ci(release): dispatch recompile-safe-output-fixtures after asset upload (#911)

Releases published via release-please use the default GITHUB_TOKEN, which

GitHub Actions actively suppresses from triggering other workflows to

avoid recursive runs. As a result, the recompile-safe-output-fixtures

workflow's release: published trigger has never fired (v0.32.0 and v0.33.0

both went unhandled).

Add a final job at the end of release.yml that explicitly dispatches the

recompile workflow once binaries and checksums are uploaded, using

GH_AW_CI_TRIGGER_TOKEN so the dispatched run can itself open a PR. The

tag is passed explicitly to avoid races against a hypothetical newer

release landing mid-run.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: jamesadevine

.github/workflows/release.yml

@@ -186,3 +186,30 @@ jobs:
         run: |
           TAG="${{ needs.release-please.outputs.tag_name || github.event.inputs.tag_name }}"
           gh release upload "$TAG" checksums.txt --clobber --repo "${{ github.repository }}"
+
+  trigger-recompile-safe-output-fixtures:
+    name: Trigger safe-output fixture recompile
+    needs: [release-please, checksums]
+    # Run only once all release assets (binaries + checksums.txt) are uploaded.
+    # Releases published via release-please use the default GITHUB_TOKEN, which
+    # does NOT fire the `release: published` event on other workflows (GitHub
+    # actively suppresses this to prevent recursive triggers). Dispatch the
+    # recompile workflow explicitly here using a PAT so the dispatched run can
+    # itself open a PR.
+    if: >-
+      always() &&
+      (needs.release-please.outputs.release_created == 'true' || github.event_name == 'workflow_dispatch') &&
+      needs.checksums.result == 'success'
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Dispatch recompile-safe-output-fixtures
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_AW_CI_TRIGGER_TOKEN }}
+        run: |
+          set -euo pipefail
+          TAG="${{ needs.release-please.outputs.tag_name || github.event.inputs.tag_name }}"
+          echo "Dispatching recompile-safe-output-fixtures for $TAG"
+          gh workflow run recompile-safe-output-fixtures.lock.yml \
+            --repo "${{ github.repository }}" \
+            --ref main \
+            -f "version=$TAG"