Release gate: every check in full and in parallel before a branch replaces main

release-gate.yml, run by hand on a branch, calls ci.yml as Run workflow with
cross-compilation (every native suite in full, reference, doc and GPU path tests, the whole
action matrix, property tests, web-offline, wasm, Windows FXC and startup), kernel-rig.yml
(every area and the ladder) and release.yml as a dry run (every package and its smoke
tests), and passes only when all three pass. release.yml can now be called (workflow_call).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/release-gate.yml

@@ -0,0 +1,70 @@
+# The release gate: everything, in full and in parallel, on one branch's head, before that branch
+# replaces main as a release (develop, rebased onto main). Run it by hand:
+#   gh workflow run release-gate.yml --ref develop
+# It calls the workflows that own each check instead of copying their jobs:
+# - ci.yml as Run workflow with cross-compilation: every native suite in full (not scoped), the
+#   reference tests, the doc tests, the GPU path tests, the action matrix (all 16 shards) and its
+#   determinism check, the property tests, the repository checks (web-offline among them),
+#   WebAssembly and RISC-V, Windows D3D12 FXC and Windows app startup;
+# - kernel-rig.yml: every rig area against its KNOWN_FAILING and the ladder against its golden;
+# - release.yml as a dry run (draft false): the Linux, Flatpak, Snap, FreeBSD, macOS, Windows and
+#   web packages with their smoke tests and package checks.
+# The gate passes only when all three pass. Before main is replaced, tag the old main
+# (main-before-develop-<date>) and push the tag.
+name: Release gate
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-gate-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  ci:
+    name: CI
+    uses: ./.github/workflows/ci.yml
+    permissions:
+      contents: read
+      # Select checks reads this commit's other runs.
+      actions: read
+    with:
+      cross_compile: true
+
+  kernel-rig:
+    name: Kernel rig
+    uses: ./.github/workflows/kernel-rig.yml
+    permissions:
+      contents: read
+
+  packages:
+    name: Packages
+    uses: ./.github/workflows/release.yml
+    # release.yml's last job asks for contents: write (it creates releases); a dry run only keeps
+    # the files as an artifact.
+    permissions:
+      contents: write
+      actions: read
+    secrets: inherit
+    with:
+      draft: false
+
+  release-gate:
+    name: release-gate
+    needs: [ci, kernel-rig, packages]
+    if: always()
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Every part passed
+        env:
+          CI: ${{ needs.ci.result }}
+          KERNEL_RIG: ${{ needs.kernel-rig.result }}
+          PACKAGES: ${{ needs.packages.result }}
+        run: |
+          echo "ci=$CI kernel-rig=$KERNEL_RIG packages=$PACKAGES"
+          test "$CI" = success
+          test "$KERNEL_RIG" = success
+          test "$PACKAGES" = success

.github/workflows/release.yml

@@ -20,6 +20,7 @@
 # releases/latest/download/<name> links in the README keep working across releases.
 #
 # A dry run: dispatch with draft=false (the default). Only the release branch may create drafts.
+# The release gate (release-gate.yml) calls it as such a dry run.
 # A dry run from any branch also test-signs the Windows files when SIGNPATH_API_TOKEN exists:
 #   gh workflow run release.yml --ref <branch> -f draft=false [-f signpath_signing_policy=test-signing]
 name: Release
@@ -40,6 +41,18 @@ on:
         description: "SignPath signing policy for the Windows files (empty: the repository variable, else test-signing)"
         type: string
         default: ""
+  # The release gate (release-gate.yml): a dry run (draft false) of every package and its checks.
+  # The event stays the caller's (workflow_dispatch), so a call runs as a dispatched dry run does.
+  workflow_call:
+    inputs:
+      draft:
+        description: "Create/update a draft (release branch only; off: build artifacts only)"
+        type: boolean
+        default: false
+      signpath_signing_policy:
+        description: "SignPath signing policy for the Windows files (empty: the repository variable, else test-signing)"
+        type: string
+        default: ""
 
 permissions:
   contents: read