feat(workflows): add release lifecycle workflows

.github/workflows/release-finish.yml

@@ -0,0 +1,66 @@
+# Reusable workflow — publishes a draft release or deletes it on failure.
+# Pair with release-start.yml: call this after your gate jobs succeed or fail.
+---
+name: Release - Finish
+
+on:
+  workflow_call:
+    inputs:
+      runs-on:
+        description: |
+          JSON array of runner(s) to use.
+          See https://docs.github.com/en/actions/using-jobs/choosing-the-runner-for-a-job.
+        type: string
+        default: '["ubuntu-latest"]'
+        required: false
+      tag:
+        description: "The tag of the draft release to publish or delete (output of the release-start.yml workflow)."
+        type: string
+        required: true
+      publish:
+        description: "Set to true to publish the draft, false to delete it."
+        type: boolean
+        default: true
+        required: false
+
+permissions: {}
+
+jobs:
+  publish:
+    if: ${{ !inputs.publish }}
+    name: Publish draft release
+    runs-on: ${{ fromJson(inputs.runs-on) }}
+    permissions:
+      contents: write
+    steps:
+      - id: local-workflow-actions
+        uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@f24ce3360a8abf9bf386a62ab13d0ae5de5f9d13 # 0.31.7
+        with:
+          actions-path: actions
+
+      - id: create-release
+        uses: ./self-workflow/actions/release/create
+        with:
+          publish: true
+          tag: ${{ inputs.tag }}
+
+      # jscpd:ignore-start
+      - uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@f24ce3360a8abf9bf386a62ab13d0ae5de5f9d13 # 0.31.7
+        if: always() && steps.local-workflow-actions.outputs.repository
+        with:
+          actions-path: actions
+          repository: ${{ steps.local-workflow-actions.outputs.repository }}
+          ref: ${{ steps.local-workflow-actions.outputs.ref }}
+      # jscpd:ignore-end
+  cancel:
+    if: ${{ inputs.publish }}
+    name: Cancel release
+    runs-on: ${{ fromJson(inputs.runs-on) }}
+    permissions:
+      contents: write
+    steps:
+      - env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        shell: bash
+        run: gh release delete "${{ inputs.tag }}" --cleanup-tag --yes

