Add guarded basectl release publish

CHANGELOG.md

@@ -11,6 +11,8 @@ and Base versions are tracked in the repo-root `VERSION` file.
 
 - Added read-only workspace manifest support for `basectl workspace status`,
   `check`, and `doctor` with `--manifest <path>`.
+- Added guarded `basectl release publish` for annotated Git tags and GitHub
+  Releases, including post-publish Homebrew handoff reporting.
 - Added read-only `basectl release check|plan|notes` commands backed by
   manifest-owned release metadata.
 - Added opt-in project Git `origin` reachability diagnostics with

README.md

@@ -151,6 +151,7 @@ Current implemented commands include:
 - `basectl release check --version <version>`
 - `basectl release plan --version <version>`
 - `basectl release notes --version <version>`
+- `basectl release publish --version <version>`
 - `basectl activate <project>`
 - `basectl test [project]`
 - `basectl build <project> [target...]`
@@ -569,14 +570,17 @@ Inspect release readiness for a Base-managed repository with:
 basectl release check --version 0.4.0
 basectl release plan --version 0.4.0
 basectl release notes --version 0.4.0
+basectl release publish --version 0.4.0 --dry-run
+basectl release publish --version 0.4.0 --yes
 ```
 
-`basectl release` is read-only in this first slice. It validates the manifest
+`basectl release check|plan|notes` are read-only. They validate the manifest
 release contract, version file, changelog section, Git worktree state, GitHub
-CLI authentication, and local and remote tag availability, then prints the
-GitHub release target and any required Homebrew handoff declared by
-`base_manifest.yaml`. It does not create tags, publish GitHub Releases, or edit
-Homebrew tap repositories yet.
+CLI authentication, local and remote tag availability, and planned downstream
+handoffs. `basectl release publish` reuses those checks, requires confirmation
+unless `--yes` is supplied, creates an annotated tag, pushes the tag, and
+creates the GitHub Release from the matching changelog section. Homebrew tap
+updates remain a manual handoff printed by the command.
 
 Use `--keep-last <count>` to retain the newest log files per CLI log directory
 while pruning older logs. This retention mode applies only to `*.log` files;
@@ -1165,7 +1169,8 @@ Base follows a few simple principles.
 Base `0.3.0` is the current release. The implemented command surface covers
 setup, checks, diagnostics, project discovery, project activation, project test
 execution, mise integration, cleanup, updates, onboarding, repository baseline
-creation, release readiness inspection, and GitHub workflow helpers.
+creation, release readiness inspection, guarded GitHub release publishing, and
+GitHub workflow helpers.
 
 For the documentation map and naming convention, see
 [docs/README.md](docs/README.md). For the architecture and product direction,

cli/bash/commands/basectl/basectl.sh

@@ -27,8 +27,8 @@ Commands:
     Create repository baselines, agent guidance, and project installer templates.
   ci <setup|check|doctor> <project> [options]
     Run Base setup, checks, and diagnostics in non-interactive CI.
-  release <check|plan|notes> --version <version> [options]
-    Inspect release readiness, plan, and changelog notes without publishing.
+  release <check|plan|notes|publish> --version <version> [options]
+    Inspect release readiness, plan, notes, and guarded GitHub publishing.
   clean [--older-than <age>] [--keep-last <count>] [options]
     Remove old Base CLI runtime logs, temp files, and cache entries.
   logs [options]

cli/bash/commands/basectl/subcommands/release.sh

@@ -9,14 +9,17 @@ Usage:
   basectl release check --version <version> [options]
   basectl release plan --version <version> [options]
   basectl release notes --version <version> [options]
+  basectl release publish --version <version> [options]
 
 Options:
   --version <version>  Release version to inspect.
