Harden release workflow review fixes

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: MariusStorhaug

.github/actions/Get-PSModuleSettings/src/main.ps1

@@ -268,6 +268,9 @@ LogGroup 'Calculate Job Run Conditions:' {
         -not [string]::IsNullOrWhiteSpace($pullRequest.merged_at)
     }
     $pullRequestIsClosed = $null -ne $pullRequest -and $pullRequest.State -eq 'closed'
+    $isOpenOrUpdatedPR = $eventName -eq 'pull_request' -and
+        -not $pullRequestIsClosed -and
+        $pullRequestAction -in @('opened', 'reopened', 'synchronize', 'labeled', 'unlabeled')
     $targetBranch = if ($pullRequest) { $pullRequest.Base.Ref } elseif ($isPush) { $pushBranch } else { $workflowRef }
     $isTargetDefaultBranch = $targetBranch -eq $defaultBranch
     $pullRequestContext = if ($pullRequest) {

.github/actions/Release-PSModule/src/release.ps1

@@ -40,10 +40,6 @@
     'PSUseDeclaredVarsMoreThanAssignments', 'commitSha',
     Justification = 'Variable is used in script blocks.'
 )]
-[Diagnostics.CodeAnalysis.SuppressMessageAttribute(
-    'PSUseDeclaredVarsMoreThanAssignments', 'commitMessage',
-    Justification = 'Variable is used in script blocks.'
-)]
 [Diagnostics.CodeAnalysis.SuppressMessageAttribute(
     'PSUseDeclaredVarsMoreThanAssignments', 'releaseType',
     Justification = 'Variable is used in script blocks.'
@@ -112,6 +108,12 @@ LogGroup 'Load release context' {
     $prNumber = $pullRequest.Number
     $prHeadRef = $pullRequest.HeadRef
     $commitMessage = $githubEvent.head_commit.message
+    if ([string]::IsNullOrWhiteSpace($commitMessage) -and -not [string]::IsNullOrWhiteSpace($commitSha)) {
+        $commitMessage = git log -1 --format=%B $commitSha
+        if ($LASTEXITCODE -ne 0) {
+            throw "Failed to read commit message for [$commitSha]."
+        }
+    }
 
     if ($prNumber) {
         Write-Host "Pull request: [#$prNumber]"

.github/actions/Release-PSModule/tests/Release-PSModule.WhatIf.Tests.ps1

@@ -36,6 +36,7 @@ AfterAll {
         [System.Environment]::SetEnvironmentVariable($name, $script:originalEnvironment[$name])
     }
     Remove-Item -Path function:global:gh -ErrorAction SilentlyContinue
+    Remove-Item -Path function:global:git -ErrorAction SilentlyContinue
 }
 
 Describe 'Release-PSModule WhatIf' {
@@ -140,4 +141,20 @@ Describe 'Release-PSModule WhatIf' {
         Get-Content -Path $script:githubOutputPath | Should -Contain 'ReleaseTag=v1.2.3'
         $releaseOutput | Should -Match '--target pushed-commit-sha'
     }
+
+    It 'uses the checked-out commit message for a manual dispatch' {
+        $manifest = Get-Content -Path $manifestPath -Raw
+        $manifest -replace "Prerelease = 'preview.1'", "Prerelease = ''" | Set-Content -Path $manifestPath
+        @{} | ConvertTo-Json | Set-Content -Path $eventPath
+        $env:PSMODULE_RELEASE_PSMODULE_INPUT_ReleaseTag = 'v1.2.3'
+        $env:PSMODULE_RELEASE_PSMODULE_INPUT_CommitSha = 'dispatched-commit-sha'
+        Set-Item -Path function:global:git -Value {
+            $global:LASTEXITCODE = 0
+            'Publish manual dispatch release'
+        }
+
+        $releaseOutput = & $script:releaseScriptPath 6>&1 | Out-String
+
+        $releaseOutput | Should -Match 'Using the pushed commit message as release notes'
+    }
 }

.github/workflows/workflow.yml

@@ -76,7 +76,7 @@ permissions:
   id-token: write # to verify the deployment originates from an appropriate source
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  group: Process-PSModule-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: false
 
 jobs:

docs/content/guides/calling-the-workflow.md

@@ -64,6 +64,8 @@ Keep the `pull_request` trigger for CI, prereleases, and prerelease cleanup.
 The concurrency key keeps a pull request distinct from a default-branch push, so the close-event cleanup and the
 resulting stable release do not serialize as one run. Keep `cancel-in-progress: false`: a release-capable run mutates
 the PowerShell Gallery, GitHub Releases, and tags, so later runs must queue rather than interrupt it.
+The reusable workflow uses its own prefixed concurrency group, so it cannot queue behind the caller while the caller
+waits for it to finish.
 
 ## Passing test data
 

docs/content/guides/versioning-and-releases.md

@@ -45,8 +45,10 @@ The label names are configurable through `Publish.Module.MajorLabels`, `MinorLab
 ## Branch types
 
 - **Main (stable)** — pushes publish stable releases. A prerelease label on an open pull request publishes a prerelease.
-- **Development** — optional prerelease branch (for example `dev`). Each push publishes a prerelease.
-- **Feature branch** — optional feature branch. A prerelease label publishes a prerelease for testing.
+- **Development** — optional prerelease branch (for example `dev`). Its open, prerelease-labelled pull request to the
+  stable branch publishes previews when it is updated.
+- **Feature branch** — optional feature branch. Its open, prerelease-labelled pull request publishes a preview for
+  testing.
 
 Exactly one branch is authorized to publish stable releases, so consumers always have one unambiguous latest version.