Answer prose round 1: 0 🔴, 4 🟡; name the package-repository checks, list the release secrets, and point each sentence at its actor

release-tooling/goreleaser.yaml

@@ -1,6 +1,5 @@
-# The packages workflow runs this from a checkout of the release's tag, in src/, beside
-# this repository's tooling/ checkout: the paths below are relative to src/. A dist/
-# inside src/ would make Go stamp the binaries' version +dirty.
+# Paths are relative to the release's source checkout; dist/ sits outside it because a
+# dist/ inside would make Go stamp the version +dirty.
 version: 2
 
 project_name: fejkdata

release-tooling/publish_release.py

@@ -3,7 +3,7 @@
 
 A top heading of `[Unreleased]`, or a version already released, publishes nothing.
 Env: FORGE_API_URL, FORGE_REPOSITORY (owner/repo), FORGE_TOKEN, SHA, and GITHUB_OUTPUT,
-where a published release writes `tag=vX.Y.Z`.
+to which it appends `tag=vX.Y.Z` when it publishes a release.
 """
 
 import json