ci: update DSP on releases

[cole-h]

Motivation

Context

Summary by CodeRabbit

• Chores
  • Improved the release workflow to refresh package metadata earlier in the process, helping keep proposed releases more up to date.
  • The release note generation and versioning steps still run as part of the same automated flow.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e691b35c-d790-4628-a0b5-e98adb2d6cb0

📥 Commits

Reviewing files that changed from the base of the PR and between 3888c31 and 4a6a3ae.

📒 Files selected for processing (1)

• .github/workflows/propose-release.yml

---

📝 Walkthrough

Walkthrough

The release proposal workflow now updates the ./packaging/secure-packages Nix flake and commits the lockfile before writing .version-determinate and generating release notes.

Changes

Release workflow update

Layer / File(s)	Summary
Secure packages flake update .github/workflows/propose-release.yml	Adds an early nix flake update --commit-lock-file --flake ./packaging/secure-packages step before .version-determinate is written and release notes are generated.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

A bunny hopped at release time bright,
Flake locks clicked snug in the moonlit light.
Then version notes sprang forth in line,
All neat and tidy, just in time.
🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is related to the release CI workflow change, though it uses an acronym and does not describe the exact action taken.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch update-dsp-on-releases

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🚀 Deployed on https://6a3ed6bbefb8ff837d5be1d9--determinate-nix.netlify.app