fix: harden release validation and publishing

[marandaneto]

💡 Motivation and Context

The 4.12.1 release completed successfully but exposed gaps in the release safeguards: the automated version bump left composer.lock stale while validation suppressed the mismatch, and a no-op release commit could allow the publish job to finish without creating a GitHub Release. The release also requested the GitHub App's default installation permissions and performed an unnecessary full checkout to build the Slack comparison URL.

This makes the release path fail closed and keeps the committed Composer lock consistent with each released composer.json. This PR intentionally does not include a change intent; the updated path can be exercised by a later release.

💚 How did you test it?

• composer validate --no-check-version --strict
• composer install --dry-run --no-interaction
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/release.yml .github/workflows/php.yml
• Simulated a release candidate bump from 4.12.1 to 4.12.2 and confirmed composer update --lock changed only the lock content hash
• composer api:check
• ./vendor/bin/phpunit --bootstrap vendor/autoload.php --configuration phpunit.xml --no-coverage (441 tests, 3,762 assertions; existing warnings/deprecations remain)
• Independent read-only reviewer pass found no blockers

📝 Checklist

• I reviewed the submitted code.
• I added tests to verify the changes.
• I updated the docs if needed.
• No breaking change or entry added to the changelog.

If releasing new changes

• Ran pnpm change to generate a change intent file

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Implemented with the Pi coding agent using GitHub CLI, Composer, actionlint, and a read-only reviewer subagent. The chosen approach refreshes only Composer's lock content hash during version bumps, explicitly fails when no release commit is returned, narrows the App token to contents: write, and uses the pinned reusable workflow's checkout-free version-tag lookup. A temporary synthetic change intent was used to validate the candidate-generation path, but no release intent is committed in this PR.

[github-actions]

posthog-php Compliance Report

Date: 2026-07-23 07:26:02 UTC
Duration: 95139ms

✅ All Tests Passed!

46/46 tests passed

---

Capture Tests

✅ 29/29 tests passed

View Details

Test	Status	Duration
Format Validation.Event Has Required Fields	✅	10ms
Format Validation.Event Has Uuid	✅	5ms
Format Validation.Event Has Lib Properties	✅	4ms
Format Validation.Distinct Id Is String	✅	4ms
Format Validation.Token Is Present	✅	5ms
Format Validation.Custom Properties Preserved	✅	4ms
Format Validation.Event Has Timestamp	✅	4ms
Retry Behavior.Retries On 503	✅	5314ms
Retry Behavior.Does Not Retry On 400	✅	2008ms
Retry Behavior.Does Not Retry On 401	✅	2008ms
Retry Behavior.Respects Retry After Header	✅	8014ms
Retry Behavior.Implements Backoff	✅	15716ms
Retry Behavior.Retries On 500	✅	5110ms
Retry Behavior.Retries On 502	✅	5112ms
Retry Behavior.Retries On 504	✅	5114ms
Retry Behavior.Max Retries Respected	✅	16516ms
Deduplication.Generates Unique Uuids	✅	10ms
Deduplication.Preserves Uuid On Retry	✅	5110ms
Deduplication.Preserves Uuid And Timestamp On Retry	✅	10320ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	5115ms
Deduplication.No Duplicate Events In Batch	✅	9ms
Deduplication.Different Events Have Different Uuids	✅	6ms
Compression.Sends Gzip When Enabled	✅	4ms
Batch Format.Uses Proper Batch Structure	✅	4ms
Batch Format.Flush With No Events Sends Nothing	✅	3ms
Batch Format.Multiple Events Batched Together	✅	8ms
Error Handling.Does Not Retry On 403	✅	2006ms
Error Handling.Does Not Retry On 413	✅	2008ms
Error Handling.Retries On 408	✅	5114ms

Feature_Flags Tests

✅ 17/17 tests passed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	5ms
Request Payload.Flags Request Uses V2 Query Param	✅	4ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	3ms
Request Payload.Flags Request Omits Authorization Header	✅	4ms
Request Payload.Token In Flags Body Matches Init	✅	3ms
Request Payload.Groups Round Trip	✅	4ms
Request Payload.Groups Default To Empty Object	✅	3ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	4ms
Request Payload.Disable Geoip Omitted Defaults To False	✅	3ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	3ms
Request Lifecycle.No Flags Request On Init Alone	✅	1ms
Request Lifecycle.No Flags Request On Normal Capture	✅	5ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	5ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	4ms
Retry Behavior.Retries Flags On 502	✅	105ms
Retry Behavior.Retries Flags On 504	✅	105ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	6ms

[greptile-apps]

_{Reviews (1): Last reviewed commit: "fix: harden release validation and publi..." | Re-trigger Greptile}