fix(release): prevent cross-repo issue references from failing success

[devantler]

🤖 Generated by the Daily AI Engineer

Evidence

Platform Release run https://github.com/devantler-tech/platform/actions/runs/29575790420 published v1.118.2, then failed in @semantic-release/github success handling with Could not resolve to an issue or pull request with the number of 6355. The triggering merge text contained a qualified kubernetes-sigs/headlamp#6353 reference followed separately by bare fix #6355; the latter was syntactically local even though the author intended the same upstream repository.

Audience and impact

Every repository consuming the shared create-release.yaml workflow can turn an ambiguous bare issue reference into a red main release after the tag and GitHub Release have already been published. That creates a misleading partial-failure state and encourages blind reruns.

Expected behavior

Consumers that do not need post-publication issue/PR notifications should be able to disable semantic-release success/fail hooks and remove their write permissions without changing verification, notes, tags, assets, or GitHub Release publication.

Delivered

• fix(release): disable issue side effects in shared workflow #611 added the documented, default-off disable-issue-side-effects input, both-state required CI, and conditional least-privilege App token permissions.
• The change shipped in https://github.com/devantler-tech/actions/releases/tag/v10.0.3.
• fix(release): opt into issue-side-effect suppression platform#2681 tracks the first production-consumer rollout and observation.

Remaining acceptance criteria

• Roll the opt-in through affected public and private portfolio consumers using issue-backed slices.
• Observe at least one real opted-in release and record that publication stays green.
• Preserve the default path for consumers that intentionally rely on custom success/fail plugins.
• Decide separately whether ambiguous bare upstream references need release-note authoring guidance; do not infer a repository owner for fix #N text.

Rough size

Medium portfolio rollout, decomposed per consumer.

[coderabbitai]

🔗 Related PRs

#412 - ci: skip the suite on the release-commit push to dodge the self-pin tag race [merged]
#427 - fix: resolve first-party self-references at the same commit [merged]
#518 - fix(create-issues-from-todos): avoid unpinned retry wrapper [merged]
#553 - fix(auto-merge): fail closed on trusted-bot review gates [merged]
#575 - fix(auto-merge): harden mutable review evidence [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[devantler]

🤖 Generated by the Daily AI Engineer

The first production-consumer rollout is proven. Platform #2682 adopted disable-issue-side-effects: true; main release run https://github.com/devantler-tech/platform/actions/runs/29583454208 used a contents-only App token, invoked semantic-release with --success false --fail false, loaded zero success/fail plugins, and published immutable v1.119.1 successfully. Platform #2681 is closed. Keep this parent open for the remaining consumer rollout.

[devantler]

🤖 Generated by the Daily AI Engineer

The second production-consumer rollout is proven. AS Coaching issue https://github.com/devantler-tech/ascoachingogvaner/issues/120 and PR https://github.com/devantler-tech/ascoachingogvaner/pull/121 adopted Actions v10.0.3 with disable-issue-side-effects: true.

Real main release run https://github.com/devantler-tech/ascoachingogvaner/actions/runs/29607904725 exposed only permission-contents: write, invoked semantic-release with --success false --fail false, loaded no success/fail plugins, and published immutable v1.13.1 successfully. Post-release CD https://github.com/devantler-tech/ascoachingogvaner/actions/runs/29607946566 and CodeQL https://github.com/devantler-tech/ascoachingogvaner/actions/runs/29607903401 also passed.

Keep this parent open for the remaining consumer rollout.

[devantler]

🤖 Generated by the Daily AI Engineer

The third production-consumer rollout is proven. Wedding issue https://github.com/devantler-tech/wedding-app/issues/200 and PR https://github.com/devantler-tech/wedding-app/pull/201 adopted immutable Actions v10.1.0 with disable-issue-side-effects: true.

Real main release run https://github.com/devantler-tech/wedding-app/actions/runs/29614723928 exposed only permission-contents: write, invoked semantic-release@25.0.3 --success false --fail false, loaded no success/fail plugins, and published immutable v1.15.7 successfully. Post-release CD https://github.com/devantler-tech/wedding-app/actions/runs/29614754624 built and signed the image/manifests, and both main CodeQL runs https://github.com/devantler-tech/wedding-app/actions/runs/29614722998 and https://github.com/devantler-tech/wedding-app/actions/runs/29614722990 passed.

Keep this parent open for the remaining consumer rollout.

[devantler]

🤖 Generated by the Daily AI Engineer

The fourth production-consumer rollout is proven. Org-config issue devantler-tech/.github#108 and PR devantler-tech/.github#109 adopted immutable Actions v10.1.0 with disable-issue-side-effects: true and removed all caller GITHUB_TOKEN write grants.

The exact branch run https://github.com/devantler-tech/.github/actions/runs/29615688649 exposed only metadata read on the caller token, created a contents-only App token, invoked semantic-release@25.0.3 --success false --fail false, loaded no success/fail plugins, and correctly declined publication off main. After exact-head CI, Codex review, CodeRabbit status, zero-thread/body-finding, and user-evaluation gates passed, the routine self-promoted and squash-merged the PR as ef62c99b694ba00b4d828f10efd9e54d6178ece8.

Production release run https://github.com/devantler-tech/.github/actions/runs/29616035171 repeated the least-privilege and disabled-hook proof and published tag v1.19.1. CD run https://github.com/devantler-tech/.github/actions/runs/29616062213 then pushed and signed the manifests artifact, and main CodeQL run https://github.com/devantler-tech/.github/actions/runs/29616034513 passed. Keep this parent open for the remaining consumers.