feat: dispatch release event to mellea-contribs

[avinash2692]

Summary

Adds a workflow that fires a repository_dispatch event (event_type=mellea-released) to generative-computing/mellea-contribs whenever a stable mellea GitHub Release is published. The contribs receiver bumps every subpackage's mellea>= constraint and project.version, refreshes lock files, and opens a PR there — see generative-computing/mellea-contribs#63 for that side.

Pre-releases are skipped — only stable releases dispatch.

Files

• .github/workflows/dispatch-to-contribs.yml — fires on release: published (skipping pre-releases) and supports workflow_dispatch for manual recovery. Authenticates to mellea-contribs via a GitHub App; mints a short-lived installation token at runtime.

Required setup before this lands

This workflow authenticates to mellea-contribs via a GitHub App. One-time setup by an org admin:

1. Create a GitHub App under the generative-computing org:
   • Settings → Developer settings → GitHub Apps → New GitHub App
   • Name: e.g. mellea-contribs-dispatcher
   • Homepage URL: any (e.g. the mellea repo URL)
   • Webhook: disable (no webhook needed)
   • Repository permissions: Contents: Read and write, Metadata: Read-only
   • Where can this App be installed: Only on this account
2. Generate a private key for the App (download the .pem file).
3. Install the App on generative-computing/mellea-contribs only.
4. Add two repo secrets to generative-computing/mellea (this repo):
   • CONTRIBS_DISPATCHER_APP_ID — the App's numeric App ID (visible on the App settings page)
   • CONTRIBS_DISPATCHER_PRIVATE_KEY — the contents of the downloaded .pem file (paste as-is, including header/footer lines)

If either secret is missing or the App isn't installed on contribs when the workflow fires, the actions/create-github-app-token step fails loudly and contribs stays unchanged. The manual workflow_dispatch is the recovery path once setup is fixed.

Testing

The contribs receiver was sandbox-tested independently. End-to-end (release → dispatch → contribs PR) will be exercised on the next stable mellea release; manual recovery is the documented escape hatch:

gh workflow run dispatch-to-contribs.yml \
  -R generative-computing/mellea \
  -f version=<actual-mellea-version>

Status

Opened as draft until the GitHub App is set up and secrets are configured. Will be marked ready for review after that.

The receiver in contribs (PR #63) is safe to land independently.