From 03c04cfc25a8523d3a00a8bbfce5e700507e8aaf Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 22 Sep 2026 09:38:58 +0000
Subject: [PATCH 01/12] ci(release): migrate release automation to
 release-please manifest mode

Replaces the fragile matrix + single-commit git diff/grep hack in
release.yml with real release-please manifest mode, backed by a root
release-please-config.json/.release-please-manifest.json (one package
per Component, path-scoped to <name>/ only). Requires upgrading
release-please-action v3 -> v5, since v5 dropped the package-name
input the matrix job depended on.

Also:
- scope scripts/compute-workflow-sha256.sh to only the 8 reusable
  (workflow_call:) workflow files instead of all 9, and make it
  executable
- add a pull_request-triggered CI check that runs the script with
  --check on every PR (not wired into branch protection yet)
- add CONTRIBUTING.md documenting the workflow-sha256 sync step
---
 .github/workflows/release.yml                | 40 +----------
 .github/workflows/verify-workflow-sha256.yml | 19 ++++++
 .release-please-manifest.json                | 10 +++
 CONTRIBUTING.md                              | 15 +++++
 release-please-config.json                   | 70 ++++++++++++++++++++
 scripts/compute-workflow-sha256.sh           | 35 ++++++++++
 6 files changed, 151 insertions(+), 38 deletions(-)
 create mode 100644 .github/workflows/verify-workflow-sha256.yml
 create mode 100644 .release-please-manifest.json
 create mode 100644 CONTRIBUTING.md
 create mode 100644 release-please-config.json
 create mode 100755 scripts/compute-workflow-sha256.sh

