ci: stopgap — switch release workflow to workflow_dispatch only

.github/workflows/release.yml

@@ -1,17 +1,26 @@
 # Hand-written (not auto-generated) — see Build.CI.GitHubActions.cs for the
 # rationale (lets us bridge GitHub's NUGET_API_KEY secret to Fallout's
 # NuGetApiKey parameter, which would otherwise have to share a name).
+#
+# STOPGAP (2026-05-29, #267 / milestone #13):
+# Trigger is workflow_dispatch only — auto-publish on push to main has been
+# disabled because it was firing a Fallout.* release on every merge
+# (Dependabot noise across the userbase: ~20 patch versions in recent days
+# for what was mostly internal cleanup). The proper shape — tag-triggered
+# publishes on `release/vN` branches with multi-channel GitHub Environments —
+# is being implemented under milestone #13 (RFC #267). Until that lands,
+# releases happen manually: navigate to Actions → release → "Run workflow"
+# on the desired ref (main for now; `release/v11` once cut).
 
 name: release
 
 on:
-  push:
-    branches:
-      - main
-    paths-ignore:
-      - 'docs/**'
-      - '.assets/**'
-      - '**/*.md'
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Ref to release from (defaults to current branch; will be release/v11 once cut per #267)'
+        required: false
+        default: 'main'
 
 permissions:
   contents: write     # for ICreateGitHubRelease (tag + GitHub release)

CHANGELOG.md

@@ -82,6 +82,8 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 - **Added "Default to backwards compatibility" rule to the AGENTS.md AI brief** (#262). Critical rules now state the principle explicitly — prefer additive over breaking changes; `[Obsolete]`, transition shims, and overload-based extension before a hard break. The existing breaking-change PR-creation flow (label + `⚠️` callout + `version.json` bump + CHANGELOG entry with migration path) remains the mechanics for when a break is unavoidable. Issue [#262](https://github.com/ChrisonSimtian/Fallout/issues/262) stays open for the broader policy discussion (LTS stance for the `Nuke.*` shims, what qualifies as "backwards compatible" for on-disk formats and CI workflow generators, when transition-shim generators are the right answer, etc.).
 
+- **Disabled auto-release on every push to `main`** (stopgap for milestone [#13](https://github.com/ChrisonSimtian/Fallout/milestone/13) / RFC [#267](https://github.com/ChrisonSimtian/Fallout/issues/267)). The `release` workflow now triggers on `workflow_dispatch` only — releases are explicit, run manually from Actions UI. Auto-publishing was firing a Fallout.* release on every merge (≈20 patch versions accumulated in recent days for what was mostly internal cleanup), generating Dependabot upgrade PRs across every downstream consumer. The proper restructure — tag-triggered publishes on `release/vN` branches with three GitHub Environments (`nuget-org` / `github-packages` / `github-releases`) — is being implemented under milestone #13. This stopgap stops the consumer-facing noise immediately while that lands.
+
 ## [10.2.0] / 2026-05-21
 The NUKE → Fallout hard fork. Originally NUKE by [@matkoch](https://github.com/matkoch) and contributors; under new maintenance and rebranded to Fallout.