feat(release): the dev build is one pre-release on a moving tag; triage knows current versions

[soydiloreto]

📝 What changes

• plugin-release-wp.yml, job Development build: instead of an artifact, publishes the build as one GitHub pre-release named Development build <next>-dev.<N> on the moving tag dev-tag (new input, default dev; empty publishes none). Each push to the default branch (only there): zips the stamped tree under the slug; if the commit is still the head of the branch, creates the pre-release when missing, uploads <slug>.zip with --clobber, edits title and notes (the version, a link to the commit, install steps and the changelog under Unreleased.), and moves the tag to the commit last, so a failed upload leaves the previous build whole and a re-run of an old run never moves the tag back. …/releases/download/dev/<slug>.zip is a fixed URL. In a rehearsal (dry-run: true) the build is made and its notes go to the summary, but nothing is published: no tag, no release. The job needs contents: write and a concurrency group. upload-artifact goes; the dev output's description follows.
• issue-triage.yml: new input dev-tag (default dev). The brief gains "Current versions" (the readme's Stable tag; the pre-release's version when one exists). The needs_info category now also covers a report made on a plugin version older than the released one or a development build older than the current one; the reply asks to update, or to install the current development build (link), and to say whether the problem is still there. Header comment updated.
• README (release row and inputs; triage row; adoption step 3: the tag rulesets cover X.Y.Z only so dev stays free), workflow-templates/release-wp.yml header, CONTRIBUTING.md ("How a change becomes a version": the pre-release, no history), docs/plans/release-automation.md (the artifact is gone).

💡 Why

The maintainer wants development builds where people look for downloads, in Releases, the way WooCommerce publishes its nightly: one pre-release that is always the latest, with a link that never changes and no login to download, while X.Y.Z releases and their history stay exactly as they are. One tag per build was rejected: it multiplies permanent tags, needs the publishing App's key on every push and leaves a trail nobody asked for. With no history of development builds, a bug reported on an old one must be checked against the current one; the triage now knows which versions are current and asks for that, which also catches the common report from a site that never updated.

🧪 How I tested it

• actionlint 1.7.12 on every workflow.
• The notes extraction (awk) against Offload's real readme.txt: the bullets under Unreleased., without that line and without a leading blank line.
• Live test: Offload's next push to main after adopting this version must create the pre-release Development build 2.0.0-dev.N on tag dev with diluxone-offload.zip, and a later push must replace it (same URL, tag moved).

🤖 AI-generated · Claude Fable 5.1 (Anthropic)

[dilux-bot]

Claude review · risk high · complexity medium · type feat

The new commits fix the major finding and three minor ones. dry-run now skips the publish step and writes the notes to the summary, the dev output's description is correct, the job runs only on the default branch, the plan no longer mentions an artifact, and publishing is reordered: check the branch head, create the release if missing, upload with --clobber, edit, then move the tag. A re-run of an old run no longer moves the tag back, and a failed upload leaves the previous build whole.

Two minor points are still open. If gh release edit fails after the upload, the new zip is live under the old title and notes; the next push repairs it. It is still unverified that GITHUB_TOKEN may move dev: the README now says the adoption guide's tag rulesets cover X.Y.Z only, but an existing organisation ruleset covering all tags would block it, and Offload's live run would settle that.

The PR as a whole adds behaviour: a public moving pre-release and version-aware triage. The description now matches the diff.

• minor .github/workflows/plugin-release-wp.yml:320: Upload runs before gh release edit: if the edit fails, the new zip is live under the old title and notes until the next push
• minor .github/workflows/plugin-release-wp.yml:322: Unverified: moving dev with GITHUB_TOKEN assumes no existing org or repo tag ruleset covers all tags; Offload's live run would settle it

_{Policy floor: high (touches high-risk paths: .github/workflows/issue-triage.yml, .github/workflows/plugin-release-wp.yml, CONTRIBUTING.md, README.md, docs/plans/release-automation.md …). Reviewed 8493872 (since c3bb920; review 2 of 5 automatic). Author trusted for auto-merge: true.}

_{🤖 AI review · claude-opus-5-5 (Anthropic) · $0.14, 4 turns}