[ziadantar90]

What this adds

The public results page and the Tests badge can't go stale between releases any more.

• New .github/workflows/release.yml. It runs when a GitHub release is published, or by hand for a tag. It checks out the tag, runs scripts/trust-report.sh there, and then runs scripts/trust-report.sh --check-release <tag>. That check fails the job unless the page is the run at that tag: the tag's own commit, the release named as the tag, and a clean tree. When the check passes, the workflow opens a PR "Test results page for vX.Y.Z" with only the page files, on top of main. The job is also red when the report itself found a problem. In that case the PR still opens, so the page shows the problem.
• Why after the tag. Release PRs are squash-merged, so a page made on the release branch tests a commit that is never in the tag. The page on main today tests 98324c8, which is not in v0.15.0. The check reports exactly that.
• Fix: every run looked dirty. trust-report.sh deleted its tracked docs/trust/logs/ before reading git status, so every run, the weekly ones included, was marked "working tree had uncommitted changes". The logs are now cleared after the tree is read.
• TRUST_TAG names the release when the tagged commit carries more than one tag.
• The badge and the site's results strip show what was tested. The badge reads "all checks pass · v0.16.0 a1b2c3d · 2026-11-05", and the site strip reads "tested v0.16.0 (a1b2c3d) on …"; the release reads "v0.16.0+" after later commits. The README says the page is regenerated at each tag.
• CONTRIBUTING § Releases gains step 3: merge the results-page PR, what a red run means, and the repo setting the workflow needs.
• tests/trust-report-test.sh covers the new behaviour. It checks the badge text, and runs --check-release against a throwaway repo: an older commit, a commit outside the tag, a "+ later commits" page, a dirty run and a missing tag are all refused. It also does a real faked run at a tag with two lightweight tags, which passes the check.

Checks: tests/trust-report-test.sh passes. Each new case fails when its rule is removed (moving the log cleanup back, ignoring TRUST_TAG, dropping the ancestry and dirty checks). STRICT=1 scripts/kit-selftest.sh passes. An independent review found the dirty-tree bug, a silent gh pr create failure and the shared concurrency group; all three are fixed.

---

Generated by Claude Code