ci: cut releases from a tag, with notes from CHANGELOG.md (#717)

Port of #715 and #716 to 2.x. Releases here were published by hand, so
the notes every install is offered were written at that moment rather
than reviewed with the change — 2.4.2's were composed at the point of
release, and nothing checked they existed or matched what shipped.

Tagging is now all that is required. release.yaml reads the CHANGELOG.md
section for the tag, builds via `make clean dist`, creates the release as
a draft with the package already attached, and publishes it as a separate
step. `release: published` therefore fires only once the tests have
passed and the asset is in place, so a failed run leaves no release at
all rather than a published one nobody can download — which is what
2.4.2 left behind. A tag with no section fails before anything is
published, and before any dependency is installed.

Because the asset is attached at publication, docker.yaml no longer needs
to build it: release_artifact_build is gone, and register_release loses
both that dependency and the always() dance it needed to survive the job
being skipped on a manual dispatch.

GitHub's "Latest release" pointer is gated on LATEST_MAJOR, the same
expression docker.yaml uses for its moving image tags.

The workflow is identical to 3.x's but for comments. tests.yaml carries
this branch's own test definition — xdebug coverage and a frontend build,
where 3.x runs in parallel and splits out module tests.

.github/workflows/docker.yaml

@@ -46,100 +46,7 @@ jobs:
     if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
     needs:
       - php_syntax_errors
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        php-version:
-          - 8.4
-    env:
-      extensions: bcmath, curl, dom, gd, imagick, json, libxml, mbstring, pcntl, pdo, pdo_mysql, zip
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Setup PHP Action
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php-version }}
-          extensions: ${{ env.extensions }}
-          coverage: xdebug
-          tools: pecl, composer
-
-      - name: Install Composer dependencies
-        uses: ramsey/composer-install@4.0.0
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v6
-
-      - name: Use Node.js 24
-        uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          cache: pnpm
-
-      - name: Install
-        run: pnpm install --frozen-lockfile
-
-      - name: Compile Front-end
-        run: pnpm build
-
-      - name: Apply tests ${{ matrix.php-version }}
-        run: php artisan test
-
-  release_artifact_build:
-    name: 🏗️ Build / Upload - Release File
-    if: github.event_name == 'release'
-    needs:
-      - tests
-    runs-on: ubuntu-latest
-    env:
-      extensions: bcmath, curl, dom, gd, imagick, json, libxml, mbstring, pcntl, pdo, pdo_mysql, zip
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: 8.4
-          extensions: ${{ env.extensions }}
-          coverage: none
-
-      - name: Install Composer dependencies
-        uses: ramsey/composer-install@4.0.0
-        with:
-          composer-options: --no-dev
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v6
-
-      - name: Use Node.js 24
-        uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          cache: pnpm
-
-      - name: Install
-        run: pnpm install --frozen-lockfile
-
-      - name: Compile Front-end
-        run: pnpm build
-
-      - name: Build Dist
-        run: |
-          make clean dist
-
-      - name: Upload package
-        uses: svenstaro/upload-release-action@v2
-        with:
-          repo_token: ${{ github.token }}
-          file: InvoiceShelf.zip
-          asset_name: InvoiceShelf.zip
-          tag: ${{ github.ref }}
-          overwrite: true
-
+    uses: ./.github/workflows/tests.yaml
 
   # Registration lives in its own job, and fetches the published asset rather than
   # reusing the build job's working directory. That decoupling is deliberate: the
@@ -151,14 +58,13 @@ jobs:
   # injection from the release body.
   register_release:
     name: 📡 Register release on the updater
-    # always() is required because release_artifact_build is skipped on a manual
-    # dispatch, and a job needing a skipped job is skipped too.
+    # release.yaml attaches the package before publishing, so by the time this
+    # runs the asset is already there and no build dependency is needed. That also
+    # retires the always() dance this condition previously required to survive a
+    # skipped build job on a manual dispatch.
     if: >-
-      always() &&
-      ((github.event_name == 'release' && needs.release_artifact_build.result == 'success') ||
-       (github.event_name == 'workflow_dispatch' && inputs.register_tag != ''))
-    needs:
-      - release_artifact_build
+      github.event_name == 'release' ||
+      (github.event_name == 'workflow_dispatch' && inputs.register_tag != '')
     runs-on: ubuntu-latest
 
     steps: