ci(nightly): add dry_run and skip_ci_verify dispatch inputs - #809

What

Mirrors release.yml's workflow_dispatch inputs on nightly.yml and passes them through the workflow_call:

• dry_run — build, sign, assemble, and smoke everything, publish nothing. Two nightly-specific behaviors:
  • Forces the build even when HEAD is already staged (should_release == 'true' || inputs.dry_run == true) — a rehearsal that skips itself proves nothing. The smoke jobs then run against the fresh artifacts.
  • Never advances the channel — promote-nightly gains && !inputs.dry_run. A dry-run release stages nothing, and re-pointing nightly at a previously staged HEAD would make the rehearsal publish.
• skip_ci_verify — straight pass-through to release.yml's verify-ci gate (admin override for a commit whose checks are known-good but unreported).

Scheduled runs see an empty inputs context, so every expression falls back to today's behavior.

This makes gh workflow run nightly.yml -f dry_run=true the safe end-to-end rehearsal of the whole nightly pipeline — including the smoke jobs added in #759 — which #759's description noted wasn't previously possible.

Authorization (workflow freeze)

Editing .github/workflows/ is normally frozen and CODEOWNER-gated (see CLAUDE.md). Owner-directed follow-up to #759, opened for code-owner review.

Validation

actionlint (1.7.12) runs clean. Scheduled-path behavior is unchanged by construction (empty inputs context); the dispatch path gets its first proof from a dry_run=true dispatch once merged.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Added manual nightly workflow options for dry runs and skipping CI verification.
  • Dry runs can now execute release preparation without advancing the release channel.
  • Workflow inputs are forwarded automatically, with safe defaults when omitted.