fix(ci): restore the workflow_dispatch re-run path in the release pipeline

.github/workflows/release.yml

@@ -426,12 +426,13 @@ jobs:
     name: Publish to PyPI
     runs-on: ubuntu-latest
     needs: [validate-release, quality-gates, security-scan, build-package, generate-changelog]
-    # Only ever upload from a tag push. A manual `workflow_dispatch` run is a
-    # dry run of build + quality gates: PyPI rejects re-uploading an existing
-    # version, so a dispatch that reached this job would always fail.
-    if: |
-      startsWith(github.ref, 'refs/tags/')
-      && needs.validate-release.outputs.is-prerelease == 'false'
+    # `workflow_dispatch` takes a required `tag` input and every job checks that
+    # tag out, so a dispatch is a re-run of the pipeline for an existing tag --
+    # not a dry run. Guarding on `github.ref` would therefore always be false on
+    # a dispatch (it is `refs/heads/main`) and silently skip the upload.
+    # A duplicate upload is already prevented by the "Check if tag already
+    # exists in releases" step in `validate-release`.
+    if: needs.validate-release.outputs.is-prerelease == 'false'
     environment: pypi
     # No API tokens: authentication happens via short-lived OIDC credentials.
     permissions:
@@ -471,11 +472,8 @@ jobs:
     needs: [validate-release, build-package, generate-changelog, publish]
     # `always()` so prereleases (where `publish` is skipped) still get a GitHub
     # release, but never when a required upstream job actually failed.
-    # Tag-only for the same reason as `publish`: a manual dispatch must not try
-    # to create a release for a ref that is not a tag.
     if: |
       always()
-      && startsWith(github.ref, 'refs/tags/')
       && needs.validate-release.result == 'success'
       && needs.build-package.result == 'success'
       && needs.generate-changelog.result == 'success'
@@ -597,9 +595,9 @@ jobs:
     name: Post-Release Validation
     runs-on: ubuntu-latest
     needs: [validate-release, create-github-release, publish, update-docs]
-    # Tag-only: on a manual dispatch there is no release to validate, so this
-    # would always fail with "GitHub release missing".
-    if: always() && startsWith(github.ref, 'refs/tags/')
+    # Runs for dispatch re-runs too: `validate-release` resolves the tag from the
+    # required `tag` input, so there is always a release to validate.
+    if: always()
     steps:
       - name: Validate release completion
         run: |

CHANGELOG.md

@@ -8,6 +8,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Fixed
+- Release workflow: `publish`, `create-github-release` and `post-release-validation` no
+  longer require `github.ref` to be a tag. `workflow_dispatch` takes a required `tag`
+  input and every job checks that tag out, so a dispatch is a re-run of the pipeline for
+  an existing tag; on a dispatch `github.ref` is `refs/heads/main`, so the guard was
+  always false and silently skipped the upload while the run still reported success.
+  Duplicate uploads remain prevented by the existing "Check if tag already exists in
+  releases" step in `validate-release`.
 - CI: removed the `paths:` filter from the `pull_request` trigger of `ci-gates.yml` and
   `fast-tests.yml`. These workflows provide the required status checks `Unit Tests &
   Coverage`, `Integration Smoke Tests` and `Quick Security Scan`; with a path filter they