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3593ef5..80f2c8f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,34 +14,8 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  setup-release-context:
-    runs-on: ubuntu-latest
-    outputs:
-      packages: ${{ steps.check-files.outputs.packages }}
-    steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-        with:
-          fetch-depth: 2
-      - name: Get list of workflows with changes
-        id: check-files
-        run: |
-          # Get list of workflows
-          workflow_list=($(basename -a -s .yml $(find .github/workflows/ -type f -print | xargs -I{} grep -l "workflow_call:$" {})))
-          # Get list of workflows to release
-          workflow_with_changes=$(printf "/%s[./]\n" ${workflow_list[@]} | xargs -I{} sh -c "git diff --name-only ${{ github.sha }} ${{ github.sha }}^ | grep -om1 -e '{}' || true" | tr -d /.)
-          releases_with_changes=$(printf "^%s[./]\n" ${workflow_list[@]} | xargs -I{} sh -c "git diff --name-only ${{ github.sha }} ${{ github.sha }}^ | grep -om1 -e '{}' || true" | tr -d /.)
-          # Set list of workflows to release
-          echo "packages=$(jq -cn --args '$ARGS.positional' -- ${workflow_with_changes[@]} ${releases_with_changes[@]})" >> "$GITHUB_OUTPUT"
-        shell: bash
-
   release-please:
-    needs: setup-release-context
-    if: ${{ needs.setup-release-context.outputs.packages != '[]' }}
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        package: ${{ fromJSON(needs.setup-release-context.outputs.packages) }}
     steps:
       - name: Get Token
         id: get_token
@@ -49,17 +23,7 @@ jobs:
         with:
           client-id: "${{ secrets.RELEASE_PLEASE_APPLICATION_ID }}"
           private-key: ${{ secrets.RELEASE_PLEASE_PRIVATE_KEY }}
-      - uses: googleapis/release-please-action@db8f2c60ee802b3748b512940dde88eabd7b7e01 # v3.7.13
-        id: release
+      - name: Run release-please
+        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:
-          default-branch: main
           token: ${{ steps.get_token.outputs.token }}
-          release-type: simple
-          package-name: ${{ matrix.package }}
-          version-file: ${{ matrix.package }}/version.txt
-          changelog-path: ${{ matrix.package }}/CHANGELOG.md
-          labels: ${{ matrix.package }}
-          bump-patch-for-minor-pre-major: true
-          bump-minor-pre-major: true
-          monorepo-tags: true
-          release-as: ""
diff --git a/.github/workflows/verify-workflow-sha256.yml b/.github/workflows/verify-workflow-sha256.yml
new file mode 100644
index 0000000..50edf67
--- /dev/null
+++ b/.github/workflows/verify-workflow-sha256.yml
@@ -0,0 +1,19 @@
+name: verify-workflow-sha256
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: verify-workflow-sha256-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  verify-workflow-sha256:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - name: Verify workflow-sha256 files are up to date
+        run: scripts/compute-workflow-sha256.sh --check
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
new file mode 100644
index 0000000..8309dfe
--- /dev/null
+++ b/.release-please-manifest.json
@@ -0,0 +1,10 @@
+{
+  "docker-build": "3.5.2",
+  "docker-build-cloud": "1.1.1",
+  "propose-safe-multisig-tx": "1.1.1",
+  "publish-npm": "1.7.1",
+  "release-please": "2.2.1",
+  "rust-build": "3.0.0",
+  "stale": "1.0.1",
+  "conventional-commits": "1.2.1"
+}
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..5bef6e5
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,15 @@
+# Contributing
+
+## Editing a reusable workflow
+
+Each reusable workflow (`.github/workflows/<name>.yml` declaring `workflow_call:`) is backed by a Component directory `<name>/` that release-please versions independently. Release-please only sees changes under `<name>/`, so a commit that only edits the workflow file is otherwise invisible to it.
+
+After editing any `.github/workflows/<name>.yml` for one of the 8 reusable workflows, run:
+
+```sh
+scripts/compute-workflow-sha256.sh
+```
+
+This regenerates `<name>/workflow-sha256`, a checksum of the workflow file. Commit the resulting diff alongside your workflow change — this is what makes the change visible to release-please for that Component.
+
+CI enforces this on every pull request via `scripts/compute-workflow-sha256.sh --check`, which fails if any `workflow-sha256` file is out of date.
diff --git a/release-please-config.json b/release-please-config.json
new file mode 100644
index 0000000..20236f3
--- /dev/null
+++ b/release-please-config.json
@@ -0,0 +1,70 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "separate-pull-requests": true,
+  "packages": {
+    "docker-build": {
+      "release-type": "simple",
+      "version-file": "docker-build/version.txt",
+      "changelog-path": "docker-build/CHANGELOG.md",
+      "extra-label": "docker-build",
+      "bump-patch-for-minor-pre-major": true,
+      "bump-minor-pre-major": true
+    },
+    "docker-build-cloud": {
+      "release-type": "simple",
+      "version-file": "docker-build-cloud/version.txt",
+      "changelog-path": "docker-build-cloud/CHANGELOG.md",
+      "extra-label": "docker-build-cloud",
+      "bump-patch-for-minor-pre-major": true,
+      "bump-minor-pre-major": true
+    },
+    "propose-safe-multisig-tx": {
+      "release-type": "simple",
+      "version-file": "propose-safe-multisig-tx/version.txt",
+      "changelog-path": "propose-safe-multisig-tx/CHANGELOG.md",
+      "extra-label": "propose-safe-multisig-tx",
+      "bump-patch-for-minor-pre-major": true,
+      "bump-minor-pre-major": true
+    },
+    "publish-npm": {
+      "release-type": "simple",
+      "version-file": "publish-npm/version.txt",
+      "changelog-path": "publish-npm/CHANGELOG.md",
+      "extra-label": "publish-npm",
+      "bump-patch-for-minor-pre-major": true,
+      "bump-minor-pre-major": true
+    },
+    "release-please": {
+      "release-type": "simple",
+      "version-file": "release-please/version.txt",
+      "changelog-path": "release-please/CHANGELOG.md",
+      "extra-label": "release-please",
+      "bump-patch-for-minor-pre-major": true,
+      "bump-minor-pre-major": true
+    },
+    "rust-build": {
+      "release-type": "simple",
+      "version-file": "rust-build/version.txt",
+      "changelog-path": "rust-build/CHANGELOG.md",
+      "extra-label": "rust-build",
+      "bump-patch-for-minor-pre-major": true,
+      "bump-minor-pre-major": true
+    },
+    "stale": {
+      "release-type": "simple",
+      "version-file": "stale/version.txt",
+      "changelog-path": "stale/CHANGELOG.md",
+      "extra-label": "stale",
+      "bump-patch-for-minor-pre-major": true,
+      "bump-minor-pre-major": true
+    },
+    "conventional-commits": {
+      "release-type": "simple",
+      "version-file": "conventional-commits/version.txt",
+      "changelog-path": "conventional-commits/CHANGELOG.md",
+      "extra-label": "conventional-commits",
+      "bump-patch-for-minor-pre-major": true,
+      "bump-minor-pre-major": true
+    }
+  }
+}
diff --git a/scripts/compute-workflow-sha256.sh b/scripts/compute-workflow-sha256.sh
new file mode 100755
index 0000000..4d471dc
--- /dev/null
+++ b/scripts/compute-workflow-sha256.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+check=false
+if [[ "${1:-}" == "--check" ]]; then
+  check=true
+fi
+
+outdated=false
+
+mapfile -t workflow_files < <(grep -lE "^[[:space:]]*workflow_call:[[:space:]]*$" .github/workflows/*.yml)
+
+for workflow_file in "${workflow_files[@]}"; do
+  name="$(basename "$workflow_file" .yml)"
+  sha_file="$name/workflow-sha256"
+  computed_sha="$(sha256sum "$workflow_file" | awk '{print $1}')"
+
+  if [[ "$check" == true ]]; then
+    if [[ ! -f "$sha_file" ]] || [[ "$(cat "$sha_file")" != "$computed_sha" ]]; then
+      echo "outdated \`$sha_file\`" >&2
+      outdated=true
+    fi
+  else
+    mkdir -p "$name"
+    echo "$computed_sha" > "$sha_file"
+    echo "$sha_file: $computed_sha" >&2
+  fi
+done
+
+if [[ "$check" == true ]] && [[ "$outdated" == true ]]; then
+  echo "found outdated workflow sha256: execute \`compute-workflow-sha256.sh\` to refresh workflows sha256"
+  exit 1
+fi

From 898dbad7aef6735182a5a9c0ff95abc554d556cb Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 22 Sep 2026 09:38:58 +0000
Subject: [PATCH 02/12] chore: seed workflow-sha256 for the 8 reusable
 workflows

Bootstraps <name>/workflow-sha256 for every Component so the new
verify-workflow-sha256 PR check (introduced in the prior commit) has
something to compare against instead of failing immediately on the
first PR.
---
 conventional-commits/workflow-sha256     | 1 +
 docker-build-cloud/workflow-sha256       | 1 +
 docker-build/workflow-sha256             | 1 +
 propose-safe-multisig-tx/workflow-sha256 | 1 +
 publish-npm/workflow-sha256              | 1 +
 release-please/workflow-sha256           | 1 +
 rust-build/workflow-sha256               | 1 +
 stale/workflow-sha256                    | 1 +
 8 files changed, 8 insertions(+)
 create mode 100644 conventional-commits/workflow-sha256
 create mode 100644 docker-build-cloud/workflow-sha256
 create mode 100644 docker-build/workflow-sha256
 create mode 100644 propose-safe-multisig-tx/workflow-sha256
 create mode 100644 publish-npm/workflow-sha256
 create mode 100644 release-please/workflow-sha256
 create mode 100644 rust-build/workflow-sha256
 create mode 100644 stale/workflow-sha256

