feat(release): gate tags on scoped workflows

tools/release/govoplan_release/repository_tag.py

@@ -3,15 +3,17 @@
 from __future__ import annotations
 
 from dataclasses import dataclass
+import os
 from pathlib import Path
 import re
 import subprocess
+import sys
 
 from .git_state import collect_repository_snapshot, git_text
 from .model import RepositorySnapshot
 from .repository_push import command_text, compact_output
 from .version_alignment import repository_version_issues
-from .workspace import load_repository_specs, resolve_repo_path, resolve_workspace_root
+from .workspace import META_ROOT, load_repository_specs, resolve_repo_path, resolve_workspace_root
 
 
 _RELEASE_VERSION = re.compile(r"^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$")
@@ -75,6 +77,24 @@ def tag_repositories(
                 "detail": "batch preflight failed; no selected repository was mutated",
                 "repositories": blocked_rows,
             }
+    elif selected:
+        manifest_gate_issue = manifest_shape_gate_issue(workspace)
+        if manifest_gate_issue:
+            return {
+                "status": "blocked",
+                "apply": False,
+                "push": push,
+                "remote": remote,
+                "detail": "release manifest validation failed",
+                "repositories": [
+                    {
+                        "repo": repo,
+                        "status": "blocked",
+                        "detail": manifest_gate_issue,
+                    }
+                    for repo in selected
+                ],
+            }
 
     for repo in selected:
         version = normalize_version(repo_versions.get(repo))
@@ -352,6 +372,20 @@ def basic_blocker(*, snapshot: RepositorySnapshot, version: str) -> str | None:
     return None
 
 
+def manifest_shape_gate_issue(workspace: Path) -> str | None:
+    command = (
+        sys.executable,
+        str(META_ROOT / "tools" / "checks" / "check-manifest-shapes.py"),
+        "--workspace-root",
+        str(workspace),
+    )
+    result = run(command, cwd=META_ROOT, env={**os.environ, "PYTHONDONTWRITEBYTECODE": "1"})
+    if result.returncode == 0:
+        return None
+    detail = compact_output(result.stderr) or compact_output(result.stdout)
+    return f"manifest/documentation release gate failed: {detail or 'unknown validation error'}"
+
+
 @dataclass(frozen=True, slots=True)
 class RemoteTagResult:
     commit: str | None = None