ci: automate signed catalog releases

.github/release-allowed-signers

@@ -0,0 +1 @@
+steipete@gmail.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII9XsaCcr8TInPnHcuTVfvXXcsoUFrOE7menfbEIHFW9 steipete@gmail.com

.github/workflows/release.yml

@@ -0,0 +1,42 @@
+name: Release
+
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Version matching a dated CHANGELOG section
+        required: true
+        type: string
+      dry_run:
+        description: Validate and verify without publishing
+        default: true
+        type: boolean
+
+permissions: {}
+
+concurrency:
+  group: release-${{ github.repository }}-${{ inputs.version || github.ref_name }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    permissions:
+      actions: read
+      checks: read
+      contents: write
+      statuses: read
+    uses: openclaw/release-workflows/.github/workflows/release-source.yml@v1
+    with:
+      version: ${{ inputs.version || github.ref_name }}
+      dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}
+      require-signed-tag: true
+      strict-checks: true
+      ci-check-events: '["push"]'
+      source-archives: true
+      test-command: |
+        python3 -m venv "$RUNNER_TEMP/release-venv"
+        "$RUNNER_TEMP/release-venv/bin/pip" install -r requirements-dev.txt
+        npx --yes --package=node@26.10.0 --call 'npm ci --ignore-scripts'
+        PATH="$RUNNER_TEMP/release-venv/bin:$PATH" npx --yes --package=node@26.10.0 --call 'python scripts/check-skills'

.release-version

@@ -0,0 +1 @@
+0.5.0

docs/RELEASING.md

@@ -1,19 +1,34 @@
 # Releasing
 
-This repository distributes skills and helper scripts directly from Git.
-`package.json` is private development tooling: there is no npm package or
-compiled release artifact. GitHub supplies source archives for each release tag.
+This catalog distributes skills and helper scripts directly from Git. Its private
+npm manifests are development tooling, not registry packages. `release-source.yml`
+runs the catalog checks and publishes frozen-commit source tar/zip archives with
+the exact changelog notes, inventory, and `SHA256SUMS`. Independent push CI must
+also pass Linux, Windows, and native macOS sandbox checks.
 
-1. Run the shared checks described in the README and verify the release PR's
-   exact head passes Linux, Windows, and native macOS sandbox CI.
-2. Move the accumulated `Unreleased` entries into `## X.Y.Z - YYYY-MM-DD`,
-   retain contributor credit, and add a one-line **Highlights** lead-in.
-   Keep an empty `## Unreleased` section above the release. Use a patch version
-   for fixes, or a minor version for features or compatibility changes.
-3. Land the release preparation PR and update a clean `main` checkout.
-4. Create and push an annotated `vX.Y.Z` tag at that commit. Publish a GitHub
-   Release for the existing tag, using the finalized changelog section as its
-   body (`gh release create --verify-tag --notes-file <file>`).
-5. Verify the published release is not a draft, its tag resolves to the intended
-   commit, and its body matches the changelog. No registry publication, signing,
-   or downstream snapshot update is implied by this source release.
+The `Release` workflow calls the shared OpenClaw archetype at `@v1`. It
+requires a protected `main`, matching version metadata, a dated changelog section,
+and successful independent **push** CI on the exact release commit. It verifies
+SSH-signed annotated tags against `.github/release-allowed-signers` and rejects
+moved tags or an existing GitHub Release.
+
+Prepare the version and dated `## X.Y.Z - YYYY-MM-DD` changelog section in a PR,
+retain `## Unreleased`, and merge only after CI and review. After explicit release
+authorization, create and push an SSH-signed annotated `vX.Y.Z` tag at that merged
+commit using an allowed signing key. Tag pushes publish through Actions; manual
+GitHub Release creation is retired. A live dispatch cannot create a missing signed
+tag: create the signed tag first.
+
+For a no-publish rehearsal, dispatch `release.yml` on current `main` with a version
+that already has a dated changelog section and `dry_run=true` (the default):
+
+```sh
+gh workflow run release.yml --ref main -f version=0.5.0 -f dry_run=true
+```
+
+The rehearsal exercises current protected main, even when the version already has
+an older tag. It creates no tag, release, or registry publication. Inspect every
+job and the retained verification artifacts before release. Real releases never
+move a tag or overwrite an existing version.
+
+Update `.release-version` with the changelog version in each release preparation PR.