Fix release pipeline verification and latest release tagging

.github/workflows/build-and-release.yml

@@ -59,7 +59,7 @@ jobs:
         id: flags
         shell: bash
         run: |
-          if [[ "${GITHUB_REF:-}" == refs/tags/v* || "${GITHUB_EVENT_NAME:-}" == "workflow_dispatch" ]]; then
+          if [[ "${GITHUB_REF:-}" == refs/tags/v* || "${GITHUB_EVENT_NAME:-}" == "workflow_dispatch" || "${GITHUB_REF:-}" == "refs/heads/main" ]]; then
             echo "should_release=true" >> "$GITHUB_OUTPUT"
           else
             echo "should_release=false" >> "$GITHUB_OUTPUT"

docs/README_TESTING.md

@@ -8,13 +8,13 @@ Run unit and widget tests:
 flutter test
 ```
 
-Run golden tests:
+Run golden tests when the `test/golden` directory exists and contains golden test files:
 
 ```bash
 flutter test test/golden
 ```
 
-Run integration tests:
+Run integration tests when the `integration_test` directory exists and contains integration test files:
 
 ```bash
 flutter test integration_test
@@ -39,6 +39,8 @@ go test ./...
 
 ## CI Coverage
 
-- Pull requests in `xworkmate-app` run Flutter tests, golden tests, and integration tests.
+- Pull requests in `xworkmate-app` use the `verify` stage as a static-analysis gate and always run `flutter analyze`.
+- Widget, golden, integration, and Patrol suites are owned by their dedicated commands and release validation flows, not by the lightweight `verify` gate.
+- Pushes to `main`, version tags, and manual workflow runs publish build artifacts and update the GitHub Release entry for that release mode.
 - `xworkmate-bridge` Go tests run in the companion repository.
 - `release/*` branches run Patrol tests in addition to the PR chain.

scripts/ci/compute_release_metadata.sh

@@ -14,6 +14,10 @@ elif [[ "${GITHUB_EVENT_NAME:-}" == "workflow_dispatch" ]]; then
   release_tag="manual-${GITHUB_RUN_NUMBER:-0}"
   release_title="Manual Build ${GITHUB_RUN_NUMBER:-0}"
   release_notes="Automated manual build from ${GITHUB_SHA:-unknown}"
+elif [[ "${GITHUB_REF:-}" == "refs/heads/main" ]]; then
+  release_tag="latest"
+  release_title="Latest"
+  release_notes="Automated latest main build from ${GITHUB_SHA:-unknown}"
 else
   release_tag="main-${GITHUB_RUN_NUMBER:-0}"
   release_title="Main Build ${GITHUB_RUN_NUMBER:-0}"

scripts/ci/monitor_build_and_release.sh

@@ -41,6 +41,10 @@ expected_jobs = %w[prepare verify build release]
 missing_jobs = expected_jobs.reject { |job| data.fetch('jobs', {}).key?(job) }
 abort("Missing workflow jobs: #{missing_jobs.join(', ')}") unless missing_jobs.empty?
 
+prepare_job = data.fetch('jobs').fetch('prepare')
+prepare_text = prepare_job.fetch('steps', []).map { |step| step['run'] }.compact.join("\n")
+abort('prepare job must release from main.') unless prepare_text.include?('refs/heads/main')
+
 build_job = data.fetch('jobs').fetch('build')
 matrix = build_job.fetch('strategy', {}).fetch('matrix', {}).fetch('include', [])
 platforms = matrix.map { |entry| entry['platform'] }.compact.to_h { |platform| [platform, true] }.keys
@@ -50,10 +54,11 @@ abort("Missing build matrix platforms: #{missing_platforms.join(', ')}") unless
 
 text = File.read(workflow_path)
 required_snippets = [
-  'bash ./scripts/ci/run_code_analysis.sh',
+  'bash ./scripts/ci/run_flutter_ci_suite.sh',
   'bash ./scripts/ci/build_matrix_artifacts.sh',
   'bash ./scripts/ci/setup_platform_deps.sh',
   'bash ./scripts/ci/compute_release_metadata.sh',
+  'needs.prepare.outputs.should_release == \'true\'',
   'actions/upload-artifact',
   'actions/download-artifact'
 ]

scripts/ci/run_code_analysis.sh

@@ -3,4 +3,3 @@ set -euo pipefail
 
 flutter pub get
 flutter analyze
-flutter test

scripts/ci/run_flutter_ci_suite.sh

@@ -3,6 +3,3 @@ set -euo pipefail
 
 flutter pub get
 flutter analyze
-flutter test
-flutter test test/golden
-flutter test integration_test