fix(ci): validate release branch updates

Author: morluto

.github/workflows/ci.yml

@@ -8,6 +8,7 @@ on:
     types: [opened, synchronize, reopened, edited, labeled, unlabeled]
   merge_group:
     types: [checks_requested]
+  workflow_dispatch:
 
 concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}

.github/workflows/release-please.yml

@@ -83,6 +83,15 @@ jobs:
           git add uv.lock
           git commit -m "chore(release): synchronize uv lock"
           git push origin "HEAD:$RELEASE_BRANCH"
+      - name: Dispatch release candidate CI
+        if: steps.validated-head.outputs.current == 'true' && steps.release.outputs.prs_created == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_BRANCH: release-please--branches--main--components--jacobian
+        run: >-
+          gh workflow run ci.yml
+          --repo "$GITHUB_REPOSITORY"
+          --ref "$RELEASE_BRANCH"
       - name: Dispatch release publishing
         if: steps.release.outputs.release_created == 'true'
         env:

tests/unit/tooling/test_release_workflow.py

@@ -6,6 +6,8 @@
 RELEASE_PLEASE_CONFIG = ROOT / "release-please-config.json"
 SERVER_METADATA = ROOT / "server.json"
 WORKFLOW = ROOT / ".github" / "workflows" / "release.yml"
+RELEASE_PLEASE_WORKFLOW = ROOT / ".github" / "workflows" / "release-please.yml"
+CI_WORKFLOW = ROOT / ".github" / "workflows" / "ci.yml"
 
 
 def test_release_build_resolves_and_verifies_one_immutable_sha() -> None:
@@ -24,6 +26,24 @@ def test_release_build_resolves_and_verifies_one_immutable_sha() -> None:
     )
 
 
+def test_release_candidate_dispatches_full_ci_after_lockfile_sync() -> None:
+    release_please = RELEASE_PLEASE_WORKFLOW.read_text(encoding="utf-8")
+    ci = CI_WORKFLOW.read_text(encoding="utf-8")
+
+    ci_triggers = ci.split("on:", 1)[1].split("concurrency:", 1)[0]
+    assert "workflow_dispatch:" in ci_triggers
+    assert "plan_output=$(.github/scripts/classify-ci-paths --force-exhaustive)" in ci
+
+    lockfile_sync = release_please.index("name: Synchronize release lockfile")
+    candidate_dispatch = release_please.index("name: Dispatch release candidate CI")
+    assert lockfile_sync < candidate_dispatch
+
+    dispatch = release_please[candidate_dispatch:]
+    assert "steps.release.outputs.prs_created == 'true'" in dispatch
+    assert "gh workflow run ci.yml" in dispatch
+    assert '--ref "$RELEASE_BRANCH"' in dispatch
+
+
 def test_mcp_publisher_is_verified_before_oidc_or_publication() -> None:
     source = WORKFLOW.read_text(encoding="utf-8")
     publisher = source[source.index("publish-mcp:") :]