diff --git a/conventional-commits/workflow-sha256 b/conventional-commits/workflow-sha256
new file mode 100644
index 0000000..8366669
--- /dev/null
+++ b/conventional-commits/workflow-sha256
@@ -0,0 +1 @@
+f4d93a8c6e9661da06e9cdc25bc14514ce8ba762289824d22b4e38ed55d53f45
diff --git a/docker-build-cloud/workflow-sha256 b/docker-build-cloud/workflow-sha256
new file mode 100644
index 0000000..146b5cb
--- /dev/null
+++ b/docker-build-cloud/workflow-sha256
@@ -0,0 +1 @@
+f364b67e9d5c3795461d15b7bab21adddcd63490e097a15aa82678f80212bff4
diff --git a/docker-build/workflow-sha256 b/docker-build/workflow-sha256
new file mode 100644
index 0000000..e1137cc
--- /dev/null
+++ b/docker-build/workflow-sha256
@@ -0,0 +1 @@
+02e205d604954431c03868fe49a190239b824e83173234bdb862a958bb63f4e3
diff --git a/propose-safe-multisig-tx/workflow-sha256 b/propose-safe-multisig-tx/workflow-sha256
new file mode 100644
index 0000000..e3b8d0f
--- /dev/null
+++ b/propose-safe-multisig-tx/workflow-sha256
@@ -0,0 +1 @@
+2bc401eb56f124daf40536e5e7c2b46f93a6dc11752d05984d2031df30207b8b
diff --git a/publish-npm/workflow-sha256 b/publish-npm/workflow-sha256
new file mode 100644
index 0000000..1bf4d63
--- /dev/null
+++ b/publish-npm/workflow-sha256
@@ -0,0 +1 @@
+fad5473affcfa7afb6c30f6127c7851eb7d5bc613203ff3a780278f25e5fdf15
diff --git a/release-please/workflow-sha256 b/release-please/workflow-sha256
new file mode 100644
index 0000000..f8ddc67
--- /dev/null
+++ b/release-please/workflow-sha256
@@ -0,0 +1 @@
+1d9d54064d8a10354bfc6a5429a13770b9e185c82fb0a116ed2abc3ceb8dbbf7
diff --git a/rust-build/workflow-sha256 b/rust-build/workflow-sha256
new file mode 100644
index 0000000..b1796ad
--- /dev/null
+++ b/rust-build/workflow-sha256
@@ -0,0 +1 @@
+e26af861c1aabbbc1d5468e9153f8e1bb1878713ce4ae501f7aaff3626008bdc
diff --git a/stale/workflow-sha256 b/stale/workflow-sha256
new file mode 100644
index 0000000..4f32bab
--- /dev/null
+++ b/stale/workflow-sha256
@@ -0,0 +1 @@
+28cbda1ec67a165c2bea5b6c83c4a50fdfa26f67852c47bc6dbeb84e31afd1f8

From 565584c0bd685ac955e9e6ffd5682c5a8badf5ff Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 22 Sep 2026 09:38:58 +0000
Subject: [PATCH 03/12] refactor(release): hoist common package fields to
 release-please-config.json root

release-type, bump-patch-for-minor-pre-major, and bump-minor-pre-major
were identical across all 8 packages; release-please-config.json
applies root-level ReleaserConfigOptions as defaults to every package,
so set them once instead of repeating per package.
---
 release-please-config.json | 43 ++++++++++----------------------------
 1 file changed, 11 insertions(+), 32 deletions(-)

diff --git a/release-please-config.json b/release-please-config.json
index 20236f3..92bbc36 100644
--- a/release-please-config.json
+++ b/release-please-config.json
@@ -1,70 +1,49 @@
 {
   "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
   "separate-pull-requests": true,
+  "release-type": "simple",
+  "bump-patch-for-minor-pre-major": true,
+  "bump-minor-pre-major": true,
   "packages": {
     "docker-build": {
-      "release-type": "simple",
       "version-file": "docker-build/version.txt",
       "changelog-path": "docker-build/CHANGELOG.md",
-      "extra-label": "docker-build",
-      "bump-patch-for-minor-pre-major": true,
-      "bump-minor-pre-major": true
+      "extra-label": "docker-build"
     },
     "docker-build-cloud": {
-      "release-type": "simple",
       "version-file": "docker-build-cloud/version.txt",
       "changelog-path": "docker-build-cloud/CHANGELOG.md",
-      "extra-label": "docker-build-cloud",
-      "bump-patch-for-minor-pre-major": true,
-      "bump-minor-pre-major": true
+      "extra-label": "docker-build-cloud"
     },
     "propose-safe-multisig-tx": {
-      "release-type": "simple",
       "version-file": "propose-safe-multisig-tx/version.txt",
       "changelog-path": "propose-safe-multisig-tx/CHANGELOG.md",
-      "extra-label": "propose-safe-multisig-tx",
-      "bump-patch-for-minor-pre-major": true,
-      "bump-minor-pre-major": true
+      "extra-label": "propose-safe-multisig-tx"
     },
     "publish-npm": {
-      "release-type": "simple",
       "version-file": "publish-npm/version.txt",
       "changelog-path": "publish-npm/CHANGELOG.md",
-      "extra-label": "publish-npm",
-      "bump-patch-for-minor-pre-major": true,
-      "bump-minor-pre-major": true
+      "extra-label": "publish-npm"
     },
     "release-please": {
-      "release-type": "simple",
       "version-file": "release-please/version.txt",
       "changelog-path": "release-please/CHANGELOG.md",
-      "extra-label": "release-please",
-      "bump-patch-for-minor-pre-major": true,
-      "bump-minor-pre-major": true
+      "extra-label": "release-please"
     },
     "rust-build": {
-      "release-type": "simple",
       "version-file": "rust-build/version.txt",
       "changelog-path": "rust-build/CHANGELOG.md",
-      "extra-label": "rust-build",
-      "bump-patch-for-minor-pre-major": true,
-      "bump-minor-pre-major": true
+      "extra-label": "rust-build"
     },
     "stale": {
-      "release-type": "simple",
       "version-file": "stale/version.txt",
       "changelog-path": "stale/CHANGELOG.md",
-      "extra-label": "stale",
-      "bump-patch-for-minor-pre-major": true,
-      "bump-minor-pre-major": true
+      "extra-label": "stale"
     },
     "conventional-commits": {
-      "release-type": "simple",
       "version-file": "conventional-commits/version.txt",
       "changelog-path": "conventional-commits/CHANGELOG.md",
-      "extra-label": "conventional-commits",
-      "bump-patch-for-minor-pre-major": true,
-      "bump-minor-pre-major": true
+      "extra-label": "conventional-commits"
     }
   }
 }

