Refactor: Call the shared release workflow

[ModeSevenIndustrialSolutions]

Why

tag-push.yaml here duplicated a validate-then-promote job graph that 96
repositories each carried their own copy of. This replaces it with a thin
caller delegating to the
release reusable in generic-workflows,
pinned to
v0.0.4
(007258a132e4ba5358a20a5c0a902fa04de3a045).

Renamed to release.yaml

The name describes the outcome rather than the trigger, and sits beside the
release-drafter.yaml that creates the draft this workflow publishes.

Behaviour changes to be aware of

The caller passes no inputs, so it adopts the reusable's defaults in full —
the release-gating policy and the runner-hardening defaults.

1. Gating. Repositories that enforced only the versioning scheme, signature
and pre-release checks gain four gates:

Gate	Effect
enforce_increment	Tag must exceed the highest existing comparable tag
require_branch	Tag commit must be reachable from the default branch
require_recent	Tag object must be under three minutes old
require_latest	Tag must point at the current tip of the default branch

Tags that are stale, raised off the default branch, or not at its tip now fail
rather than produce a faulty immutable release. This is the intended
organisation-wide default; it had simply not been rolled out everywhere. Eight
repositories already carried all eight gates — for those, nothing tightens.

2. Runner hardening. 14 repositories still ran harden-runner in audit
mode and move to block. Every one of those 14 also lacks the
harden-runner-block-action allow-list loader, while all 82 on block have
it — they are stragglers on an older template, not deliberate opt-outs. After
this conversion all 96 run an identical workflow, so the egress profile is
uniform and already proven by the 82 running these exact steps under block.

3. Concurrency. Six repositories used a global group
(${{ github.workflow }}), serialising all releases; they move to the
estate-standard per-tag group (${{ github.workflow }}-${{ github.ref }}).
Distinct tags are independent work, and the reusable serialises itself per-tag
as well.

mark_latest defaults to true, matching the latest: true the old promote
step passed.

Tag deletions

Deleting a tag also fires this push event. The reusable already guards its
own jobs with if: ${{ !github.event.deleted }}, but the caller carries the
guard too so that — exactly as before — no run starts at all.

Validation

The reusable and this caller pattern were exercised end-to-end in
test-release-process,
the repository built to test the organisation's release tooling: a signed tag
push validated against the full gate set and promoted its draft release. This
generated caller passes actionlint and yamllint against this repository's
own configuration.

Review note

The caller keeps its own concurrency block. That is safe: the reusable
serialises under generic-workflows-release-${{ github.ref }}, a literal
prefix that cannot collide with the caller's own group.

timeout-minutes is deliberately absent — GitHub does not permit it on a job
that calls a reusable workflow (actionlint rejects it). The reusable sets its
own timeouts of 2, 5 and 5 minutes on its three jobs.

[Copilot]

Pull request overview

Refactors the repository’s tag-push release automation to delegate to the organization’s shared reusable release workflow, reducing duplicated workflow logic and adopting the shared release-gating defaults.

Changes:

• Removed the “fat” .github/workflows/tag-push.yaml workflow that validated tags and promoted draft releases locally.
• Added .github/workflows/release.yaml as a thin caller that invokes lfreleng-actions/generic-workflows/.github/workflows/release.yaml on tag pushes, retaining local concurrency behavior and skipping tag-deletion events.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/tag-push.yaml	Deletes the local validate+promote job graph that is being replaced by a reusable workflow call.
.github/workflows/release.yaml	Adds a thin reusable-workflow caller to handle tag-push releases with shared org defaults and preserved concurrency behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[tykeal]

🤖 Dependamerge
Approved this pull request ✅