ci(weekly-release): a PR touching the release tooling runs the dry run against main (read-only); the cut job checks out the dispatched ref

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

.github/workflows/weekly-release.yml

@@ -3,9 +3,12 @@ name: Weekly release
 # Release, and fast-forwards refs/heads/stable to it (docs/releases.md). Team
 # installs follow stable, so this is the only thing that moves them. Runs
 # every Monday morning Pacific; run it by hand with a ref for a hotfix, or
-# with dry_run to see the plan and change nothing. The candidate's gate must
-# already be green (free-tests, no red check run, a green Main backstop gate
-# run, no active freeze): this workflow never runs tests or paid evals.
+# with dry_run to see the plan and change nothing. A pull request that touches
+# the release tooling runs the dry run against main with a read-only token,
+# which is the only pre-merge exercise of the real workflow. The candidate's
+# gate must already be green (free-tests, no red check run, a green Main
+# backstop gate run, no active freeze): this workflow never runs tests or
+# paid evals.
 on:
   schedule:
     # Monday 14:00 UTC: 07:00 PDT, 06:00 PST.
@@ -20,10 +23,15 @@ on:
         description: 'Hotfix: release this commit of main instead of the newest green one (full SHA)'
         type: string
         default: ''
+  pull_request:
+    paths:
+      - '.github/workflows/weekly-release.yml'
+      - 'scripts/release-cut.ts'
 
-# One cut at a time; a second dispatch waits for the first.
+# One cut at a time; a second dispatch waits for the first. A pull request's
+# dry run is its own group.
 concurrency:
-  group: weekly-release
+  group: weekly-release-${{ github.event.pull_request.number || 'cut' }}
   cancel-in-progress: false
 
 permissions: {}
@@ -31,6 +39,7 @@ permissions: {}
 jobs:
   cut:
     name: Cut the release
+    if: github.event_name != 'pull_request'
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     permissions:
@@ -40,9 +49,9 @@ jobs:
       actions: read
       checks: read
     steps:
-      # The dispatched ref supplies the tooling (a dry run from a PR branch
-      # exercises that branch's script); the release candidate always comes
-      # from origin/main, which fetch-depth 0 brings along with every branch.
+      # The dispatched ref supplies the tooling; the release candidate always
+      # comes from origin/main, which fetch-depth 0 brings along with every
+      # branch.
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
@@ -71,3 +80,32 @@ jobs:
           [ -n "$RELEASE_REF" ] && args+=(--ref "$RELEASE_REF")
           echo "## Weekly release ($([ "$DRY_RUN" = true ] && echo 'dry run' || echo 'cut'))" >> "$GITHUB_STEP_SUMMARY"
           bun --no-env-file --config=/dev/null --no-install run scripts/release-cut.ts "${args[@]}"
+
+  dry-run:
+    name: Dry run against main
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      actions: read
+      checks: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.4.2
+
+      - name: Plan only
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          git fetch --quiet origin '+refs/heads/stable:refs/remotes/origin/stable' 2>/dev/null || echo "origin has no stable yet"
+          git fetch --quiet --tags origin
+          echo "## Weekly release (dry run from PR #${{ github.event.pull_request.number }})" >> "$GITHUB_STEP_SUMMARY"
+          bun --no-env-file --config=/dev/null --no-install run scripts/release-cut.ts --repo "$GITHUB_REPOSITORY" --summary "$GITHUB_STEP_SUMMARY" --dry-run