[Troublor]

Summary

Migrates the release workflows from Maxwell/release-publish to the shared Gutenberg release pipeline (megaeth-labs/.github main; guide: https://github.com/megaeth-labs/.github/blob/main/.github/actions/RELEASE.md).

• release-candidate.yml: Gutenberg token (permission-* listed), push-to-main route + cut, no job environment; bump_command: cargo update --workspace kept with dependency_token: ${{ github.token }} (algebra, salt, mega-evm are all public).
• release-settle.yml: PR-based route/refresh/publish; only publish uses environment: release.
• release-publish.yml: deleted (publish now happens in release-settle).
• on-release.yml: registry job environment: publish -> release; nothing else changed.
• app-token-lint.yml: new, linting only the four release files (not claude.yml, which mints Maxwell without permissions).

Owner Phase A prerequisites (console checklist, stateless-validator)

1. A1: confirm org variable MEGA_GUTENBERG_CLIENT_ID / secret MEGA_GUTENBERG_PK are visible to this repo and the mega-gutenberg app installation covers it.
2. A2: environment release: keep branch main, add branch release-v* and tag v*; keep reviewer Troublor.
3. A3: add GCP_AUTH_KEY to environment release before the first tag (today it exists only in publish).
4. A4-tag: ruleset 22500122: add Integration 5494042 (Always), remove 3956799, keep RepositoryRole:5.
5. A4-branch: ruleset 22500044: remove Maxwell bypass, uncheck Restrict creations, keep lint/test, enable do-not-enforce-on-create and up-to-date branches.

Notes

• Someone's 2.1.0 dispatch failed on 2026-10-28 (run 40698636456, missing dependency_token); after merge it can simply be re-dispatched.
• Stale branches chore/release-candidate-2.0.18, chore/release-candidate-2.0.19, chore/release-settle-v2.0.18 are intentionally left alone.
• Not merged and no workflow dispatched.

[mega-maxwell]

Claude review status

Living comment — rewritten in place. The review workflow keeps this single comment up to date instead of posting a new one each round, so it always describes the latest reviewed commit and the earlier text is intentionally gone. No reply is needed here; reply to a finding in its own review thread, and answer an open question in a reply on this PR. The next review round reconciles your answer.

✅ Review clean

Last reviewed: 8b78c051..f69efb56 · updated 2026-10-29T06:33:37+00:00

New this round: 0 finding(s), 0 question(s) · Resolved this round: 0 · Open questions: 0

[mega-maxwell]

⚠️ Review needs attention — 1 finding(s)

0 blocking · 0 should-fix · 1 suggestion(s) · 0 open question(s)

Reviewed head 2e16a3ba.

Findings without inline anchors:

• .github/workflows/on-release.yml:30 — [Minor] Comment still references the old publish environment after the registry job was moved to release An operator reading the header to confirm where to configure the secret is pointed at the wrong GitHub environment (publish), while the job actually resolves credentials from release. The PR body already lists A3 (add GCP_AUTH_KEY to environment release before the first tag) as a prerequisite; a stale comment that still claims the secret lives in publish directly contradicts that prerequisite and increases the chance the registry upload fails on the first real release. Suggested fix: Update the comment to say the secret lives in the release environment (and that its deployment policy must allow v* tag refs, matching A2 in the PR body), so the orientation comment and the environment: on line 134 stay in sync.