Require explicit release publication opt-in

[hawkff]

Summary

• make release publication an explicit typed workflow input
• keep release creation disabled by default
• add a repository guard for workflow defaults and gates

Validation

• Namespace CI run 29211339854 passed
• CodeRabbit CLI reported no findings

Greptile Summary

This PR makes release publication an explicit opt-in workflow action. The main changes are:

• A boolean publish input with default: false in the release workflow.
• A positive publish-job gate using inputs.publish.
• A CI guard that checks the release workflow keeps the safe publish gate.

Confidence Score: 4/5

This is close, but I would fix the remaining guard behavior before merging.

• The release workflow now defaults publication off.
• The publish job only runs when the boolean input is explicitly enabled.
• The new guard can still block safe equivalent publish conditions.

scripts/check-release-publish-gate.sh

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Adds a default-disabled boolean publish input and gates release publication on that input.
.github/workflows/ci.yml	Adds the release publication guard to the CI guard job.
scripts/check-release-publish-gate.sh	Adds checks for the release publish input, publish job gate, and related permissions.

_{Reviews (3): Last reviewed commit: "fix(ci): require explicit release public..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 15 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e493dc4b-0138-433c-9b53-6170fb70bb0f

📥 Commits

Reviewing files that changed from the base of the PR and between ff4269f and 6b447e9.

📒 Files selected for processing (3)

• .github/workflows/ci.yml
• .github/workflows/release.yml
• scripts/check-release-publish-gate.sh

---

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Condition check remains exact

This guard still requires one exact spelling of the publish condition. A workflow with the same boolean input defaulting to false and an equivalent positive gate such as if: ${{ inputs.publish }} remains explicitly opt-in, but this regex rejects it and blocks CI. The guard should check the publish job's safety property instead of requiring this single expression form.

[hawkff]

No change. The guard intentionally requires the explicit typed comparison from the release policy: inputs.publish == true. Shorthand truthiness is excluded so future edits cannot weaken the positive boolean opt-in. Field order and unrelated job settings remain flexible.

[hawkff]

Latest commit passed Namespace CI run 29212802158, including the release-gate self-test.