release.yaml: share duplicated steps with YAML anchors

[marcleblanc2]

release.yaml carried the same ~100-line image-update step block five times (internal.create × patch/minor/major, promoteToPublic.create, and promoteToPublic.finalize's update-main section). This PR defines each shared step once under a top-level x-shared-steps key near the top of the file (YAML anchors), and the sections below only alias them. 615 → 378 lines, no behaviour change except the intentional edits below.

What changed

• All anchors live in x-shared-steps, right after requirements, so a reader sees the building blocks before the sections that use them. sg release decodes with default yaml.v3 settings (no KnownFields), so the unknown top-level key is ignored.
• internal.create.steps.patch/minor/major all alias one internal-create step list. The three copies differed only by a stray echo "updating sourcegraph images" and release_<type> in the commit message / PR title.
  • Commit message is now release: {{version}} and PR title (internal) release: build {{version}}, which is what the Temporal workflow already produces (see (internal) release: build v8.0.0 #945). The release type is still recorded in the commit body via {{config}}.
• The public-registry sg ops update-images steps, chart:version, chart:appVersion and helm:docs are aliased into promoteToPublic.create and promoteToPublic.finalize.
• update helm docs step renamed to helm:docs to match the internal section.
• Removed the commented-out "validate promotion criteria" block (disabled since release: disable promotion criteria validation #465).

Verification

sg release steps --format json rendered for every operation (internal-create × patch/minor/major, internal-finalize, test, promote-to-public, promote-to-public-finalize) against main and this branch. The only diffs are the edits listed above; the x-shared-steps restructure (second commit) renders byte-identical to the first commit for every operation. sg's loader (dev/sg/internal/release/config.go) uses the default yaml.v3 decoder, which resolves anchors/aliases.

Question for @sourcegraph/release: keep internal.create / promoteToPublic.create at all?

Evidence gathered while looking at this:

• The Buildkite pipeline here only runs sg release run test and ... finalize (.buildkite/pipeline.yaml). Nothing in this repo runs the create steps.
• In sourcegraph/sourcegraph, TriggerDeployRepoWorkflows → DeployRepoReleaseCreate / DeployRepoReleasePromote (internal/releaseplatform/temporal/workflow/deployrepos*.go) reimplement the create phases natively via the GitHub API and never invoke sg release ... create. Every internal/promote PR here since v7.5.0 ((internal) release: build v7.5.0 #903, Jul 2026) was opened by sourcegraph-bot-2 with the Temporal-style title; the last release.yaml-style one was (internal) release_patch: build v7.4.2513 #899 (v7.4.2513, Jun 2026).
• The batch-change workflow DeployReposRelease (internal/releaseplatform/temporal/workflow/batchchange.go) does shell out to sg release create, but it has no callers (only registered in cmd/releaseworker), and it reads batch-change/release.yaml, not this file.
• One exception: (promote) release: build v7.5.4453 #908 (promote v7.5.4453, Jul 9) is a single promote-release: commit by a human, i.e. someone ran sg release promote-to-public --workdir . by hand as a fallback, two days after sourcegraph/sourcegraph#13551 fixed helm-docs regeneration in the workflow. Four releases since then went through the bot cleanly.

So the create sections are a manual fallback, used once in the last three months. Two options:

1. Keep as fallback — merge this PR as is.
2. Delete them — if the Temporal workflow is the only supported path now, I'll push a follow-up commit removing internal.create and promoteToPublic.create (the anchored steps move into finalize), plus a separate PR deleting batch-change/ and the unused DeployReposRelease workflow in the monorepo.

deploy-sourcegraph-k8s and deploy-sourcegraph-docker have the same five-copy layout; I'll mirror whichever option lands here.

Test plan: sg release steps before/after diff described above; CI here doesn't execute release.yaml on non-release branches.

[github-actions]

Open the Diff Tour for this PR in Sourcegraph