From 26cc20f84fab92906770e819a88c143c4d9efee2 Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 22 Sep 2026 09:38:58 +0000
Subject: [PATCH 04/12] ci(release): pin tag-separator to "-" in
 release-please-config.json

Locks the separator between component name and version in generated
GitHub tags (e.g. docker-build-v3.5.2) so it doesn't silently change
if release-please's own default ever changes.
---
 release-please-config.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/release-please-config.json b/release-please-config.json
index 92bbc36..aa84cd7 100644
--- a/release-please-config.json
+++ b/release-please-config.json
@@ -2,6 +2,7 @@
   "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
   "separate-pull-requests": true,
   "release-type": "simple",
+  "tag-separator": "-",
   "bump-patch-for-minor-pre-major": true,
   "bump-minor-pre-major": true,
   "packages": {

From faa490addd43df3133c67596965db89bcd74c729 Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 22 Sep 2026 09:54:20 +0000
Subject: [PATCH 05/12] fix(ci): invoke compute-workflow-sha256.sh via bash,
 drop executable bit

The script isn't executable, so both CI and the documented contributor
workflow must invoke it as `bash scripts/compute-workflow-sha256.sh`
rather than relying on the shebang and execute permission.
---
 .github/workflows/verify-workflow-sha256.yml | 2 +-
 CONTRIBUTING.md                              | 4 ++--
 scripts/compute-workflow-sha256.sh           | 0
 3 files changed, 3 insertions(+), 3 deletions(-)
 mode change 100755 => 100644 scripts/compute-workflow-sha256.sh

diff --git a/.github/workflows/verify-workflow-sha256.yml b/.github/workflows/verify-workflow-sha256.yml
index 50edf67..9b0b415 100644
--- a/.github/workflows/verify-workflow-sha256.yml
+++ b/.github/workflows/verify-workflow-sha256.yml
@@ -16,4 +16,4 @@ jobs:
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Verify workflow-sha256 files are up to date
-        run: scripts/compute-workflow-sha256.sh --check
+        run: bash scripts/compute-workflow-sha256.sh --check
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 5bef6e5..44434fc 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -7,9 +7,9 @@ Each reusable workflow (`.github/workflows/<name>.yml` declaring `workflow_call:
 After editing any `.github/workflows/<name>.yml` for one of the 8 reusable workflows, run:
 
 ```sh
-scripts/compute-workflow-sha256.sh
+bash scripts/compute-workflow-sha256.sh
 ```
 
 This regenerates `<name>/workflow-sha256`, a checksum of the workflow file. Commit the resulting diff alongside your workflow change — this is what makes the change visible to release-please for that Component.
 
-CI enforces this on every pull request via `scripts/compute-workflow-sha256.sh --check`, which fails if any `workflow-sha256` file is out of date.
+CI enforces this on every pull request via `bash scripts/compute-workflow-sha256.sh --check`, which fails if any `workflow-sha256` file is out of date.
diff --git a/scripts/compute-workflow-sha256.sh b/scripts/compute-workflow-sha256.sh
old mode 100755
new mode 100644

From 6f5ebecdaf80c6426145a36b797e8047788a8b08 Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 22 Sep 2026 10:00:09 +0000
Subject: [PATCH 06/12] fix(ci): bump actions/checkout to v7.0.1 in
 verify-workflow-sha256
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

v6.1.0 was picked to match this repo's most common existing pin, but
v7.0.1 is actually the latest release and is already used elsewhere
in the repo (publish-npm.yml) — align on the current version instead
of the majority-but-stale one.
---
 .github/workflows/verify-workflow-sha256.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/verify-workflow-sha256.yml b/.github/workflows/verify-workflow-sha256.yml
index 9b0b415..71f5c67 100644
--- a/.github/workflows/verify-workflow-sha256.yml
+++ b/.github/workflows/verify-workflow-sha256.yml
@@ -14,6 +14,6 @@ jobs:
   verify-workflow-sha256:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Verify workflow-sha256 files are up to date
         run: bash scripts/compute-workflow-sha256.sh --check

From 7a9471fe5d87cd6ff0fee482b3cc16b94ae0dbfa Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 22 Sep 2026 10:03:46 +0000
Subject: [PATCH 07/12] fix(ci): disable persist-credentials on checkout in
 verify-workflow-sha256

This job only reads the repo to compute a checksum and never pushes,
so there's no reason for actions/checkout to leave the GITHUB_TOKEN
in the local git config for later steps to pick up.
---
 .github/workflows/verify-workflow-sha256.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/verify-workflow-sha256.yml b/.github/workflows/verify-workflow-sha256.yml
index 71f5c67..c806f1f 100644
--- a/.github/workflows/verify-workflow-sha256.yml
+++ b/.github/workflows/verify-workflow-sha256.yml
@@ -15,5 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Verify workflow-sha256 files are up to date
         run: bash scripts/compute-workflow-sha256.sh --check

From 42d8ccac35d4bf3a680af117affd9316bb83e373 Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 22 Sep 2026 10:14:45 +0000
Subject: [PATCH 08/12] fix(ci): scope the release-please app token to
 contents/issues/PRs

Explicitly requests only the permissions release-please-action needs
via create-github-app-token's permission-* inputs, instead of letting
the generated installation token inherit the GitHub App's full set of
installed permissions.
---
 .github/workflows/release.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 80f2c8f..2d744a6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,6 +23,9 @@ jobs:
         with:
           client-id: "${{ secrets.RELEASE_PLEASE_APPLICATION_ID }}"
           private-key: ${{ secrets.RELEASE_PLEASE_PRIVATE_KEY }}
+          permission-contents: write
+          permission-issues: write
+          permission-pull-requests: write
       - name: Run release-please
         uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:

From 12d89d7cea1be7b17e37fc5f6663f926ab27c8ba Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 22 Sep 2026 12:18:20 +0000
Subject: [PATCH 09/12] style(ci): drop unnecessary quotes on client-id in
 release.yml

${{ ... }} is already a valid unquoted YAML plain scalar; the quotes
were leftover from the pre-existing release-please.yml this step was
copied from and don't change parsing here, just inconsistent with the
unquoted private-key line right below it.
---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2d744a6..4833e83 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,7 +21,7 @@ jobs:
         id: get_token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          client-id: "${{ secrets.RELEASE_PLEASE_APPLICATION_ID }}"
+          client-id: ${{ secrets.RELEASE_PLEASE_APPLICATION_ID }}
           private-key: ${{ secrets.RELEASE_PLEASE_PRIVATE_KEY }}
           permission-contents: write
           permission-issues: write

From beda76c7a9a3813bc47fca897a7558dfa355c700 Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 22 Sep 2026 13:29:51 +0000
Subject: [PATCH 10/12] fix(ci): drive workflow-sha256 discovery from
 release-please-config.json
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Read the tracked workflow names from release-please-config.json's
packages keys (via jq) instead of grepping .github/workflows/*.yml for
workflow_call: declarations. A reusable workflow with no package entry
isn't versioned by release-please, so it has no reason to carry a
workflow-sha256 file — scoping to the config's package list ties the
check to what's actually tracked instead of what merely looks
reusable. jq ships by default on GitHub-hosted ubuntu-latest runners.

