so that — exactly as before — no run starts at all.

Validation

The reusable and this caller pattern were exercised end-to-end in
test-release-process,
the repository built to test the organisation's release tooling: a signed tag
push validated against the full gate set and promoted its draft release. This
generated caller passes actionlint and yamllint against this repository's
own configuration.

Review note

The caller keeps its own concurrency block. That is safe: the reusable
serialises under generic-workflows-release-${{ github.ref }}, a literal
prefix that cannot collide with the caller's own group.

timeout-minutes is deliberately absent — GitHub does not permit it on a job
that calls a reusable workflow (actionlint rejects it). The reusable sets its
own timeouts of 2, 5 and 5 minutes on its three jobs.

[Copilot]

Pull request overview

Refactors the repository’s tag-push release automation to delegate validation and draft-release promotion to the shared lfreleng-actions/generic-workflows reusable release workflow (pinned to v0.0.3), reducing duplicated workflow logic and adopting the organization’s default release-gating policy.

Changes:

• Replaced the former “fat” tag-push workflow graph with a thin reusable-workflow caller pinned to b80a5a8… (v0.0.3).
• Renamed the workflow file from tag-push.yaml to release.yaml while preserving the existing concurrency serialization pattern.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/tag-push.yaml	Removed the duplicated validate-and-promote job graph previously run on tag pushes.
.github/workflows/release.yaml	Added a thin workflow that triggers on tag push and calls the shared reusable release workflow (pinned to v0.0.3), retaining the repo-specific concurrency group.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/release.yaml:45

• PR description says the reusable workflow should be pinned to generic-workflows v0.0.3 (commit b80a5a8…), but this workflow currently calls commit 007258a… (annotated as v0.0.4). Please align the pin with the PR description (either update the ref here, or update the PR description if v0.0.4 is intended).

    uses: lfreleng-actions/generic-workflows/.github/workflows/release.yaml@007258a132e4ba5358a20a5c0a902fa04de3a045  # v0.0.4

[tykeal]

🤖 Dependamerge
Approved this pull request ✅