ci: add testnet release orchestrator

.github/actions/dispatch-and-wait/action.yml

@@ -0,0 +1,67 @@
+name: dispatch-and-wait
+description: Dispatch a workflow_dispatch workflow in another repo and wait for it to complete.
+inputs:
+  repo:
+    description: 'owner/repo to dispatch in'
+    required: true
+  workflow:
+    description: 'Workflow file name (e.g. deploy-core.testnet.yml). Must accept a correlation_id input surfaced in its run-name.'
+    required: true
+  ref:
+    description: 'Git ref to run the workflow from'
+    required: false
+    default: 'main'
+  fields:
+    description: 'Extra inputs, one key=value per line'
+    required: false
+    default: ''
+  token:
+    description: 'Token with actions:write on the target repo'
+    required: true
+  slack-webhook:
+    description: >-
+      Optional Slack webhook. When set, posts a link to the dispatched run before
+      watching it, so a run gated on a required-reviewer environment in the target
+      repo gets approved instead of stalling unnoticed.
+    required: false
+    default: ''
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        REPO: ${{ inputs.repo }}
+        WORKFLOW: ${{ inputs.workflow }}
+        REF: ${{ inputs.ref }}
+        FIELDS: ${{ inputs.fields }}
+        SLACK_WEBHOOK: ${{ inputs.slack-webhook }}
+      run: |
+        set -euo pipefail
+        CID="cid-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}-${RANDOM}"
+        ARGS=(-f "correlation_id=$CID")
+        while IFS= read -r kv; do
+          [ -n "$kv" ] && ARGS+=(-f "$kv")
+        done <<< "$FIELDS"
+        echo "Dispatching $WORKFLOW in $REPO with correlation id $CID"
+        gh workflow run "$WORKFLOW" -R "$REPO" --ref "$REF" "${ARGS[@]}"
+        RUN_ID=""
+        for _ in $(seq 1 30); do
+          sleep 10
+          RUN_ID=$(gh run list -R "$REPO" --workflow "$WORKFLOW" --limit 20 \
+            --json databaseId,displayTitle \
+            --jq "[.[] | select(.displayTitle | contains(\"$CID\"))][0].databaseId // empty")
+          [ -n "$RUN_ID" ] && break
+        done
+        if [ -z "$RUN_ID" ]; then
+          echo "::error::could not find dispatched run for correlation id $CID in $REPO/$WORKFLOW"
+          exit 1
+        fi
+        RUN_URL="https://github.com/$REPO/actions/runs/$RUN_ID"
+        if [ -n "$SLACK_WEBHOOK" ]; then
+          PAYLOAD=$(jq -n --arg text "$WORKFLOW run in $REPO may need environment approval: $RUN_URL" '{text: $text}')
+          curl -sf -X POST -H 'Content-type: application/json' --data "$PAYLOAD" "$SLACK_WEBHOOK" \
+            || echo "::warning::failed to post Slack approval ping for $RUN_URL"
+        fi
+        echo "Watching $RUN_URL"
+        gh run watch "$RUN_ID" -R "$REPO" --exit-status --interval 30

.github/workflows/release.testnet.push.tags.yml

@@ -11,6 +11,11 @@ on:
         description: 'The component to tag'
         required: true
         type: string
+      skip_existing:
+        description: 'Succeed without re-tagging if the tag already exists (for orchestrator re-runs)'
+        required: false
+        type: boolean
+        default: false
     secrets:
       DOUBLEZERO_PAT:
         description: 'PAT to push tags to the repository'
@@ -44,6 +49,10 @@ jobs:
           echo "Version format is valid."
 
           if git rev-parse -q --verify "refs/tags/$TAG_NAME"; then
+            if [ "${{ inputs.skip_existing }}" = "true" ]; then
+              echo "Tag '$TAG_NAME' already exists; skipping (skip_existing=true)."
+              exit 0
+            fi
             echo "Error: Tag '$TAG_NAME' already exists in the repository."
             exit 1
           fi