chore: post 2.2.0 release sync

.github/workflows/current.yml

@@ -8,6 +8,7 @@ on:
     paths-ignore:
       - "*.md"
       - "LICENSE"
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/lint-web.yml

@@ -17,6 +17,7 @@ on:
     paths-ignore:
       - "*.md"
       - "LICENSE"
+  workflow_dispatch:
 
 jobs:
   lint-web:

.github/workflows/release.yml

@@ -89,14 +89,24 @@ jobs:
               exit 1
             fi
 
-            # CI passed for this commit on this branch
+            # CI can be started by hand on any branch, so a green run alone does not prove the branch is a release branch.
+            if [[ ! $GITHUB_REF_NAME =~ ^(dev|release/.+|stable/.+)$ ]]; then
+              echo "::error::A draft must come from dev, release/**, or stable/**, not $GITHUB_REF_NAME"
+              exit 1
+            fi
+
+            # CI passed for this commit on this branch. Only the newest run of each workflow counts, so a green
+            # manual run replaces a failed push run. Manual runs count only for the CI workflows; release.yml runs
+            # are themselves workflow_dispatch runs.
             CI_PROBLEMS=$(gh api --method GET "repos/$GH_REPO/actions/runs" -f head_sha="$GITHUB_SHA" \
-              -f branch="$GITHUB_REF_NAME" -f event=push -F per_page=100 --jq '.workflow_runs |
+              -f branch="$GITHUB_REF_NAME" -F per_page=100 --jq '[".github/workflows/current.yml", ".github/workflows/lint-web.yml",
+                  ".github/workflows/test-web.yml", ".github/workflows/test.yml"] as $ci |
+                [.workflow_runs[] | select(.event == "push" or (.event == "workflow_dispatch" and (.path | IN($ci[]))))] |
+                group_by(.path) | map(max_by(.run_started_at)) |
                 (.[] | select(.conclusion != "success" and .conclusion != "skipped") | "\(.path): \(.conclusion // .status) \(.html_url)"),
-                ([".github/workflows/current.yml", ".github/workflows/lint-web.yml", ".github/workflows/test-web.yml",
-                  ".github/workflows/test.yml"] - map(.path) | .[] | "\(.): no run")')
+                ($ci - map(.path) | .[] | "\(.): no run")')
             if [[ -n $CI_PROBLEMS ]]; then
-              echo "::error::CI for $GITHUB_SHA on $GITHUB_REF_NAME is not green. A push that changes only *.md or LICENSE files starts no CI run."
+              echo "::error::CI for $GITHUB_SHA on $GITHUB_REF_NAME is not green. A push that changes only *.md or LICENSE files, or a branch rename, starts no CI run; start one with: for w in current lint-web test-web test; do gh workflow run \$w.yml --ref $GITHUB_REF_NAME; done"
               echo "$CI_PROBLEMS"
               exit 1
             fi

.github/workflows/test-web.yml

@@ -17,6 +17,7 @@ on:
     paths-ignore:
       - "*.md"
       - "LICENSE"
+  workflow_dispatch:
 
 permissions:
   contents: read

.github/workflows/test.yml

@@ -17,6 +17,7 @@ on:
     paths-ignore:
       - "*.md"
       - "LICENSE"
+  workflow_dispatch:
 
 env:
   CARGO_TERM_COLOR: always