[Snowpile]

Summary

Part of #90. release.yml gains a final job, dispatch-services, needs: [github-release]. It:

1. Mints a token from the release-bot GitHub App (Create the release-bot App, the v* tag ruleset and release-override #89), scoped to service-api-standard and service-api-chain. GITHUB_TOKEN can't send repository_dispatch to another repository.
2. Sends api-release with client_payload.version set to the tag to both services. Their bump-api.yml (Bump metacensus/api automatically when it releases service-api-standard#14, and Bump metacensus/api automatically when it releases service-api-chain#27 in progress) opens the bump PR.
3. Tries both services even if one fails, and fails the job if either did.

Because it runs last, a service is only told about a version that has fully published. If it fails, re-running this job alone is the recovery, as the comment beside it says. AGENTS.md's "Releasing" now mentions it.

Safe to merge before the App exists

Only the next release would notice. Until #89 creates RELEASE_BOT_APP_ID and RELEASE_BOT_PRIVATE_KEY, this job fails at "Mint the release-bot token". The module, npm package and GitHub release are already published by then, so nothing is lost, but that release's run would show red. Merge this once #89 is done, or accept one red run.

Testing

• actionlint v1.7.7 is clean on every workflow.
• Checked the request body with GH_DEBUG=api against an unreachable host, so nothing was sent: {"client_payload": {"version": "v0.8.0"}, "event_type": "api-release"}, which is what bump-api.yml reads (github.event.client_payload.version).
• End to end needs Create the release-bot App, the v* tag ruleset and release-override #89 and a release: the run shows this job green, and both services show a bump-api run for that version.

🤖 Generated with Claude Code