   --manifest <path>   Use a specific base_manifest.yaml path.
+  --dry-run           Print publish actions without creating tags or releases.
+  --yes               Publish without an interactive confirmation prompt.
   -h, --help          Show this help text.
 
-Inspect release readiness, plan, and changelog notes without creating tags,
-publishing GitHub Releases, or editing Homebrew taps.
+Inspect release readiness, plan, changelog notes, and guarded GitHub publishing.
+Homebrew tap updates remain a manual handoff.
 EOF
 }
 
@@ -29,7 +32,7 @@ base_release_subcommand_main() {
             base_release_subcommand_usage
             return 0
             ;;
-        check|plan|notes)
+        check|plan|notes|publish)
             ;;
         *)
             base_release_subcommand_usage >&2

cli/bash/commands/basectl/tests/help.bats

@@ -15,7 +15,7 @@ load ./basectl_helpers.bash
     [[ "$output" == *"run <project> <command> [options]"* ]]
     [[ "$output" == *"repo <init|check|configure|agent-guidance|installer-template> [options]"* ]]
     [[ "$output" == *"ci <setup|check|doctor> <project> [options]"* ]]
-    [[ "$output" == *"release <check|plan|notes> --version <version> [options]"* ]]
+    [[ "$output" == *"release <check|plan|notes|publish> --version <version> [options]"* ]]
     [[ "$output" == *"clean [--older-than <age>] [--keep-last <count>] [options]"* ]]
     [[ "$output" == *"logs [options]"* ]]
     [[ "$output" == *"config <path|show|doctor>"* ]]
@@ -53,7 +53,7 @@ load ./basectl_helpers.bash
     grep -Fqx '  run <project> <command> [options]' <<<"$output"
     grep -Fqx '  repo <init|check|configure|agent-guidance|installer-template> [options]' <<<"$output"
     grep -Fqx '  ci <setup|check|doctor> <project> [options]' <<<"$output"
-    grep -Fqx '  release <check|plan|notes> --version <version> [options]' <<<"$output"
+    grep -Fqx '  release <check|plan|notes|publish> --version <version> [options]' <<<"$output"
     grep -Fqx '  logs [options]' <<<"$output"
     grep -Fqx '  workspace <status|check|doctor> [options]' <<<"$output"
     [[ "$output" != *"-b DIR"* ]]

cli/bash/commands/basectl/tests/release.bats

@@ -11,6 +11,7 @@ load ./basectl_helpers.bash
     [[ "$output" == *"basectl release check --version <version>"* ]]
     [[ "$output" == *"basectl release plan --version <version>"* ]]
     [[ "$output" == *"basectl release notes --version <version>"* ]]
+    [[ "$output" == *"basectl release publish --version <version>"* ]]
 }
 
 @test "basectl release delegates to the Python release layer" {
@@ -35,9 +36,28 @@ EOF
         HOME="$TEST_HOME" \
         PATH="/usr/bin:/bin:/usr/sbin:/sbin" \
         BASE_TEST_RELEASE_STATE="$TEST_TMPDIR/release-state" \
-        "$BASE_REPO_ROOT/bin/basectl" release plan --version 1.2.3 --manifest "$manifest"
+        "$BASE_REPO_ROOT/bin/basectl" release publish --dry-run --version 1.2.3 --manifest "$manifest"
 
     [ "$status" -eq 0 ]
-    [ "$output" = "ARGS=plan --version 1.2.3 --manifest $manifest" ]
+    [ "$output" = "ARGS=publish --dry-run --version 1.2.3 --manifest $manifest" ]
     [ "$(cat "$TEST_TMPDIR/release-state")" = "BASE_PROJECT=base" ]
 }
+
+@test "Bash completion includes release publish commands and options" {
+    run env \
+        BASE_HOME="$BASE_REPO_ROOT" \
+        bash -c '\
+            source "$BASE_HOME/lib/shell/completions/basectl_completion.sh"; \
+            COMP_WORDS=(basectl release ""); \
+            COMP_CWORD=2; \
+            _base_basectl_completion; \
+            printf "release_commands=%s\n" "${COMPREPLY[*]}"; \
+            COMP_WORDS=(basectl release publish --); \
+            COMP_CWORD=3; \
+            _base_basectl_completion; \
+            printf "release_publish_options=%s\n" "${COMPREPLY[*]}"'
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"release_commands=check plan notes publish"* ]]
+    [[ "$output" == *"release_publish_options=--version --manifest --dry-run --yes"* ]]
+}