[vladimir-arsov]

Summary

Replaces the two-run FE 2.0 release (branch push → fe-tag.yml pushes a tag → tag push → fe-release.yml publishes) with one run per push to release/* or manual dispatch:

guard → install-deps → build ∥ e2e → release (tag + publish, one job) → GitHub release

Ticket: PFM-ISSUE-34283

Changes

• .github/workflows/fe-release-flow.yml (new reusable workflow)
  • inputs FORCE and RUN_E2E
  • a guard job that fails a dispatch on any ref other than the default branch or release/*
  • a release job that tags and publishes
  • a github-release job that uses GITHUB_TOKEN, sets the notes range from the previous tag of the line, and marks "Latest" only on the highest version/* tag
• Artifacts tool gets a RELEASE_FLOW mode. It computes the next version, then checks for affected projects since the previous tag of the line (skipped when FORCE is set or for X.Y.1). It then pushes the tag and publishes all projects at that version.
  • Outputs: released, tag, previous_tag and is_latest, exposed through the composite action.
  • A forced dispatch on the default branch publishes a snapshot of all projects.
  • The [branch-off] guard still runs first.
• run-many turns an empty or undefined ref into '', so GHA_REF: '' selects all projects again. This was the original intent: pushes to main and release branches build all projects, PRs build only the affected ones.
• fe-install-deps.yml loses its job-level cancel-in-progress concurrency. The new caller has its own run-level, non-cancelling concurrency instead.
• Caller template fe-release.yml is replaced: push to release/*, plus workflow_dispatch with force, plus secrets: inherit. The fe-tag-pushed.yml template is deleted.
• README gets an "FE Release Flow" section: migration (including the double-publish warning), triggers and force, secrets, recovery, concurrency.

Behavior notes

• Every push runs the flow, upmerges included, as in the backend repos. Only [branch-off] commits are never tagged or published.
• Recovery after a failed publish is a forced dispatch. A re-run finds nothing affected since the tag it already pushed.
• Re-running a successful forced dispatch cuts another patch. The README warns about this.

Not in scope

• A version/* tag ruleset, a tag-triggered recovery path, and skip-if-exists or resumable publish.
• Pushing the tag with GITHUB_TOKEN (34282), immutable releases (34284), retiring GIT_USER* (34286).
• Changes to fe-tag.yml / workflows/fe-release.yml. Unmigrated callers keep the old flow.
• Migrating consumer repos (pilot PFM-ISSUE-34287).
• Master only: release lines 25.4–26.4 don't get the new workflow. The first line with it is the next branch-off.

Verification

• jest: new affected-projects, artifacts-handler-release-flow (including [branch-off] over force) and utils tests pass. The only failures are the 5 known Windows path-separator tests, which also fail on master.
• tsc --noEmit is clean.
• actionlint is clean on the new and changed workflows and the caller template. A copy with the reusable refs rewritten to local paths is also clean, which checks the nested inputs and secrets.
• Live validation is still pending and will be done manually on a throwaway release/99.x line (see plan.md, "Manual Testing Steps").

🤖 Generated with Claude Code

[Benno42]

Great! Clear flow, and the tests pass locally. Live validation is still open. maybe we can test it before merging.

[Benno42]

❓After a failed publish, "Re-run failed jobs" finds nothing affected and ends green without publishing, but design.md and plan.md promise a release. Is this intended, or should the run fail when the latest tag has no published artifact? 🤖

[vladimir-arsov]

Good catch, confirmed: with the previous tag as base, the dangling tag became the base and the re-run found nothing. Fixed by switching to publish before tag:

• the tool writes the version to $RUNNER_TEMP before publishing, publishes all projects, then pushes the tag
• a new cleanup step in the release job (failure() || cancelled()) unpublishes that version via the existing ONLY_DELETE_ARTIFACTS + TAG mode, unless the tag is already on the remote
• the constructor-ordering bug is fixed so TAG on a release/* branch keeps its own version (needed for the cleanup)

Result: a version/* tag always means a complete release, and "Re-run failed jobs" (or the next push) releases the same version. design.md, plan.md and the README are updated accordingly.

[Benno42]

LGTM