Document release-please-config.json as the source of truth for this
in CONTRIBUTING.md.
---
 CONTRIBUTING.md                    | 4 ++--
 scripts/compute-workflow-sha256.sh | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 44434fc..835dd43 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -2,9 +2,9 @@
 
 ## Editing a reusable workflow
 
-Each reusable workflow (`.github/workflows/<name>.yml` declaring `workflow_call:`) is backed by a Component directory `<name>/` that release-please versions independently. Release-please only sees changes under `<name>/`, so a commit that only edits the workflow file is otherwise invisible to it.
+Each shared reusable workflow is backed by a Component directory `<name>/` that release-please versions independently. Release-please only sees changes under `<name>/`, so a commit that only edits the workflow file is otherwise invisible to it.
 
-After editing any `.github/workflows/<name>.yml` for one of the 8 reusable workflows, run:
+After editing any `.github/workflows/<name>.yml` for a workflow listed in `release-please-config.json`, run:
 
 ```sh
 bash scripts/compute-workflow-sha256.sh
diff --git a/scripts/compute-workflow-sha256.sh b/scripts/compute-workflow-sha256.sh
index 4d471dc..50b0340 100644
--- a/scripts/compute-workflow-sha256.sh
+++ b/scripts/compute-workflow-sha256.sh
@@ -10,10 +10,10 @@ fi
 
 outdated=false
 
-mapfile -t workflow_files < <(grep -lE "^[[:space:]]*workflow_call:[[:space:]]*$" .github/workflows/*.yml)
+mapfile -t package_names < <(jq -r '.packages | keys[]' release-please-config.json)
 
-for workflow_file in "${workflow_files[@]}"; do
-  name="$(basename "$workflow_file" .yml)"
+for name in "${package_names[@]}"; do
+  workflow_file=".github/workflows/$name.yml"
   sha_file="$name/workflow-sha256"
   computed_sha="$(sha256sum "$workflow_file" | awk '{print $1}')"
 

From 622a81def573646fe1e9480e2e8072bdc271b348 Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 22 Sep 2026 15:21:16 +0000
Subject: [PATCH 11/12] ci(release): enable always-update in
 release-please-config.json

Keeps open release PRs continuously refreshed with the latest changes
instead of staying static after initial creation.
---
 release-please-config.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/release-please-config.json b/release-please-config.json
index aa84cd7..e08cbb6 100644
--- a/release-please-config.json
+++ b/release-please-config.json
@@ -3,6 +3,7 @@
   "separate-pull-requests": true,
   "release-type": "simple",
   "tag-separator": "-",
+  "always-update": true,
   "bump-patch-for-minor-pre-major": true,
   "bump-minor-pre-major": true,
   "packages": {

From 096f14ec73a00b06ebe5118b39444d0fa173ecbd Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 22 Sep 2026 15:26:16 +0000
Subject: [PATCH 12/12] style(release): sort packages lexicographically in
 config and manifest
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Purely cosmetic — release-please doesn't care about JSON key order —
but keeps both files easier to scan and diff as packages are added.
---
 .release-please-manifest.json |  4 ++--
 release-please-config.json    | 10 +++++-----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 8309dfe..02bf5d9 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,10 +1,10 @@
 {
+  "conventional-commits": "1.2.1",
   "docker-build": "3.5.2",
   "docker-build-cloud": "1.1.1",
   "propose-safe-multisig-tx": "1.1.1",
   "publish-npm": "1.7.1",
   "release-please": "2.2.1",
   "rust-build": "3.0.0",
-  "stale": "1.0.1",
-  "conventional-commits": "1.2.1"
+  "stale": "1.0.1"
 }
diff --git a/release-please-config.json b/release-please-config.json
index e08cbb6..d701e3b 100644
--- a/release-please-config.json
+++ b/release-please-config.json
@@ -7,6 +7,11 @@
   "bump-patch-for-minor-pre-major": true,
   "bump-minor-pre-major": true,
   "packages": {
+    "conventional-commits": {
+      "version-file": "conventional-commits/version.txt",
+      "changelog-path": "conventional-commits/CHANGELOG.md",
+      "extra-label": "conventional-commits"
+    },
     "docker-build": {
       "version-file": "docker-build/version.txt",
       "changelog-path": "docker-build/CHANGELOG.md",
@@ -41,11 +46,6 @@
       "version-file": "stale/version.txt",
       "changelog-path": "stale/CHANGELOG.md",
       "extra-label": "stale"
-    },
-    "conventional-commits": {
-      "version-file": "conventional-commits/version.txt",
-      "changelog-path": "conventional-commits/CHANGELOG.md",
-      "extra-label": "conventional-commits"
     }
   }
 }