[Sun-sunshine06]

Release manifest synchronization pushes a [skip ci] commit to protected main, then silently succeeds when the fallback PR cannot be created. Intel verification targets the retired macos-13 runner and does not gate publishing.

• Generate a dedicated manifest PR without skipping CI or pushing main. Use a lease when refreshing its branch, reuse an open PR, and fail on credential, PR creation, or auto-merge errors.
• Require RELEASE_BOT_TOKEN instead of GITHUB_TOKEN so PR events trigger required checks. Document minimum permissions and recovery of existing skipped-CI PRs.
• Move native Intel packaging to macos-15-intel, verify runner architecture, run it on related PRs, and reuse it as a publication gate. Suppress the additional DMG artifact during release calls.
• Add local-Git integration tests with mocked gh calls to CI, covering no-op, missing credentials, creation, reruns and denied PR creation.

Validation: actionlint 1.7.12 on all three changed workflows; bash syntax; local and CI manifest integration tests; git diff --check. Cloud CI (lint/typecheck/tests/Electron build), Linux packaging smoke, CodeQL, Dependency Review and automated PR review passed for 79dc6ab. Native Intel validation also passed on attempt 2 (3m37s): https://github.com/OpenCoworkAI/open-codesign/actions/runs/41869077136/job/126721621301 . Verified x86_64 runner architecture, x64 DMG packaging, packaged app architecture, native application smoke test, and artifact upload. Attempt 1 failed because no hosted runner acquired the job; it executed no steps. Rerunning the failed job passed without code changes. All 8 current PR checks pass for 79dc6ab.

Maintainer setup: configure repository secret RELEASE_BOT_TOKEN using a repository-scoped fine-grained PAT with Contents and Pull requests read/write, with organization approval if required. Keep required checks and auto-merge enabled; no protection bypass is needed. No settings or secrets were changed. Actual release publication and token-backed manifest PR creation are not exercised by this PR.

Leaves #541 and #534 untouched.

[github-actions]

Findings

• [Minor] The generated manifest PR can end up green-but-never-merged if any path-filtered workflow is a required check — .github/scripts/sync-release-manifests.sh:40 runs gh pr merge --auto --squash and then exits 0 with ::notice::… awaiting required checks and merge. The manifest PR only touches packaging/**, but .github/workflows/release-macos-x64-native-check.yml:7-14 and .github/workflows/packaging-smoke.yml are both restricted by paths filters that exclude packaging/**. Under branch protection that requires those job names, the check stays pending forever, auto-merge never fires, the job still reports success, and the in-repo manifests silently stay stale — the exact failure mode this PR is fixing. I cannot read branch protection from the public checkout, so this is conditional on the required-check list.
  Suggested fix: before relying on auto-merge, confirm the required-check list only contains jobs that run on every PR (ci.yml check), or add an always-running companion job that reports the same check name for path-filtered PRs.

• [Nit] The artifact suppression keys off github.workflow inside a called workflow — .github/workflows/release-macos-x64-native-check.yml:118 uses if: github.workflow == 'Release macOS x64 native check' || inputs.upload-artifact. Because the github context in a workflow_call invocation is associated with the caller, this comparison is non-obvious and would silently invert if that association ever changes, which would attach a second native-check-macos-x64 DMG artifact to a release run.
  Suggested fix: key off the event directly, e.g. if: github.event_name != 'workflow_call' || inputs.upload-artifact.

• [Nit] A non-stable tag fails the release run after artifacts are published — .github/scripts/sync-release-manifests.sh:7-10 hard-errors on anything other than vX.Y.Z, while .github/workflows/release.yml still triggers on v*.*.*, so a tag like v0.3.0-rc.1 publishes installers and then turns bump-manifests red with no actionable recovery.
  Suggested fix: emit ::notice::Skipping manifest sync for non-stable tag and exit 0 for pre-release tags (or narrow the release tag pattern), keeping the hard failure for malformed stable tags.

• [Nit] The PR number is re-queried instead of read from gh pr create — .github/scripts/sync-release-manifests.sh:34 re-lists after creation and .github/scripts/sync-release-manifests.sh:36-39 fails the job when the list call misses, which leaves an already-created PR orphaned and fails a release that actually succeeded in opening it.
  Suggested fix: capture the created PR number from the command output (gh pr create prints the URL), e.g. pr_number="$(gh pr create … | grep -oE '[0-9]+$')", and keep the list call only for the reuse-existing-PR branch.

Questions

• Does the current branch protection required-check list include Linux packaging smoke or Native Intel packaging check? If yes, the first finding is effectively blocking for the manifest PR and needs the companion aggregator job.

Summary

• Review mode: initial
• No blockers. The core direction is right: dropping the direct main push and the [skip ci] marker, requiring RELEASE_BOT_TOKEN with an explicit credential failure (.github/workflows/release.yml:495-505), and gating publish on native-intel (.github/workflows/release.yml:433) all address the reported defects, and the new local-git integration test genuinely exercises no-op, missing-credential, create, rerun, and denied-create paths.
• The PR makes no closure claims — it explicitly says #541 and #534 are untouched — so there is no linked-issue acceptance criteria to validate.
• Residual risk I could not verify from the public checkout: macos-15-intel runner availability/queue time for the new publication gate (author reports actionlint 1.7.12 only, which does not prove the label is served). If that runner is unavailable, publish now blocks rather than degrades.
• Pre-existing drift this PR does not backfill: packaging/homebrew/Casks/open-codesign.rb:2 is still at 0.2.2 while the live OpenCoworkAI/homebrew-tap cask is at 0.3.0, and packaging/scoop/bucket/open-codesign.json is at 0.2.2 against a 0.2.0 live bucket. After merge, run the sync once for the current release (workflow_dispatch of release.yml for the last stable tag, or ./packaging/update-shas.sh <version>) so the first automated PR is not a large backfill.
• Removing the [skip ci] marker also means the manifest PR is correctly subject to required CI; nothing here loosens protection or introduces a bypass.

Testing

• Added: .github/scripts/sync-release-manifests.test.sh, wired into .github/workflows/ci.yml:25-26; runs on every PR without network or credentials.
• Gaps worth a small follow-up: a mock case for gh pr merge failing (auto-merge disabled) and for git push --force-with-lease rejecting a concurrent writer, since both now fail the release job — the body claims those paths fail loudly but only nullsoft-create denial is asserted.
• Not run (automation).

Open-CoDesign Bot