[efraespada]

Release and hotfix publication callbacks now receive the live merge-queue attestation policy used by preparation and resume. This keeps reconciliation policy consistent across publication paths and preserves target-specific readiness checks.

What changed

• Forward the live MERGE_QUEUE_CHECK_ATTESTATIONS value, with an [] fallback, from consumer and source release and hotfix workflows during publication callbacks.
• Require live attestation inputs on preparation, publication, and resume entrypoints through structural workflow validation.
• Clarify the live-policy behavior in deployment orchestration documentation and the merge-queue readiness specification.
• Add 24 structural regression cases covering missing or stale attestation inputs across source and consumer workflows.

Validation

• 295 workflow-contract tests; typecheck; workflow, specification, and documentation validators; git diff --check; and AST-only graphify update . passed.
• No release or deployment was launched.

Closes #643

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/copilot~649

Documentation is deployed and generated using docs.page

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.11%. Comparing base (274db40) to head (1285e4a).
⚠️ Report is 1576 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #649      +/-   ##
===========================================
+ Coverage    90.94%   94.11%   +3.16%     
===========================================
  Files          135      950     +815     
  Lines         6251    30588   +24337     
  Branches      1338     8980    +7642     
===========================================
+ Hits          5685    28788   +23103     
- Misses         172      704     +532     
- Partials       394     1096     +702     

see 1017 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[vypbot]

Bugbot: review complete

Current status: No active findings on 1285e4a.

Pull request · Verified commit · Workflow run

[vypbot]

Copilot approval · Human review needed

Status: A protected workflow, policy, or trust-boundary file changed.
Completed: 1/1 observed checks succeeded; Bugbot complete.
Action required: Ask a human reviewer to decide.
Impact: No new approval is confirmed for this revision.
See checks

Technical evidence

Revision: 1285e4a5d682; base: 6c3e5a7ba3d4; reason: protected-path.