From 1aa2cffdd804ca449599965cc5755e1f9cfd7b87 Mon Sep 17 00:00:00 2001
From: Federico Izzo <federico@fedeizzo.dev>
Date: Mon, 28 Sep 2026 12:00:38 +0200
Subject: [PATCH] ci: dispatch Toolboxes stable releases

---
 .github/workflows/release-please.yml | 17 +++++++++++++++++
 docs/RELEASING.md                    |  6 ++++++
 2 files changed, 23 insertions(+)

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 3b21a8c3c3..696ff4015c 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -21,14 +21,31 @@ jobs:
         with:
           client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: |
+            gufo
+            toolboxes
           permission-actions: read
           permission-contents: write
           permission-issues: write
           permission-pull-requests: write
 
       - name: Maintain release pull request or publish merged release
+        id: release-please
         uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:
           token: ${{ steps.app-token.outputs.token }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
+
+      - name: Request stable Toolboxes images
+        if: ${{ steps.release-please.outputs.release_created == 'true' }}
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          RELEASE_TAG: ${{ steps.release-please.outputs.tag_name }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          jq -n --arg tag "$RELEASE_TAG" \
+            '{event_type: "gufo-release", client_payload: {tag: $tag}}' \
+            | gh api --method POST repos/gufo-org/toolboxes/dispatches --input -
diff --git a/docs/RELEASING.md b/docs/RELEASING.md
index a6ab95ab93..b60d7b3c7d 100644
--- a/docs/RELEASING.md
+++ b/docs/RELEASING.md
@@ -84,3 +84,9 @@ Official artifacts build the `release` package from a `vX.Y.Z` tag and report
 `gufo version X.Y.Z (<revision>)`. Both package outputs retain the exact flake
 revision; only the explicitly selected release output reads the semantic version
 from `version.txt`.
+
+After Release Please creates a GitHub Release, the same workflow sends its exact
+`vX.Y.Z` tag to the Toolboxes repository. Toolboxes builds the release package
+from that tag and publishes OCI images tagged `X.Y.Z`, `X.Y` and `latest`.
+Rolling Toolboxes images remain separate: they follow Gufo `main` and use `edge`
+and `sha-<revision>` tags.