[billfreeman44]

Fleet sweep from the plan in igl-gotv docs/plans/workflow_hardening_sweep.md, which carries the evidence for each change.

What changed here:

• publish.yml: publish step name now names the package (1)
• publish.yml: added run-name
• publish.yml: added timeout-minutes to 1 job(s)
• version.yml: dispatch input moved out of the shell line
• version.yml: added run-name

CHANGELOG updated.

Warning

version.yml, promote.yml, publish.yml and redeploy.yml are tag- or dispatch-triggered, so PR CI never exercises them. A green check here does not cover them - they were validated by parsing the YAML.

[Copilot]

Pull request overview

This PR hardens release-related GitHub Actions workflows by improving run readability and reducing the chance of “wrong value in shell line” issues during version cutting and publishing.

Changes:

• Add human-readable run-name titles for dispatch/tag workflows.
• Pass the version input via env (instead of interpolating directly into the run: line) for the version-cut workflow.
• Add/adjust workflow job timeouts and make publish step naming more descriptive.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
CHANGELOG.md	Documents workflow-hardening changes (currently overstates concurrency behavior).
.github/workflows/version.yml	Adds run-name and switches npm version to use an env var for the version string.
.github/workflows/publish.yml	Adds run-name, adds a timeout for the docs job, and updates publish step naming.

Suppressed comments (1)

.github/workflows/version.yml:48

• The VERSION env var is constructed by concatenating inputs.version and client_payload.version. If both are present, npm version will be invoked with a concatenated (invalid) version. Prefer coalescing to ensure exactly one source is used.

          VERSION: ${{ github.event.inputs.version }}${{ github.event.client_payload.version }}

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[billfreeman44]

Acted on the review:

• reverted the publish.yml step-name rename
• corrected the CHANGELOG bullet

Not taken, with reasons:

• Use || instead of concatenating inputs.* and client_payload.*. Raised on most of these PRs. The concatenation is the fleet's established idiom - it appears in roughly 200 places across every repo, and it works because exactly one of the two is ever populated: workflow_dispatch fills inputs, repository_dispatch fills client_payload. Switching a handful of files to || would leave the fleet reading two ways at once, which is the drift this sweep exists to reduce. Worth doing as its own consistency pass over all of them, not piecemeal here.
• Make the version input required: true. A fair point, and out of scope: it changes who can start a release, not how safely it runs. Recorded as a follow-up rather than folded in silently.