[Levaj2000]

Summary

Adds a workflow_dispatch trigger to release-cut.yml, with mode (dry-run or push) and version inputs. The same change goes into both repos.

The Sprint & Portfolio Board panel cannot send repository_dispatch from the browser, because GitHub requires a real token on /dispatches. The panel becomes a guide that shows the command to paste instead:

gh workflow run release-cut.yml --repo Levaj2000/ai-identity-platform -f mode=dry-run -f version=0.6.0

On this path, GitHub's own check (write access to the repo) is the auth, so the HMAC step is skipped. The inputs go through the same mode and N.N.N version validation, and then the same run-cut job runs. The signed repository_dispatch path and the tag-on-merge job are unchanged.

Linear

AI-

Testing

• actionlint 1.7.7: clean.
• The validate step, extracted and run locally:
  • a manual dispatch with 0.6.0 passes and writes mode and version to the outputs;
  • 0.6.0;rm is rejected as a bad version;
  • a correctly signed repository_dispatch still passes.

Checklist

• CHANGELOG.md updated under [Unreleased] (required for feat and fix PRs): n/a, CI change
• Tests added or updated for new behavior, and the affected suites pass: no code paths changed
• No secrets, keys or real .env files in the diff
• Migrations, audit-chain, retention or mandate-signing changes are called out above: none
• Docs, runbooks or AGENTS.md updated if behavior or setup changed: n/a

---

Generated by Claude Code