tools/release/forwardport-release-to-main/main.go:189

• The success message states "forwardport PR #%d closed" but the code doesn't explicitly close the PR - it only deletes the branch. While GitHub will automatically close a PR when its head branch is deleted, this might be confusing. Consider either: (1) explicitly closing the PR before deleting the branch to match the message, or (2) updating the message to be more accurate, e.g., "forwardport PR #%d will be auto-closed" or simply removing the "closed" reference.

	fmt.Printf("✅ Merged %s into main (forwardport PR #%d closed)\n", releaseBranch, draftPR.GetNumber())

tools/release/internal/github/client.go:390

• The context cancellation check using a select with default case may not respect the timeout promptly. The API call on line 387 happens after the context check, so if the context is cancelled between the check and the API call, the function will still make the API request. Consider checking ctx.Err() before making the API call, or use the context directly in the API call which should respect cancellation. Additionally, the fixed 20-second sleep intervals mean the function could wait up to 20 seconds past the timeout before detecting cancellation.

	for {
		select {
		case <-ctx.Done():
			return fmt.Errorf("waiting for check %q: %w", checkName, ctx.Err())
		default:
		}
		result, _, err := c.api.Checks.ListCheckRunsForRef(ctx, c.owner, c.repo, ref, opts)
		if err != nil {
			return fmt.Errorf("listing check runs for ref %s: %w", ref, err)
		}

tools/release/forwardport-release-to-main/main.go:102

• If a previous forwardport run failed or was interrupted after pushing the branch but before cleanup, the forwardport branch (e.g., forwardport/v1.15) will already exist on the remote. When this workflow runs again, CreateBranchFrom will fail because git checkout -b cannot create a branch that already exists. Consider either: (1) checking if the branch exists and deleting it first, or (2) using git checkout -B (force create) instead of -b, or (3) adding error handling that suggests manual cleanup.

	fmt.Printf("📌 Creating branch %s from main...\n", forwardportBranch)
	if err := git.CreateBranchFrom(forwardportBranch, "main"); err != nil {
		log.Fatalf("Failed to create branch %s: %v", forwardportBranch, err)
	}

tools/release/forwardport-release-to-main/main.go:170

• The error message "Zizmor did not pass in time or failed" could be more specific. The underlying error from WaitForCheckRun already contains useful details (timeout, wrong conclusion, API errors), but this wrapper message uses "or" ambiguously. Consider either: (1) removing the wrapper and using just the underlying error, or (2) making the message more specific, e.g., "Zizmor check failed or timed out".

		log.Fatalf("Zizmor did not pass in time or failed: %v", err)

tools/release/internal/github/client.go:411

• The check conclusion validation only accepts "success" but GitHub check runs can have other valid conclusions like "neutral" or "skipped" which might be acceptable in some workflows. If zizmor could legitimately return "neutral" or "skipped", this would cause the forwardport to fail unnecessarily. Consider whether other conclusions should be accepted, or at minimum, improve the error message to help diagnose why the check didn't succeed.

		conclusion := found.GetConclusion()
		if conclusion != "success" {
			return fmt.Errorf("check %q completed with conclusion %q (expected success)", checkName, conclusion)
		}