[rmcdaniel]

Review tier A: CI trust. It adds a contents: write job to the reviewed tag-dispatch binding.

server#972 adds a release job to native-release.yml. It creates the GitHub Release for the tag (title is the version; Latest only when the live registry latest alias names this release's index), under the rolling-alias lock. Like the four publishing jobs, it has:

• environment: dockerhub-native
• needs: [plan, publish, aliases]
• the exact github.ref == format('refs/tags/{0}', inputs.tag) predicate
• contents: write, packages: read

The central preflight refuses it today ("privileged workflow_dispatch job 'release' can run outside refs/heads/main"), because the binding lists only aliases, build-amd64, build-arm64 and publish.

Change

• qualification/policy.json: the server/native-release.yml binding's jobs adds release.
• tests/test_qualification_policy.py: the tag-dispatch fixture adds a release job with contents: write, and the admitted-jobs assertion includes it. The existing loosened-gate, wrong-environment, missing-plan, unlisted-job and other-workflow refusals now also cover it.

Checked

• 43 tests pass.
• validate --target server passes on server#972's head and fails on current server main: "missing policy-bound tag dispatch jobs ['release']".

Sequencing

The binding requires every listed job to be present. Once this merges, server main and every other server PR fail the preflight until server#972 merges, so the two must land together, the way #283 landed with server#957. Keep this draft until server#972 is cleared.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Withdrawn: Security and General decided not to widen the tag-dispatch binding. server#972 will move GitHub Release creation to a protected main-only phase instead.