Finding
The Release workflow only runs on manual workflow_dispatch — release-please's tag push cannot trigger it (GITHUB_TOKEN recursion guard, noted in the workflow's own WHY comment). Nobody runs the dispatch. Result: v0.2.3 shipped with zero binary assets (source tarball + SBOM only), matching the comment's admission that every release through v0.1.11 shipped none. v0.3.0 nearly repeated it; the dispatch was run by hand after the tag (run 31613428692).
Evidence
gh release view v0.2.3 — no harmonia-{x86_64,aarch64}* binaries attached..github/workflows/release.yml header comment documents the gap as known.- The Release run history shows no tag-triggered runs at all.
Why this matters
The release train produces the attested binaries the release policy promises; without the dispatch step it quietly ships source-only releases, and the gap is invisible unless someone lists assets.
Desired correction
Pick one: (a) a tiny follow-up workflow that dispatches Release when a release-please merge lands on main (title pattern chore(main): release), or (b) run release-please with a PAT/fine-grained token so its tag pushes trigger workflows normally (the aletheia#4201 template), or (c) kanon-side automation: the release-please merge path in pr_merge fires the dispatch after tagging. (a) is the smallest honest fix.
Done when: a release cut needs no manual dispatch for binaries to land.
Finding
The Release workflow only runs on manual
workflow_dispatch— release-please's tag push cannot trigger it (GITHUB_TOKEN recursion guard, noted in the workflow's own WHY comment). Nobody runs the dispatch. Result: v0.2.3 shipped with zero binary assets (source tarball + SBOM only), matching the comment's admission that every release through v0.1.11 shipped none. v0.3.0 nearly repeated it; the dispatch was run by hand after the tag (run 31613428692).Evidence
gh release view v0.2.3— noharmonia-{x86_64,aarch64}*binaries attached..github/workflows/release.ymlheader comment documents the gap as known.Why this matters
The release train produces the attested binaries the release policy promises; without the dispatch step it quietly ships source-only releases, and the gap is invisible unless someone lists assets.
Desired correction
Pick one: (a) a tiny follow-up workflow that dispatches Release when a release-please merge lands on main (title pattern
chore(main): release), or (b) run release-please with a PAT/fine-grained token so its tag pushes trigger workflows normally (the aletheia#4201 template), or (c) kanon-side automation: the release-please merge path inpr_mergefires the dispatch after tagging. (a) is the smallest honest fix.Done when: a release cut needs no manual dispatch for binaries to land.