ci: split release into firmware and PCB tag-triggered workflows

[gaetanars]

Summary

Firmware and PCB now release on separate tag prefixes with separate CHANGELOGs. v*.*.* tags cut a firmware release (CHANGELOG.md, no asset). pcb-*.*.* tags cut a PCB release (pcb/CHANGELOG.md, gerber.zip attached, makeLatest: false). The unified release.yml and its conditional "PCB inchangé" body note are retired.

The split eliminates the forced shared lifecycle: a PCB revision no longer requires a firmware bump (and vice versa), and release notes for either component no longer pull in commits from the other.

What changed

• New: .github/workflows/release-firmware.yml — v*.*.* trigger, no asset, makeLatest: legacy, writes CHANGELOG.md.
• New: .github/workflows/release-pcb.yml — pcb-*.*.* trigger, gerber.zip validated via Garde C12, makeLatest: false, writes pcb/CHANGELOG.md.
• Removed: .github/workflows/release.yml — unified workflow + the PCB-unchanged conditional body note.
• Updated: README.md "Couper une release" split into two runbooks with an explicit seed-tag guardrail.
• Seeded: annotated tag pcb-0.1.0 on b5573bb (the squash-merge where pcb/ landed on main) as the anchor for git tag --list 'pcb-*'. First real PCB release will be pcb-0.1.1.

Key design decisions

• fromTag/toTag with a shell pre-step, not the action's tag: mode. requarks/changelog-action's default mode runs a prefix-blind git describe — on a pcb-0.1.1 push it would return the latest firmware tag, producing either an action failure (latestTag.name !== tag) or a PCB changelog full of firmware commits. The pre-step computes the component-scoped previous tag with git tag --list '<prefix>[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | grep -v -Fx "${ref}" | head -n1 and fails loudly on empty. Skip-by-name is correct under forward-looking retags of older versions; positional sed '2p' would not be.
• Shared concurrency: release-main across both workflows. Per-workflow groups would only serialize retags of the same component. The real concern is a combined git push origin main v0.2.0 pcb-0.1.1 racing two CHANGELOG auto-commits against main. A shared group closes that window.
• Refname-exact tag-on-main guard. grep 'origin/main$' → git branch -r --format='%(refname)' | grep -Fxq 'refs/remotes/origin/main'. Closes a residual risk from the hardening learning doc — origin/main$ would match feat-main or a second remote's main.
• Seed tag anchors on b5573bb, not on the original import commit 7ea5eab. PR feat: fusionner frangipool/pcb dans le monorepo + release workflow #7 was squash-merged, so 7ea5eab is unreachable from main. git merge-base pcb-0.1.0 HEAD would otherwise return c73abbf and pollute the first PCB release notes with the monorepo fusion itself. b5573bb — the squash-merge — is the correct anchor for a post-monorepo PCB lifecycle.
• No composite action for shared guards. ~20 duplicated lines between the two workflows. Extracting them would recreate the coupling the split was designed to remove.

Known residual risks

Risk	Status
TOCTOU on auto-commit if a human push hits main between checkout and git-auto-commit-action	Shared concurrency closes the workflow-vs-workflow window; human-vs-workflow window fails cleanly (no half-published release)
No pre-merge actionlint — new workflow YAML is first validated on a real tag push	Tracked as follow-up; would have caught three findings during this PR's code review
No workflow_dispatch dry-run path	Deferred; revisit after first production use if pain emerges
Seed tag pcb-0.1.0 deletion would break all future PCB releases	Workflow-level guard (if: github.ref_name != 'pcb-0.1.0') + README "NE JAMAIS supprimer" encart. Repo-level tag protection rule recommended but not yet configured

Post-Deploy Monitoring & Validation

No CI-level monitoring to configure — the GitHub Actions tab is sufficient. The first real release cycle is the end-to-end test:

• Firmware (v0.2.0): release-firmware.yml only fires (not release-pcb.yml). CHANGELOG.md gets a new ## [v0.2.0] entry excluding scopes pcb,changelog and types chore,style,build. No asset attached. "Latest release" badge updates.
• PCB (pcb-0.1.1): release-pcb.yml only fires. pcb/CHANGELOG.md gets a new ## [pcb-0.1.1] entry above the archived ## [v0.1.0] - 2023-06-08. gerber.zip attached, C12 pattern passes. "Latest release" badge unchanged — stays on firmware.
• Combined push (git push origin main v0.2.1 pcb-0.1.2): both workflows queue on release-main, serialize cleanly. Both releases land without non-fast-forward errors.

Full post-merge checklist in docs/plans/2026-04-23-001-refactor-split-release-tags-plan.md under "Post-merge validation checklist". Failure signal: an unexpected asset on a firmware release, missing asset on a PCB release, or a CHANGELOG commit without a corresponding GitHub Release (commit-before-publish drift). Rollback: gh release delete <tag> --yes, git tag -d <tag>, git push origin :refs/tags/<tag>, re-tag after fixing the workflow.

References

• Origin: docs/brainstorms/2026-04-23-001-split-release-tags-requirements.md
• Plan: docs/plans/2026-04-23-001-refactor-split-release-tags-plan.md
• Hardening learning: docs/solutions/architecture/tag-triggered-release-workflow-hardening.md
• Code review artifact: .context/compound-engineering/ce-code-review/20260423-072851-f135194c/ — 4 safe_auto applied; P1 seed-tag retarget resolved during review; 2 P2 residuals tracked above

---