feat(release): publish verified source tags

tools/release/govoplan_release/selective_planner.py

@@ -126,6 +126,7 @@ def compatibility_issues(dashboard: ReleaseDashboard) -> tuple[CompatibilityIssu
 
 def dry_run_steps(*, units: tuple[ReleasePlanUnit, ...], dashboard: ReleaseDashboard, channel: str) -> tuple[ReleasePlanStep, ...]:
     steps: list[ReleasePlanStep] = []
+    snapshots = {repo.spec.name: repo for repo in dashboard.repositories}
     for unit in units:
         steps.append(
             ReleasePlanStep(
@@ -150,17 +151,19 @@ def dry_run_steps(*, units: tuple[ReleasePlanUnit, ...], dashboard: ReleaseDashb
                     status="needs-executor",
                 )
             )
-        steps.append(
-            ReleasePlanStep(
-                id=f"{unit.repo}:commit",
-                title=f"Commit {unit.repo} release changes",
-                detail="Commit reviewed changes for this release unit only.",
-                command=f"git add -A && git commit -m {shlex.quote(f'Release {unit.repo} {unit.target_tag}')}",
-                cwd=f"{dashboard.workspace_root}/{unit.repo}",
-                mutating=True,
-                repo=unit.repo,
+        snapshot = snapshots.get(unit.repo)
+        if unit.current_version != unit.target_version or (snapshot is not None and snapshot.dirty):
+            steps.append(
+                ReleasePlanStep(
+                    id=f"{unit.repo}:commit",
+                    title=f"Commit {unit.repo} release changes",
+                    detail="Commit reviewed changes for this release unit only.",
+                    command=f"git add -A && git commit -m {shlex.quote(f'Release {unit.repo} {unit.target_tag}')}",
+                    cwd=f"{dashboard.workspace_root}/{unit.repo}",
+                    mutating=True,
+                    repo=unit.repo,
+                )
             )
-        )
         steps.append(
             ReleasePlanStep(
                 id=f"{unit.repo}:tag",
@@ -229,10 +232,16 @@ def dry_run_steps(*, units: tuple[ReleasePlanUnit, ...], dashboard: ReleaseDashb
                 ReleasePlanStep(
                     id="catalog:validate-sign-publish",
                     title=f"Validate, sign, and publish {channel}",
-                    detail="The candidate writer validates and signs locally. Publishing to the website repo remains a separate apply step.",
-                    command="Review the candidate under runtime/release-candidates before publishing it to the website repository.",
+                    detail=(
+                        "The candidate writer validates and signs locally. Preview and guarded apply/tag/push executors "
+                        "are available in the Signed Website Catalog panel and the release-catalog CLI."
+                    ),
+                    command=(
+                        "tools/release/release-catalog.py publish-candidate "
+                        f"--candidate-dir \"$CANDIDATE_DIR\" --channel {shlex.quote(channel)}"
+                    ),
                     cwd=dashboard.meta_root,
-                    status="needs-publish-executor",
+                    status="planned",
                 )
             )
     return tuple(steps)