From 2a4906cab79e2b042a53da8bfa666979415d8d71 Mon Sep 17 00:00:00 2001
From: Ari Sulistiono <ari.sulistiono@gmail.com>
Date: Sun, 18 Oct 2026 08:25:00 +0700
Subject: [PATCH 1/2] ci(release): guarded one-time stable v1.4.0 dispatch on
 reviewed release approval

---
 .../workflows/publish-v1.4.0-on-approval.yml  | 44 +++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 .github/workflows/publish-v1.4.0-on-approval.yml

diff --git a/.github/workflows/publish-v1.4.0-on-approval.yml b/.github/workflows/publish-v1.4.0-on-approval.yml
new file mode 100644
index 00000000..4d6bac80
--- /dev/null
+++ b/.github/workflows/publish-v1.4.0-on-approval.yml
@@ -0,0 +1,44 @@
+name: Approve public stable v1.4.0
+
+# One-time source-controlled approval. Ordinary commits cannot trigger a release.
+on:
+  push:
+    branches: [main]
+    paths:
+      - ".github/release/v1.4.0.approved"
+
+permissions:
+  actions: write
+  contents: read
+
+jobs:
+  dispatch_verified_release:
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main'
+    timeout-minutes: 5
+    steps:
+      - name: Confirm stable release has not already been published
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          if gh release view v1.4.0 --repo "$GH_REPO" >/dev/null 2>&1; then
+            echo "v1.4.0 already published; aborting duplicate dispatch."
+            exit 0
+          fi
+          echo "Verified v1.4.0 not yet published. Dispatching guarded Windows release."
+
+      - name: Dispatch Windows release workflow
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          gh workflow run release-package.yml --repo "$GH_REPO" --ref main \
+            -f version=1.4.0 \
+            -f publish_release=true \
+            -f prerelease=false \
+            -f draft=false \
+            -f release_notes_file=docs/RELEASE_NOTES_v1.4.0.md
+          echo "Dispatched publish_release=true, prerelease=false, draft=false."

From 6a5781a034ce5dd6907f0e5f77815aecf96f88fd Mon Sep 17 00:00:00 2001
From: Ari Sulistiono <ari.sulistiono@gmail.com>
Date: Sun, 18 Oct 2026 08:25:19 +0700
Subject: [PATCH 2/2] fix(ci): make one-time release dispatch idempotent when
 GitHub Release already exists

---
 .github/workflows/publish-v1.4.0-on-approval.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish-v1.4.0-on-approval.yml b/.github/workflows/publish-v1.4.0-on-approval.yml
index 4d6bac80..1f3b4413 100644
--- a/.github/workflows/publish-v1.4.0-on-approval.yml
+++ b/.github/workflows/publish-v1.4.0-on-approval.yml
@@ -18,18 +18,21 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Confirm stable release has not already been published
+        id: already_published
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
         run: |
           if gh release view v1.4.0 --repo "$GH_REPO" >/dev/null 2>&1; then
-            echo "v1.4.0 already published; aborting duplicate dispatch."
+            echo "already=yes" >> "$GITHUB_OUTPUT"
+            echo "v1.4.0 already published; skipping duplicate dispatch."
             exit 0
           fi
           echo "Verified v1.4.0 not yet published. Dispatching guarded Windows release."
 
       - name: Dispatch Windows release workflow
+        if: steps.already_published.outputs.already != 'yes'
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}