Cut Release Tag

Use the release scripts for normal release operations. Do not run raw git tag, git push, gh api, or version-bump commands by hand for the normal release flow.

The release is one signed annotated semver tag on an already-merged origin/main commit. The GitHub workflow requires that tag to be GitHub-Verified, points latest at the exact verified tag object, carries remaining open issues/PRs to the next patch label, and deletes the released label while holding the shared release-label coordination queue; release admins promote lkg manually after validation. After the workflow is verified, draft release notes, then verify the maintainer-published Announcement before final handoff.

LKG Production Image Dispatch

When a release admin creates or moves lkg to a commit carrying a vX.Y.Z tag, the Release / LKG Brev Image workflow dispatches the Release Production Image workflow in brevdev/nemoclaw-image on its main branch. The dispatch passes the immutable semver tag instead of the mutable lkg tag. The source workflow requires the NEMOCLAW_IMAGE_DISPATCH_TOKEN Actions secret with Actions read/write access to brevdev/nemoclaw-image; a missing secret fails before the API request, and the workflow summary never includes its value. The trigger summary records the selected release tag, full commit SHA, target workflow, dispatch result, downstream run ID, and a direct link to the downstream run. After lkg promotion, find and wait for the source trigger run using the promoted commit: