Overview

Replace the single node-only boolean in the release workflow with three independent skip flags (skip-node, skip-toolkit, skip-runtime) so any combination of components can be released independently.

Key changes

• Separate versioning: Toolkit images are tagged with the toolkit version from util/toolkit/Cargo.toml; runtime releases use spec_version from runtime/src/lib.rs (e.g. 001_000_000 → 1.0.0)
• Dynamic git tags: Concatenated from included components with suffix at the end (e.g. node-1.0.0-toolkit-1.0.0-runtime-1.0.0-rc.1)
• Per-component release notes: changes/ restructured into node/, toolkit/, and runtime/ subdirectories; skipped component dirs are removed before season build so only relevant sections render
• Per-component archiving: archive-changes and reset-changes run once per included component instead of a single call
• Per-component version bump: "Bump components version on main" now bumps node (Cargo.toml), toolkit (Cargo.toml), and runtime (spec_version) independently based on skip flags
• Release notes header: Root index.md renders Git tag + Components section with icons (📦 Node, 🧰 Toolkit, ⚙️ Runtime); component sections include Docker Images where applicable
• Security fix: ${{ inputs.* }} expressions moved from run: blocks to env: to prevent shell injection

🗹 TODO before merging

• Ready

📌 Submission Checklist

• Changes are backward-compatible (or flagged if breaking)
• Pull request description explains why the change is needed
• Self-reviewed the diff
• I have included a change file, or skipped for this reason: change only affects CI/release workflow
• If the changes introduce a new feature, I have bumped the node minor version
• Update documentation (if relevant)
• Updated AGENTS.md if build commands, architecture, or workflows changed
• No new todos introduced

🧪 Testing Evidence

• YAML validated with python3 -c "import yaml; yaml.safe_load(open(...))" — passes
• Manually traced all 7 release scenarios through the workflow:
  • Full release (default): all jobs run, node uses node version, toolkit uses toolkit version
  • Toolkit-only (skip-node + skip-runtime): only toolkit image/SBOM/asset jobs run, git tag = toolkit-X.Y.Z, release notes from changes/toolkit/
  • Node-only (skip-toolkit + skip-runtime): only node image/SBOM/asset jobs run
  • Runtime-only (skip-node + skip-toolkit): only srtool WASM build runs, no archive PR
  • All-three-skipped: rejected by validate-inputs job
• Verified !cancelled() && !failure() pattern correctly allows downstream jobs when upstream SBOM jobs are skipped
• Verified inputs.skip-X != true (step-level) vs github.event.inputs.skip-X != 'true' (job-level for reusable workflows) context rules

Please describe any additional testing aside from CI:

• Additional tests are provided (if possible)

🔱 Fork Strategy

• Node Runtime Update
• Node Client Update
• Other: CI/release workflow only — no runtime or client changes
• N/A

Links

• Depends on season v0.6.0 (--changes-dir and --changes-template-dir flags)
• Builds on top of ci: update season version #1131 (season-action removal)