feat(release): gate tags on scoped workflows

tools/release/govoplan_release/repository_tag.py

@@ -3,15 +3,17 @@
 from __future__ import annotations
 
 from dataclasses import dataclass
+import os
 from pathlib import Path
 import re
 import subprocess
+import sys
 
 from .git_state import collect_repository_snapshot, git_text
 from .model import RepositorySnapshot
 from .repository_push import command_text, compact_output
 from .version_alignment import repository_version_issues
-from .workspace import load_repository_specs, resolve_repo_path, resolve_workspace_root
+from .workspace import META_ROOT, load_repository_specs, resolve_repo_path, resolve_workspace_root
 
 
 _RELEASE_VERSION = re.compile(r"^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$")
@@ -75,6 +77,24 @@ def tag_repositories(
                 "detail": "batch preflight failed; no selected repository was mutated",
                 "repositories": blocked_rows,
             }
+    elif selected:
+        manifest_gate_issue = manifest_shape_gate_issue(workspace)
+        if manifest_gate_issue:
+            return {
+                "status": "blocked",
+                "apply": False,
+                "push": push,
+                "remote": remote,
+                "detail": "release manifest validation failed",
+                "repositories": [
+                    {
+                        "repo": repo,
+                        "status": "blocked",
+                        "detail": manifest_gate_issue,
+                    }
+                    for repo in selected
+                ],
+            }
 
     for repo in selected:
         version = normalize_version(repo_versions.get(repo))
@@ -352,6 +372,20 @@ def basic_blocker(*, snapshot: RepositorySnapshot, version: str) -> str | None:
     return None
 
 
+def manifest_shape_gate_issue(workspace: Path) -> str | None:
+    command = (
+        sys.executable,
+        str(META_ROOT / "tools" / "checks" / "check-manifest-shapes.py"),
+        "--workspace-root",
+        str(workspace),
+    )
+    result = run(command, cwd=META_ROOT, env={**os.environ, "PYTHONDONTWRITEBYTECODE": "1"})
+    if result.returncode == 0:
+        return None
+    detail = compact_output(result.stderr) or compact_output(result.stdout)
+    return f"manifest/documentation release gate failed: {detail or 'unknown validation error'}"
+
+
 @dataclass(frozen=True, slots=True)
 class RemoteTagResult:
     commit: str | None = None

tools/release/push-release-tag.sh

@@ -493,6 +493,13 @@ run_version_alignment_gate() {
   run "${command[@]}"
 }
 
+run_manifest_shape_gate() {
+  run env PYTHONDONTWRITEBYTECODE=1 \
+    "$PYTHON" \
+    "$META_ROOT/tools/checks/check-manifest-shapes.py" \
+    --workspace-root "$PARENT"
+}
+
 run_migration_release_audit() {
   local audit_script="$META_ROOT/tools/release/release-migration-audit.py"
   local command=("$PYTHON" "$audit_script" "--track" "release")
@@ -841,6 +848,7 @@ for repo in "${REPOS[@]}"; do
 done
 
 run_migration_release_audit
+run_manifest_shape_gate
 
 confirm_release