ci: yank.yml — workflow_dispatch to delete a tag on the public repo

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/yank.yml

@@ -0,0 +1,36 @@
+name: Yank a public release
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to retract from the public repo (e.g. v0.10.0 or v0.10.0-beta1)'
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  yank:
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - name: Validate the tag format
+        env:
+          TAG: ${{ inputs.tag }}
+        run: |
+          case "$TAG" in
+            v[0-9]*.[0-9]*.[0-9]*|v[0-9]*.[0-9]*.[0-9]*-beta[0-9]*) ;;
+            *) echo "refusing to yank an unrecognised tag: $TAG" >&2; exit 1 ;;
+          esac
+      - name: Checkout public repo
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ vars.PUBLIC_REPO_SLUG }}
+          token: ${{ secrets.PUBLIC_REPO_TOKEN }}
+          fetch-depth: 0
+          path: pub
+      - name: Delete the tag on the public repo
+        env:
+          TAG: ${{ inputs.tag }}
+        run: |
+          git -C pub push origin --delete "refs/tags/${TAG}"