Harden Marketplace release workflow

[fqjony]

Summary

• add release-tag verification and GitHub Actions workflow linting
• add a public semver, Marketplace, and caller-promotion guide with changelog
• enforce ShellCheck error-level checks and cover lifecycle-root discovery

Validation

• make test (37 passing checks)
• rabbit.ci context refresh

Release impact

• no action tag or caller reference changes in this pull request

[Copilot]

Pull request overview

This pull request hardens the project’s release and CI process by adding release verification, workflow linting, stricter shell validation, and clearer release documentation for Marketplace publishing and caller promotion.

Changes:

• Add a release-published workflow to validate semantic tags and run the action’s contract tests from the published tag.
• Expand CI and local validation with workflow linting (actionlint), stricter ShellCheck checks, and additional lifecycle-discovery coverage.
• Add/extend release documentation (README, dedicated release guide, changelog, and agent guidance) and refresh Rabbit CI context.

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/run-merge-tests.sh	Adds a regression scenario ensuring lifecycle discovery reports configured roots only once.
README.md	Adds a Releases section pointing callers to the release guide and changelog.
Makefile	Adds ShellCheck error-level validation and includes the new release workflow in YAML validation.
docs/releasing.md	Introduces a step-by-step release + Marketplace publishing + caller-promotion guide.
CHANGELOG.md	Adds an initial changelog with recent release entries.
bin/lib/lifecycle.sh	Reworks lifecycle membership checks to avoid false matches and duplicates.
AGENTS.md	Documents release expectations and constraints for contributors.
.rabbit/repo.yaml	Rabbit CI context refresh capturing updated workflow triggers/permissions.
.github/workflows/release.yml	Adds “Verify release” workflow to validate tags and run make test from the published release tag.
.github/workflows/ci.yml	Adds concurrency control, workflow lint job, and yq pinning; renames workflow to “CI”.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 10 changed files in this pull request and generated no new comments.

Suppressed comments (3)

tests/run-merge-tests.sh:246

• Because this test script runs with set -e, grep -c/-cx will cause the whole test run to abort when the count is 0 (exit status 1), so you won’t get a clean assertion failure message for “not found” cases. This makes the new lifecycle-discovery assertions behave like hard errors instead of test failures.

I noticed the same pattern earlier in this file (lines 113-114) using grep -c, so it should be fixed consistently across the script.

assert_eq "$(grep -cx 'production' "$detected_lifecycles")" "1" "Production lifecycle is discovered once"
assert_eq "$(grep -cx 'staging' "$detected_lifecycles")" "1" "Staging lifecycle is discovered once"
assert_eq "$(grep -cx 'development' "$detected_lifecycles")" "1" "Development lifecycle is discovered once"

.github/workflows/release.yml:25

• This workflow command includes the raw release tag in the ::error message. Git ref names can contain %, which GitHub Actions workflow commands treat as escape sequences; unescaped % can lead to corrupted annotations/log output.

Consider sanitizing % (and other workflow-command escapes) before echoing it into a workflow command.

          if [[ ! "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error title=Invalid release tag::Expected a semantic patch tag such as v1.0.3, got $RELEASE_TAG."
            exit 1
          fi

.github/workflows/ci.yml:51

• The workflow lint job runs rhysd/actionlint:1.7.12 by Docker tag. Container tags can be retargeted, which can make CI non-reproducible and (in the worst case) introduce a supply-chain risk.

Consider pinning the image by digest (or otherwise verifying what’s being executed) to make the workflow lint check deterministic.

      - name: Run actionlint
        shell: bash
        run: docker run --rm -v "$PWD:/repo" -w /repo rhysd/actionlint:1.7.12 -color