fix(release): validate candidate workflows and next push checks

Author: hack-cli-tests

.ai/skills/hack-repo-verify/SKILL.md

@@ -37,6 +37,10 @@ For native setup use root `mise.toml`, the Bun pin in `package.json`, and
 `bun run test:local`. Add `--all-features` to equivalent Cargo commands for feature
 changes; the toolchain Rust tasks already enable all features. Keep default coverage.
 
+For release workflow edits, run the pinned syntax/context check also enforced by CI:
+`mise x actionlint@1.7.12 -- actionlint -shellcheck= -pyflakes= .github/workflows/ci.yml .github/workflows/release.yml .github/workflows/prerelease.yml`.
+This validates event globs and reusable workflow contexts; Bun YAML parsing alone does not.
+
 `bun run privacy:check` scans Git-tracked files. Stage reviewed new source/tests
 before the final gate, or rerun it after staging: an earlier pass does not cover
 untracked candidate additions. Keep private artifacts excluded from the index.

.github/actionlint.yaml

@@ -0,0 +1,5 @@
+# Blacksmith runner labels used by this repository's CI and release workflows.
+self-hosted-runner:
+  labels:
+    - blacksmith-4vcpu-ubuntu-2404
+    - blacksmith-6vcpu-macos-15

.github/workflows/ci.yml

@@ -2,6 +2,9 @@ name: CI
 
 on:
   push:
+    branches:
+      - main
+      - next
     tags-ignore:
       - "v*"
   pull_request:
@@ -32,6 +35,8 @@ jobs:
           install: false
           cache: false
           env: false
+      - name: Validate release workflow syntax
+        run: mise x actionlint@1.7.12 -- actionlint -shellcheck= -pyflakes= .github/workflows/ci.yml .github/workflows/release.yml .github/workflows/prerelease.yml
       - name: Fetch pinned model checker
         run: curl --fail --location --retry 2 --max-time 60 https://github.com/tlaplus/tlaplus/releases/download/v1.7.4/tla2tools.jar --output "$RUNNER_TEMP/tla2tools.jar"
       - name: Check evidence validation and models

.github/workflows/prerelease.yml

@@ -63,10 +63,11 @@ jobs:
     timeout-minutes: 60
     permissions:
       contents: read
-    env:
-      HACK_PRERELEASE_BUNDLE: ${{ runner.temp }}/native-candidate
-      HACK_PRERELEASE_OUTPUT: ${{ runner.temp }}/prerelease-assets
     steps:
+      - name: Select isolated build directories
+        run: |
+          printf 'HACK_PRERELEASE_BUNDLE=%s/native-candidate\n' "$RUNNER_TEMP" >> "$GITHUB_ENV"
+          printf 'HACK_PRERELEASE_OUTPUT=%s/prerelease-assets\n' "$RUNNER_TEMP" >> "$GITHUB_ENV"
       - uses: actions/checkout@v4
         with:
           ref: ${{ needs.plan.outputs.source_revision }}
@@ -111,9 +112,10 @@ jobs:
       statuses: read
       deployments: read
     env:
-      HACK_PRERELEASE_OUTPUT: ${{ runner.temp }}/prerelease-assets
       GH_TOKEN: ${{ github.token }}
     steps:
+      - name: Select isolated publication directory
+        run: printf 'HACK_PRERELEASE_OUTPUT=%s/prerelease-assets\n' "$RUNNER_TEMP" >> "$GITHUB_ENV"
       - uses: actions/checkout@v4
         with:
           ref: ${{ needs.plan.outputs.source_revision }}

.github/workflows/release.yml

@@ -27,7 +27,7 @@ on:
     tags:
       - "v*"
       - "!v*-*"
-      - "!v*+*"
+      - '!v*\+*'
 
 permissions:
   contents: read

tests/prerelease-plan.test.ts

@@ -543,7 +543,7 @@ test("registered Release routes explicit prerelease to the same-commit reusable
   expect(release.on.workflow_dispatch.inputs.publish_prerelease?.default).toBe(
     false
   );
-  expect(release.on.push.tags).toEqual(["v*", "!v*-*", "!v*+*"]);
+  expect(release.on.push.tags).toEqual(["v*", "!v*-*", "!v*\\+*"]);
   expect(release.jobs.prerelease?.uses).toBe(
     "./.github/workflows/prerelease.yml"
   );
@@ -586,6 +586,24 @@ test("registered Release routes explicit prerelease to the same-commit reusable
   expect(JSON.stringify(prerelease)).not.toContain("RELEASE_PAT");
 });
 
+test("CI admits next branch pushes while excluding release tags", async () => {
+  const ci = Bun.YAML.parse(
+    await Bun.file(".github/workflows/ci.yml").text()
+  ) as {
+    on: { push: { branches?: string[]; "tags-ignore": string[] } };
+  };
+  expect(
+    (ci.on.push.branches ?? []).some((pattern) =>
+      new Bun.Glob(pattern).match("next")
+    )
+  ).toBe(true);
+  expect(
+    ci.on.push["tags-ignore"].some((pattern) =>
+      new Bun.Glob(pattern).match("v5.0.0-next.1")
+    )
+  ).toBe(true);
+});
+
 test("compiled CLI reports the embedded candidate version and ordinary source retains package version", async () => {
   const root = await mkdtemp(join(tmpdir(), "hack-prerelease-cli-"));
   try {