[Levaj2000]

Summary

Adds .github/workflows/release-cut.yml, the automated cut half of Decision #61. The publish half (release.yml, fired by the vX.Y.Z tag) is unchanged. The same file goes into both ai-identity-platform and AI-Identity.

A signed repository_dispatch (event_type: release-cut) from the Sprint & Portfolio Board runs scripts/release.py:

• dry-run: release.py X.Y.Z --dry-run. The output goes to the job summary.
• push: release.py X.Y.Z without --push creates the cut commit. That commit is pushed to release/vX.Y.Z and a chore(release): cut X.Y.Z PR is opened.
• on merge: a push to main that changes pyproject.toml runs the tag-release job. If pyproject names a version that has a ## [X.Y.Z] CHANGELOG header and no tag yet, the job tags the merged commit. The tag starts release.yml.

Changes from the panel's draft workflow, and why:

• Push mode goes through a PR. main requires status checks, and the platform repo enforces them for admins. A direct git push origin main from the runner would be rejected; AI-Identity 0.6.0 went through chore(release): cut 0.6.0 #576 for the same reason.
• Pushes use RELEASE_BOT_TOKEN, not GITHUB_TOKEN. A push or PR made with GITHUB_TOKEN does not trigger workflows, so CI would never run on the release PR and the tag would never start release.yml. It is also the checkout token, because checkout's auth header overrides credentials in a push URL.
• The install matches each repo's ci.yml. The draft ran pip install -e .[dev], but there is no build backend and no dev extra. The platform installs the hash-pinned locks plus common/ and sets the same test env. AI-Identity installs requirements-dev.txt plus pytest, httpx and cryptography. Node and npm ci run when dashboard/package.json exists, because release.py fails without dashboard/node_modules.
• Tighter permissions and pinned actions. The workflow default is permissions: {}, with contents: read per job (writes go through the bot token). Actions are pinned to the same SHAs as the other workflows.
• Values come from the verified job. run-cut reads mode and version from the verify job's outputs, not from the raw payload. actor is validated before it goes into the summary. sig is read with jq.
• Corrected the missing-secret error. It now says the rotator's app needs Secrets: read and write, not actions:write.

Linear

AI-

Testing

• actionlint 1.7.7: clean.
• The verify step's script, extracted and run locally: a correctly signed payload passes and writes mode/version to the outputs; a wrong signature fails with "HMAC signature does not match".
• Not yet run end to end. That needs RELEASE_HMAC_TOKEN and RELEASE_BOT_TOKEN set and a dry-run dispatch from the panel.

Checklist

• CHANGELOG.md updated under [Unreleased] (required for feat and fix PRs): n/a, CI change
• Tests added or updated for new behavior, and the affected suites pass: no code paths changed
• No secrets, keys or real .env files in the diff
• Migrations, audit-chain, retention or mandate-signing changes are called out above: none
• Docs, runbooks or AGENTS.md updated if behavior or setup changed: the sprint-close runbook should point at the panel once this is live

---

Generated by Claude Code