From c52bbaa1522b112f37496533f7579ed96dd56290 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= <gaborjbernat@gmail.com>
Date: Fri, 6 Nov 2026 08:25:26 -0800
Subject: [PATCH] =?UTF-8?q?=F0=9F=91=B7=20ci:=20dry-run=20the=20release=20?=
 =?UTF-8?q?in=20the=20PR=20gate?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Release preparation installs prek hooks under the seven-day cooldown,
links fragments and builds the changelog; no pull request check did, so
a change could merge green and fail the next release (simplint#55).

The gate now calls the prepare workflow with dry-run, which assembles the
release and skips the push.
---
 .github/workflows/check.yaml           | 10 +++++++++-
 .github/workflows/prepare-release.yaml | 13 ++++++++++---
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml
index 77bf568..27f771d 100644
--- a/.github/workflows/check.yaml
+++ b/.github/workflows/check.yaml
@@ -60,10 +60,18 @@ jobs:
         uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
       - name: 🧪 Run tests with coverage
         run: ./gradlew test koverVerify
+  release:
+    name: "🏷️ Release dry run"
+    uses: $/.github/workflows/prepare-release.yaml
+    permissions:
+      contents: read
+      pull-requests: read
+    with:
+      dry-run: true
   gate:
     name: "🚦 ${{ github.event_name == 'pull_request' && 'Required checks pass' || 'Non-PR checks pass' }}"
     if: ${{ !cancelled() }}
-    needs: [plugin, lint, test]
+    needs: [plugin, lint, test, release]
     runs-on: ubuntu-26.04
     permissions: {}
     steps:
diff --git a/.github/workflows/prepare-release.yaml b/.github/workflows/prepare-release.yaml
index a8ee2e2..3ed5961 100644
--- a/.github/workflows/prepare-release.yaml
+++ b/.github/workflows/prepare-release.yaml
@@ -8,19 +8,26 @@ on:
         type: choice
         options: [auto, major, minor, patch]
         default: auto
+  workflow_call:
+    inputs:
+      dry-run:
+        description: Assemble the release without pushing, for the pull request gate
+        type: boolean
+        required: true
 permissions: {}
 concurrency:
-  group: prepare-release
+  group: prepare-release${{ inputs.dry-run && format('-dry-run-{0}', github.ref) || '' }}
   cancel-in-progress: false
 jobs:
   prepare:
     name: 🏷️ Prepare Towncrier release
-    uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@2c1f5e4ceda37c41eb8367b5cbeaa741aa60a566 # 6.5.2
+    uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@2a3b863f4563ce9891d2cee1ed381b6f82654836 # 6.6.0
     permissions:
       contents: read
       pull-requests: read
     with:
-      bump: ${{ inputs.bump }}
+      bump: ${{ inputs.bump || 'auto' }}
+      dry-run: ${{ inputs.dry-run == true }}
       tag-prefix: v
       annotated: true
     secrets: