[steve-calvert-glean]

Releasing takes several manual steps today, and two of them fail quietly:

• release-it has to push the release commit to main, which the ruleset blocks unless the person releasing can bypass it.
• Without GITHUB_TOKEN, release-it opens a release form in the browser and reports success. No release exists until someone submits the form, so publishing never starts. That happened with 3.6.0.
• Each sync PR in the three output repos needs a hand approval and merge before users get the release.

Changes

• New Release workflow (release.yml). A maintainer runs it from the Actions tab on main, with a dry-run switch that defaults to on and an optional version increment. It runs release-it as the pluginpack-sync app. The app can bypass the main ruleset, and a release the app creates triggers publish.yml. A release created with the workflow's own token wouldn't.
• publish.yml merges the sync PRs. After each sync, it squash-merges the PR it opened. The PR is built from a validated release tag.
• publish.yml runs sync mode only on a release tag. Dispatching sync from a branch fails, so unreleased code can't reach the output repos. Check mode still runs on any ref and is now the dispatch default.
• release-it stops without GITHUB_TOKEN. A before:init hook fails the release before anything changes. Dry runs skip hooks, so they still work without a token.
• RELEASE.md describes the workflow, and keeps local release as a fallback.

Before merging

These are settings changes:

• Install pluginpack-sync on this repo with contents write access, if it isn't already.
• Add pluginpack-sync to the main ruleset's bypass list.
• Let pluginpack-sync bypass required pull request reviews on main in claude-plugins, cursor-plugins, and codex-plugins.

After the first release through the workflow, remove the team bypass that was added to the main ruleset for manual releases.

Testing

• actionlint passes on all three workflows. It reports client-id as unknown for create-github-app-token@v3, but its bundled action metadata is out of date. publish.yml already uses client-id, and the 3.6.0 publish run minted tokens with it.

• Practice runs of release-it in a throwaway clone:

  Run	Result
  Release, no GITHUB_TOKEN	Stops at the hook. No commit
  Dry run, no GITHUB_TOKEN	Runs. Shows 3.6.1
  Release, GITHUB_TOKEN set (no push, tag, or GitHub Release)	Commits, including the plugin changelogs

These parts can't run until this merges, because GitHub only offers workflow_dispatch for workflows on the default branch: the workflow itself, and the app's merge of the sync PRs. The first run should be a dry run, followed by the next real release.