fix(release): use plain tag ref for SLSA provenance reusable workflow

[getappz]

Fixes SLSA provenance workflow failing because reusable workflow refs were passed as refs/tags/v0.1.0 instead of the bare tag v0.1.0.

Summary by CodeRabbit

• Chores
  • Streamlined pull request validation by running CI on Ubuntu and Windows.
  • Continued full cross-platform CI coverage for other builds.
  • Updated release provenance generation to use the v2.1.0 workflow release.
  • Added documentation clarifying the provenance workflow reference requirements.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8e9c51d2-d7d8-4188-93c6-d8c56e482362

📥 Commits

Reviewing files that changed from the base of the PR and between 45a6b86 and efa62bb.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• .github/workflows/release.yml

---

📝 Walkthrough

Walkthrough

The CI build OS matrix now varies by event type. The release provenance job references the SLSA generator’s v2.1.0 tag and documents the required workflow ref format.

Changes

CI matrix selection

Layer / File(s)	Summary
Conditional build operating systems .github/workflows/ci.yml	Pull requests run on Ubuntu and Windows, while other events continue to run on Ubuntu, macOS, and Windows.

Release provenance workflow

Layer / File(s)	Summary
SLSA generator reference .github/workflows/release.yml	The provenance job uses the v2.1.0 generator tag and documents the tag-ref requirement and SHA failure mode.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• getappz/agentflare#111: Both update conditional behavior in the CI build workflow.
• getappz/agentflare#270: Both modify SLSA provenance generator wiring.
• getappz/agentflare#314: Both change the SLSA generator reference from a SHA to the v2.1.0 tag.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is far too brief and omits the required Summary, Test plan, and Notes for reviewers sections.	Add the template sections: a Summary, the test plan checklist items, and Notes for reviewers covering risk areas and backwards compatibility.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: switching the SLSA provenance reusable workflow to a plain tag ref.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/slsa-provenance-tag-ref

---

_{Comment @coderabbitai help to get the list of available commands.}