fix: stop false-positive core detection in release-all workflow

[intel352]

Summary

• Exclude go.sum from core change detection — it's a lockfile that changes whenever auto-bump runs go mod tidy, causing spurious core releases on every subsequent run
• Exclude cmd/* from core change detection — tooling changes shouldn't trigger library releases
• Add configwatcher and eventlogger to module-release dropdown (new modules from v2 enhancements)

Problem

The auto-bump-modules workflow runs go mod tidy on root, which changes go.sum. The core detection counted go.sum as a relevant change, so every subsequent release-all run detected core as changed → released core again → bumped modules again → infinite cycle. Meanwhile, modules couldn't release through the release-modules-no-core-change path because core_changed was always true.

Test plan

• Run release-all — should NOT detect core as changed if only go.sum/cmd/ files differ since last tag
• Modules with changes should release through release-modules-no-core-change path

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates GitHub Actions release workflows to refine what counts as a “core” change during orchestrated releases and to expose newly added modules in the manual module release dropdown.

Changes:

• Adjust core change detection in release-all.yml to ignore go.sum-only changes and skip cmd/* paths.
• Add configwatcher and eventlogger to the module-release.yml workflow dispatch module options.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/release-all.yml	Refines core change detection filters used by the orchestrated “release all” workflow.
.github/workflows/module-release.yml	Extends the module selection list to include newly added modules.

[Copilot]

cmd/* is excluded from core change detection, but the core release workflow (.github/workflows/release.yml) treats any root-module changes (including under cmd/) as relevant and this orchestrator later builds/uses cmd/modcli for contract extraction. As-is, changes to cmd/modcli (or other CLI code) can be skipped by release-all, resulting in no core tag even though the published root module contents changed. Consider removing the cmd/* exclusion or narrowing it only if cmd/ has an independent release/versioning story (and then align release.yml similarly).

Suggested change

[[ $f == cmd/* ]] && continue

[intel352]

Good catch — removed the cmd/* exclusion. cmd/ is part of the root module and not independently versioned, so changes there should trigger core releases. Fixed in 5ccb423.

[Copilot]

Core change detection here intentionally ignores go.sum, but .github/workflows/release.yml still considers go.sum a core-changing file (both for initial release and diff-based detection). This inconsistency means release-all can skip a core release in cases where release.yml would release (e.g., checksum-only updates after go mod tidy). Recommend keeping the detection rules consistent between the two workflows (either include go.sum here again, or also remove it from release.yml if that behavior is truly desired).

[intel352]

Agreed — aligned release.yml to also exclude go.sum from core detection, matching the same logic in release-all.yml. Both workflows now consistently treat go.sum as a lockfile that shouldn't trigger releases. Fixed in 5ccb423.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!