[RedStar071]

🔗 Linked issue

N/A

🧭 Context

Releases of @wolfstar/plugin-* packages are published with changesets, but nothing tells the community. This posts each release to Discord in the Sapphire announcement format, built from the changelogs, the same way as in stars-components.

The posting logic lives in the org wolfstar-project/.github repository as a reusable workflow (reusable-announce-packages.yml). This PR depends on it being merged there first. GitHub rejects a workflow file that calls a missing reusable workflow, so do not merge this before then.

📚 Description

After changesets/action publishes, a new announce job calls reusable-announce-packages.yml. For each published package it reads the matching CHANGELOG.md section and the PR titles, and posts # @wolfstar/plugin-api@3.1.0 - (date) followed by 💥 / 🚀 / 🐛 / 🏠 / 📦 sections, with links to the commit and the PR. No AI is involved. A failed announcement does not affect the release job, because the packages are already out: the announce job is separate and runs after the publish.

announce.yml is a manual workflow that re-sends or previews an announcement from a name@version list (dry-run defaults to on). The published-packages input takes either that list or the JSON array changesets/action outputs.

Optional signed lifecycle callbacks (X-Release-Signature-256) are off unless both RELEASE_WEBHOOK_URL and RELEASE_WEBHOOK_SECRET are set.

Key changes

• release.yml: the release job exposes published and publishedPackages; new announce job. The old inline step that called a stars-components action is gone.
• announce.yml (new): manual re-send or preview.
• .github/zizmor.yml: wolfstar-project/.github/* may follow main (ref-pin); everything else stays hash-pinned.
• AGENTS.md: documents the flow.
• Empty changeset, since no package changes.

To turn it on, set the secret DISCORD_PACKAGES_WEBHOOK_URL and the variable DISCORD_PACKAGES_ROLE_ID. With no webhook the job only renders the preview in its summary.

Type of Change

• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation change
• Workflow / CI change

Pre-flight Checklist

• I have read the Contributing Guidelines (if applicable)
• My code follows the code style of this project
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• I have updated the documentation accordingly
• I added a changeset with pnpm changeset (or pnpm changeset add --empty if no release is needed). See .changeset/README.md.

No tests here: the workflow has no code of its own, and the action's tests (24) run in the .github repository. oxfmt is clean on the changed files. zizmor reports no finding on them; the one it still reports in pkg-pr-new.yml was already there.

🤖 AI disclosure: Claude Code was used on this PR. Code written with claude-opus-5-5 and claude-sonnet-5-5; PR description written with claude-sonnet-5-5. AI policy.

[RedStar071]

The Security analysis (zizmor) check is red, and it is not caused by this PR.

• What fails: two findings, both in files this PR does not touch: error[cache-poisoning] in pkg-pr-new.yml:31 and warning[ref-version-mismatch] in documentation.yml:20 (the hash pin there says # main, and the branch now points to another commit). Nothing in release.yml, announce.yml or zizmor.yml is reported.
• Why it is not this PR's: the same check is red on main since the fix(deps): update all non-major dependencies (#272) merge (run 42239275748); the run before it was green.
• Fix: none exists yet, and there is no open PR for it. The fix is a separate change: re-pin documentation.yml to the current main of the reusable workflow, and for pkg-pr-new.yml either drop cache: true from the step that publishes or add a documented ignore in .github/zizmor.yml. I left it out to keep this PR to the announce workflows.

This PR stays a draft until the shared workflows are merged in wolfstar-project/.github.

---

Generated by Claude Code

[wolfstar-github-agent]

🤖 REVIEW PAUSED

Wolfstar Agent Kit posted this automated status. AI open source policy.

This pull request is from an outside contributor.

Add the wolfstar-agent-review label to approve automated review and verified repairs.
Approval covers head commit 76878744cce8.

[coldtea-pr-lens]

Note

The title starts with ci:, so PR Lens left this pull request undrawn. Comment @pr-lens draw to draw it

_{github.comment.notice: false in .github/pr-lens.yml turns this note off}

[pullfrog]

Important

The reusable workflow this PR calls does not exist yet, so merging now would break release.yml. Hold the merge until it lands.

Reviewed changes

Reviewed the full diff (5 files, 3 commits) against the current release.yml, and checked the wolfstar-project/.github repository for the called workflow.

• release.yml: the release job now exposes published and publishedPackages, and a new announce job calls the shared reusable workflow.
• announce.yml: new manual workflow to re-send or preview an announcement, with dry-run on by default.
• .github/zizmor.yml: lets wolfstar-project/.github/* follow main (ref-pin) and keeps hash-pin for everything else.
• AGENTS.md and changeset: documents the flow and adds an empty changeset.

⚠️ PR body carries a second attribution after the disclosure line

The body ends with the disclosure line followed by --- and _Generated by [Claude Code](https://claude.ai/code/session_…)_. AGENTS.md says the disclosure line is the only AI attribution a PR body may carry and that nothing may follow it, so that footer should be removed.

Technical details

# Remove the extra attribution footer from the PR body

## Affected sites
- PR #280 body — trailing `---` and `_Generated by [Claude Code](...)_` after the `🤖 AI disclosure` line

## Required outcome
- The body contains exactly one disclosure line and nothing after it.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using claude-sonnet-5-5 ｜ 𝕏}

[pullfrog]

reusable-announce-packages.yml is not in wolfstar-project/.github yet (the contents API returns 404, and there is no open PR there). A caller that references a missing reusable workflow stops the whole release.yml run from starting, which would block the @next snapshot and the release publish on main. The PR is no longer a draft, so please keep the merge gated on the .github PR landing first.

Technical details

# Gate merge on the reusable workflow, and pin down the input contract

## Affected sites
- .github/workflows/release.yml:149 — `uses: wolfstar-project/.github/.github/workflows/reusable-announce-packages.yml@main`
- .github/workflows/release.yml:151 — passes `needs.release.outputs.publishedPackages`, which `changesets/action` emits as a JSON array of `{name, version}`
- .github/workflows/announce.yml:32 — passes a comma separated `name@version` list to the same `published-packages` input

## Required outcome
- Do not merge before `reusable-announce-packages.yml` exists on `wolfstar-project/.github` `main`.
- The `published-packages` input must accept both shapes (JSON array and `name@version,...`), or the two callers must normalize to one shape.

## Open questions for the human
- Does the reusable workflow parse both formats? It could not be checked because the file is not published yet.

[RedStar071]

On the open question: yes, published-packages takes both shapes. The action reads a value that starts with [ as the JSON array changesets/action emits (entries without a string name and version are dropped), and otherwise as name@version entries separated by commas or spaces. parsePublished covers both in its tests. I also checked every with: and secrets: name of the callers against the inputs and secrets the two reusable workflows declare, and none is unknown or missing.

The merge gate stays: please do not merge this before reusable-announce-packages.yml is on wolfstar-project/.github main. I cannot open that PR from this session, so it is for the maintainer to land.

---

Generated by Claude Code