[flyq]

Summary

The shared release actions at @main moved the release pipeline to the release App mega-gutenberg (megaeth-labs/.github#55, #56, #57).
That broke this repo's callers: the v2.1.0 candidate dispatch failed with bump_command needs a separate dependency_token, so the command never runs with the release token.
Even with that fixed, the old cut job (triggered on PR close, filtered on mega-maxwell[bot], no commit input) and the direct settle mode no longer exist upstream, so no release branch would ever be cut.
This PR re-renders the release workflows from the shared templates.

• release-candidate.yml / release-settle.yml: rendered from workflow-templates/ with Cargo.toml and the toml pattern.
  propose keeps the Rust toolchain and passes the read-only job token as dependency_token, since every Git dependency is public.
  cut now runs on the push of the merged candidate PR, through release-route.
  Settle opens a chore/release-settle-vX.Y.Z PR on the release-v* push and publishes when it merges, or on a versioned dispatch that goes through the release environment.
• release-publish.yml: removed; release-settle's publish job replaces it.
• app-token-lint.yml: added from the shared template.
• claude.yml: the Maxwell review token now lists its permissions (lint rule L6), the same way mega-reth does.
• on-release.yml, .github/ci-credentials.md, CHANGELOG.md header: updated to describe the new flow.
  on-release.yml stays on the publish environment, so GCP_AUTH_KEY does not have to move.

Repository / org settings this relies on

• MEGA_GUTENBERG_CLIENT_ID (org variable) and MEGA_GUTENBERG_PK (org secret) are available to this repository, and the mega-gutenberg App is installed on it.
• The release environment keeps a required reviewer, and its deployment policy allows main, release-v* and v* tags (today it allows only the default branch).
• mega-gutenberg is a bypass actor on the v* tag ruleset; the release-* branch ruleset has no App bypass.

Release flow after this merges

1. Dispatch Release Candidate with version; gutenberg opens chore/release-candidate-X.Y.Z.
2. Merge it; the push routes to cut, which creates release-vX.Y.Z at the merge commit.
3. The branch push opens the settle PR; merging it tags and publishes the Release, and on-release.yml attaches the binaries.

🤖 Generated with Claude Code

[vincent-k2026]

Blocking on one line group: the claude.yml change breaks the bot review for every PR in this repo once it merges. The release re-render itself looks right.

claude.yml now asks the Maxwell App token for explicit permissions:

permission-contents: read
permission-pull-requests: write
permission-issues: write

This PR's own pr-review job (Claude Code workflow, run 40701106814) fails while minting that token: The permissions requested are not granted to this installation. The same workflow on main, which does not list permissions, mints fine. liquan/chore/apache-license passed pr-review after this run. So the Maxwell installation on this repo lacks at least one of those grants, most likely issues: write. Once this merges, pr-review on every stateless-validator PR fails the same way. mega-reth's pr-review is currently red across PRs and develop with this same error, so "the same way mega-reth does" is copying a broken state.

Fix either way:

• drop those three lines from this PR and do the L6 lint follow-up after the installation grants match; or
• grant the Maxwell installation the listed permissions first, then confirm pr-review goes green on this PR before merging.

The rest reads correctly. Release writes move to mega-gutenberg with repo-scoped, explicitly listed permissions. Every checkout has persist-credentials: false. cut and publish are decided by the read-only release-route on push instead of PR-author filters. Publish stays behind the release environment. The deleted release-publish.yml is covered by the settle workflow's publish job.

Two org settings this depends on must be true before the first release, or the v2.1.0 run fails again: the gutenberg variable, secret and installation on this repo, and the release environment's deployment policy widened to release-v* branches and v* tags. Please confirm both in the PR before merging.

Non-blocking: write-scoped release tokens are handed to megaeth-labs/.github/.github/actions/*@main. That matches the existing workflows, but pinning those actions to a commit SHA would stop a change on .github main from running with release write access here.

[flyq]

#238 来处理