ci(release): fix dry-run and add CI status gate

- Replace sponge with temp file in dry-run (moreutils not on CI runners)
- Use git worktree add -b for proper branch creation
- Make cleanup resilient to missing branch
- Verify HEAD passed CI before running scheduled release
- Remove moreutils from devshell (no longer needed)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: cpcloud

.github/workflows/scheduled-release.yml

@@ -34,6 +34,18 @@ jobs:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
 
+      - name: Verify HEAD passed CI
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          sha=$(git rev-parse HEAD)
+          conclusion=$(gh api "repos/${{ github.repository }}/commits/$sha/check-runs" \
+            --jq '.check_runs[] | select(.name == "CI Result") | .conclusion')
+          if [ "$conclusion" != "success" ]; then
+            echo "::error::HEAD ($sha) CI Result is '$conclusion', expected 'success'. Aborting release."
+            exit 1
+          fi
+
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: lts/*

ci/release/dry-run.bash

@@ -9,26 +9,30 @@ set -euo pipefail
 
 curdir="$PWD"
 worktree="$(mktemp -d)"
-branch="$(basename "$worktree")"
+branch="semantic-release-dry-run-$(basename "$worktree")"
 
-git worktree add "$worktree"
+git worktree add -b "$branch" "$worktree" HEAD
 
 cleanup() {
   cd "$curdir"
   git worktree remove --force "$worktree"
   git worktree prune
-  git branch -D "$branch"
+  if git show-ref --verify --quiet "refs/heads/$branch"; then
+    git branch -D "$branch"
+  fi
 }
 trap cleanup EXIT
 
 cd "$worktree"
 
 # Strip @semantic-release/github so the dry-run makes no API calls
+tmp=$(mktemp)
 jq '.plugins |= map(select(
   if type == "array" then .[0] != "@semantic-release/github"
   else . != "@semantic-release/github"
   end
-))' .releaserc.json | sponge .releaserc.json
+))' .releaserc.json > "$tmp"
+mv "$tmp" .releaserc.json
 
 git add .releaserc.json
 git commit -m "test: semantic-release dry run" --no-verify --no-gpg-sign

flake.nix

@@ -416,7 +416,6 @@
               pkgs.goreleaser
               pkgs.nodejs
               pkgs.jq
-              pkgs.moreutils
               pkgs.glow
               relnotes
             ]