.github/workflows/release-start.md

@@ -0,0 +1,110 @@
+<!-- header:start -->
+
+# GitHub Workflow: Release - Start
+
+<div align="center">
+  <img src="../logo.svg" width="60px" align="center" alt="Release" />
+</div>
+
+---
+
+<!-- header:end -->
+<!-- badges:start -->
+
+[![Release](https://img.shields.io/github/v/release/hoverkraft-tech/ci-github-publish)](https://github.com/hoverkraft-tech/ci-github-publish/releases)
+[![License](https://img.shields.io/github/license/hoverkraft-tech/ci-github-publish)](http://choosealicense.com/licenses/mit/)
+[![Stars](https://img.shields.io/github/stars/hoverkraft-tech/ci-github-publish?style=social)](https://img.shields.io/github/stars/hoverkraft-tech/ci-github-publish?style=social)
+[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](https://github.com/hoverkraft-tech/ci-github-publish/blob/main/CONTRIBUTING.md)
+
+<!-- badges:end -->
+<!-- overview:start -->
+
+## Overview
+
+Reusable release workflow
+This workflow delegates release tasks by reusing a shared release workflow, ensuring standardized publishing across projects.
+
+### Permissions
+
+- **`contents`**: `write`
+- **`id-token`**: `write`
+- **`pull-requests`**: `read`
+
+<!-- overview:end -->
+<!-- usage:start -->
+
+## Usage
+
+```yaml
+name: Release
+on:
+  push:
+    branches:
+      - main
+permissions: {}
+jobs:
+  release:
+    uses: hoverkraft-tech/ci-github-publish/.github/workflows/release-start.yml@84e8ace407055e7a40ba6670a8c697e1ce2dfafa # 0.20.1
+    permissions: {}
+    with:
+      # JSON array of runner(s) to use.
+      # See https://docs.github.com/en/actions/using-jobs/choosing-the-runner-for-a-job.
+      #
+      # Default: `["ubuntu-latest"]`
+      runs-on: '["ubuntu-latest"]'
+
+      # Whether to mark the release as a prerelease
+      # See ../../actions/release/create/README.md for more information.
+      prerelease: false
+```
+
+<!-- usage:end -->
+<!-- inputs:start -->
+
+## Inputs
+
+### Workflow Dispatch Inputs
+
+| **Input**        | **Description**                                                                    | **Required** | **Type**    | **Default**         |
+| ---------------- | ---------------------------------------------------------------------------------- | ------------ | ----------- | ------------------- |
+| **`runs-on`**    | JSON array of runner(s) to use.                                                    | **false**    | **string**  | `["ubuntu-latest"]` |
+|                  | See <https://docs.github.com/en/actions/using-jobs/choosing-the-runner-for-a-job>. |              |             |                     |
+| **`prerelease`** | Whether to mark the release as a prerelease                                        | **false**    | **boolean** | `false`             |
+|                  | See ../../actions/release/create/README.md for more information.                   |              |             |                     |
+
+<!-- inputs:end -->
+<!-- secrets:start -->
+<!-- secrets:end -->
+<!-- outputs:start -->
+<!-- outputs:end -->
+<!-- examples:start -->
+<!-- examples:end -->
+<!-- contributing:start -->
+
+## Contributing
+
+Contributions are welcome! Please see the [contributing guidelines](https://github.com/hoverkraft-tech/ci-github-publish/blob/main/CONTRIBUTING.md) for more details.
+
+<!-- contributing:end -->
+<!-- security:start -->
+<!-- security:end -->
+<!-- license:start -->
+
+## License
+
+This project is licensed under the MIT License.
+
+SPDX-License-Identifier: MIT
+
+Copyright © 2026 hoverkraft-tech
+
+For more details, see the [license](http://choosealicense.com/licenses/mit/).
+
+<!-- license:end -->
+<!-- generated:start -->
+
+---
+
+This documentation was automatically generated by [CI Dokumentor](https://github.com/hoverkraft-tech/ci-dokumentor).
+
+<!-- generated:end -->

.github/workflows/release.yml → .github/workflows/release-start.yml

@@ -1,9 +1,29 @@
-# Reusable release workflow
-# This workflow delegates release tasks by reusing a shared release workflow, ensuring standardized publishing across projects.
+# Reusable release workflow — creates a draft release and outputs the tag.
+# Pair with release-finish.yml to publish or delete the draft after running your own gate.
 ---
-name: Release
+name: Release - Start
 
 on:
+  workflow_call:
+    inputs:
+      runs-on:
+        description: |
+          JSON array of runner(s) to use.
+          See https://docs.github.com/en/actions/using-jobs/choosing-the-runner-for-a-job.
+        type: string
+        default: '["ubuntu-latest"]'
+        required: false
+      prerelease:
+        description: |
+          Whether to mark the release as a prerelease.
+          See ../../actions/release/create/README.md for more information.
+        type: boolean
+        default: false
+        required: false
+    outputs:
+      tag:
+        description: "The tag of the draft release."
+        value: ${{ jobs.release.outputs.tag }}
   workflow_dispatch:
     inputs:
       #checkov:skip=CKV_GHA_7: required
@@ -16,7 +36,7 @@ on:
         required: false
       prerelease:
         description: |
-          Whether to mark the release as a prerelease
+          Whether to mark the release as a prerelease.
           See ../../actions/release/create/README.md for more information.
         type: boolean
         default: false
@@ -44,6 +64,7 @@ jobs:
         uses: ./self-workflow/actions/release/create
         with:
           prerelease: ${{ inputs.prerelease }}
+          publish: false
 
       # jscpd:ignore-start
       - uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@f24ce3360a8abf9bf386a62ab13d0ae5de5f9d13 # 0.31.7