chore: clean up content phase organization

.github/workflows/close-solved.yml

@@ -7,7 +7,7 @@ on:
   workflow_dispatch:
     inputs:
       dry_run:
-        description: Report matches without closing anything
+        description: Report matches and would-be releases without closing or releasing anything
         type: boolean
         default: false
 
@@ -61,3 +61,39 @@ jobs:
             exit 0
           fi
           bun apps/cli/sync-project-fields.ts
+
+  # One timever release per finished topic (every core sub-issue closed),
+  # tagged at the instant the last core problem closed. It reads the same rule
+  # close-topics uses (apps/cli/topics.ts) straight off the sub-issues, so the
+  # push that finishes a topic releases it in this run — no waiting for Close
+  # Topics, which chains after this workflow. Reconciling: a run releases
+  # every finished topic still missing one, so a manual dispatch backfills and
+  # a problem closed by hand in the UI is picked up by the next run.
+  release:
+    needs: close
+    # Like close-topics: a partially failed close still closed some issues,
+    # and the script only reads state, so run unless the run was cancelled.
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # push tags, create releases
+      issues: read
+    steps:
+      # Full history: each tag targets the last main commit before its topic
+      # finished, and backfilled tags reach far behind HEAD.
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: oven-sh/setup-bun@v2
+
+      # The tagger of the annotated, backdated tags.
+      - run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      # No install step: the script only uses Bun builtins + fetch.
+      - run: bun apps/cli/release-topics.ts
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DRY_RUN: ${{ inputs.dry_run }}

.github/workflows/deploy.yml

@@ -30,7 +30,13 @@ jobs:
       - uses: oven-sh/setup-bun@v2 # skip if you use npm/pnpm
 
       - run: bun install --frozen-lockfile
+      # blume.config.ts pulls the /changelog pages from this repo's GitHub
+      # releases (githubReleases source) at build time. The token authenticates
+      # that fetch — required if the repo is private, and it lifts the shared
+      # runner's unauthenticated API rate limit. `contents: read` covers it.
       - run: bun run build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - uses: actions/upload-pages-artifact@v3
         with: