ci: harden release PR check validation

[robinbraemer]

Intent

Execute backlog item connect-java-release-check-rollup-fix-w3 as an isolated connect-java change: remove duplicate release-PR build statuses/check runs while preserving an exact-commit audit of the native workflow-dispatch matrix checks before auto-merge. The workflow must retain only checks:read capability, reject incomplete or unsuccessful native checks, and refuse to merge if the release PR head moved after validation. Preserve a regression guard and concise durable project guidance. Do not release, deploy, merge a PR, change production, send public replies, widen credentials, touch the separate Gate release or Moxy-consumption decision, or otherwise expand scope.

What Changed

• Removed duplicate release-PR build statuses while retaining exact-commit auditing of the native workflow-dispatch matrix checks.
• Hardened auto-merge validation to require complete, successful checks and confirm the merged head remains the validated commit.
• Added regression coverage and concise project guidance for the release-check workflow.

Risk Assessment

✅ Low: The change is narrowly scoped, removes synthetic check/status writes, audits native checks on the captured commit, and now guards both the merge operation and externally observed merged state.

Testing

The focused regression test and workflow-level simulation passed, demonstrating native-check auditing, duplicate-check avoidance, and head-movement rejection; evidence is saved in the transcript artifact. No full suite, linter, formatter, release, merge, or deployment was run.

Evidence: Release workflow validation transcript

Success path exited 0; failed native check and moved-head scenarios exited 1 with expected workflow errors.

Release Please workflow validation (checked-out HEAD c4dbedce0a671553355e7812d588d52ee9845e68b)

The harness extracted and executed the actual `Validate and merge release PR` run block from `.github/workflows/release-please.yml` with mocked GitHub API responses.

CASE success: exit=0
Dispatching PR build for release PR #123 at release-please--branches--main--components--connect-java (abc123)
Native checks for run 9001 on commit abc123:
build (JDK 17): completed / success
build (JDK 21): completed / success
merged at validated head

CASE bad-check: exit=1
Native checks for run 9001 on commit abc123:
build (JDK 17): completed / success
build (JDK 21): completed / failure
::error::Dispatched run has incomplete or unsuccessful native checks

CASE moved-head: exit=1
Native checks for run 9001 on commit abc123:
build (JDK 17): completed / success
build (JDK 21): completed / success
::error::Release PR moved from abc123 to def456 during validation

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 2 issues found → auto-fixed (2) ✅

• 🚨 .github/workflows/release-please.yml:127 - The required intent says to “refuse to merge if the release PR head moved after validation.” Lines 123-129 perform only a non-atomic read, then gh pr merge runs without an expected-head precondition; a push between those calls can merge an unvalidated head. Use --match-head-commit "$HEAD_SHA" so GitHub enforces the validated commit atomically.
• ⚠️ core/src/test/java/com/minekube/connect/release/ReleasePleaseCheckAuditTest.java:50 - This regression test reads .github/workflows/release-please.yml, but core/build.gradle.kts only declares release.yml and release-repair.yml as test inputs. Gradle can therefore reuse cached :core:test after the release-please workflow changes, silently skipping this guard. Add the release-please workflow to the test inputs.

🔧 Fix: Make release-PR merge head-atomic and invalidate workflow test cache
1 error still open:

• 🚨 .github/workflows/release-please.yml:136 - The --match-head-commit guard protects only this merge attempt. If the PR moves from the validated SHA and another actor merges the new head while this loop runs, the guarded merge fails, but lines 140-145 accept any MERGED state and lines 150-161 continue the release flow. This still permits an unvalidated head to be treated as successfully merged. Accept MERGED only after verifying the PR head is the validated SHA, otherwise fail.

🔧 Fix: Guard merged release PRs against unvalidated head bypasses
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• ./gradlew :core:test --tests com.minekube.connect.release.ReleasePleaseCheckAuditTest
• Executed the actual release-PR validation block with mocked success, failed-check, and moved-head scenarios
• git status --short and scope inspection against origin/main

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.