ci(release): settle directly, gated by the release environment

.claude/skills/bump-version-release/SKILL.md

@@ -13,11 +13,11 @@ Releases are made by the org release pipeline (megaeth-labs/.github).
    Merging it cuts `release-vX.Y.Z`.
    Fixes for the release go to that branch by PR, and every such fix must also land on `main` (cherry-pick it in a separate PR): the next candidate is cut from `main`, so a fix that exists only on the release branch is lost in the next release.
 2. **Settle** — `gh workflow run release-settle.yml --ref main -f version=X.Y.Z -f commit=<tip sha of release-vX.Y.Z>`.
-   This opens a PR onto the release branch with the finalised changelog entry.
-   Merging it is the release approval.
-3. **Publish** — automatic on that merge.
-   It creates the annotated tag `vX.Y.Z` and the GitHub Release with the entry as notes.
-4. **Targets** — automatic on the Release: `on-release.yml` publishes the four crates to crates.io and uploads `mega-evme` to the MegaETH artifact registry and the Release page.
+   The dispatch is the release approval: the run waits for the `release` environment's reviewer, and the action checks that the dispatcher is a repository admin.
+   The same job then commits the finalised changelog entry to the release branch, creates the annotated tag `vX.Y.Z`, and publishes the GitHub Release with the entry as notes.
+   There is no settle PR; `release-publish.yml` only serves the PR mode this repo no longer uses.
+   Fix changelog wording before dispatching: in the candidate PR while it is open, or by a PR onto the release branch after it merges.
+3. **Targets** — automatic on the Release: `on-release.yml` publishes the four crates to crates.io and uploads `mega-evme` to the MegaETH artifact registry and the Release page.
    Rehearse it first on an existing tag, dispatching on that tag's ref: `gh workflow run on-release.yml --ref vX.Y.Z -f dry_run=true`.
    The tag being released is always the run's own ref; there is no separate tag input.
    The publish credentials live in the `publish` environment, whose deployment policy allows only `v*` tag refs.

.github/workflows/release-publish.yml

@@ -8,6 +8,11 @@ name: Release Publish
 #
 # This file must exist on the release branch (it does, when the branch is cut
 # from a default branch that has it).
+#
+# Only settlement by PR reaches this workflow. release-settle.yml settles
+# directly (`settle_mode: direct`, gated by the `release` environment) and
+# publishes from its own job, so nothing here fires unless this repo goes
+# back to PR mode; the job gate rejects any settle PR the app did not open.
 
 on:
   pull_request:

.github/workflows/release-settle.yml

@@ -1,10 +1,18 @@
 name: Release Settle
 
-# Propose settling a release candidate. Dispatch from any branch with the
+# Settle a release candidate. Dispatch from the default branch with the
 # version and the full SHA of the release-branch tip; the shared action
 # verifies it, generates release notes from the commits since the previous
-# tag, writes them to the changelog, and opens a settle PR onto the release
-# branch. Merging that PR is the settlement decision (release-publish tags it).
+# tag, commits them to the changelog on the release branch, and publishes:
+# annotated tag at that commit, GitHub Release with the notes (on-release.yml
+# then runs the publish targets).
+#
+# The dispatch is the settlement decision, gated twice: the `release`
+# environment on the job (its required reviewers approve the run before it
+# starts; its deployment branch policy allows only the default branch) and
+# `settlers` in the action (the dispatching actor must be a repository
+# admin). The app is a bypass actor on the release-branch and `v*` tag
+# rulesets, which is what lets the settle commit and the tag land.
 
 on:
   workflow_dispatch:
@@ -18,8 +26,8 @@ on:
         required: true
         type: string
 
-# One settle per version: two dispatches for the same version would both
-# force-push the same settle branch. Queue, never cancel.
+# One settle per version: two dispatches for the same version would race on
+# the release branch. Queue, never cancel.
 concurrency:
   group: ${{ github.workflow }}-${{ inputs.version }}
   cancel-in-progress: false
@@ -30,6 +38,7 @@ permissions:
 jobs:
   settle:
     runs-on: ubuntu-latest
+    environment: release
     steps:
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         id: app-token
@@ -50,3 +59,5 @@ jobs:
           version_file: Cargo.toml
           version_pattern: toml
           changelog_file: CHANGELOG.md
+          settle_mode: direct
+          settlers: admin

CHANGELOG.md

@@ -1,7 +1,8 @@
 # Changelog
 
 All notable changes to mega-evm are recorded here, newest first.
-Entries are generated by the release flow from merged PR titles; edit an entry in its release candidate or settle PR if the wording needs work.
+Entries are generated by the release flow from merged PR titles.
+Fix wording in the release candidate PR while it is open, or, after it merges, by a PR onto the release branch before settlement is dispatched.
 
 ## v1.7.1 (unreleased)