[agent-suggestions] Release integrity verifier workflow

[github-actions]

Agent Suggestions

Proposed workflow name: Release Integrity Verifier

Trigger: release: published (or a completed Internal: Release workflow run), plus workflow_dispatch for replay.

Purpose/scope: Detection-only post-release verification that the immutable semver tag, GitHub release, and floating major tag all resolve to the same intended commit; the release has generated notes; and the published reusable workflow lock files are present. This protects downstream users who follow the documented @v0 installation path.

Proposed safe outputs: Create one deduplicated issue per release/version containing the mismatched refs and exact remediation commands; optionally add a concise comment to the GitHub release. Never mutate tags or open a fix PR.

Evidence:

• release.yml triggers on semver tags and force-updates the floating major tag, then performs the mutation without a verification step (lines 82–99).
• Existing issue #1255 documents the high-impact risk around release tag mutation and downstream consumers.
• Release docs recommend floating major tags for users (RELEASE.md).

Why not covered already: release-update checks upstream releases and updates pinned SHAs in consumer repositories (README); upgrade-check assesses gh-aw compiler upgrades; workflow-patrol checks structural source drift. None verifies the post-release integrity of this repository’s semver/major tags and release artifacts. This complements, rather than duplicates, #1255 by detecting the bad state after publication.

Duplicate Checks

• Reviewed the current workflow catalog and source/docs inventory.
• Reviewed prior [agent-suggestions] reports, including #1238, #1363, #1198, and #1094; none proposes release-integrity verification.
• Reviewed recent open issues/PRs, including #1255, #1526, and #1533; no existing workflow implements this post-release check.

Suggested Next Step

• Add the reusable workflow, consumer example, and dogfood trigger; run it against the next semver release and a manual replay.

---

What is this? | From workflow: Trigger Agent Suggestions

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

• expires on Jul 20, 2026, 1:06 PM UTC

[github-actions]

This issue was automatically closed because it expired on 2026-07-20T13:06:14.395Z.

Closed by Workflow