ci: prepare key scan before release

[tnunamak]

Summary

Prepare the EVM key scan policy in the release workflow before semantic-release pushes release commits. The current release job installs dependencies and then runs semantic-release, but the pre-push hook now requires the pinned policy to be prepared first.

Validation

• Inspected the staged diff: only .github/workflows/release.yml changed.
• Scope is limited to the same prepare command used by the shared key-scan hook.

Assisted-by: AI

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
vana-console	Ignored		Aug 13, 2026 10:29pm
vana-rbac-auditor	Ignored		Aug 13, 2026 10:29pm
vana-vibes-demo	Ignored		Aug 13, 2026 10:29pm

[github-actions]

No actionable findings. The added step correctly prepares the pinned key-scan policy before semantic-release triggers the Husky pre-push hook. The change is appropriately scoped.

[tnunamak]

Heads-up before this merges: the prepare verb here does not exist.

- name: Prepare EVM key scan
  run: .github/scripts/install-evm-key-scan-hook.sh prepare

install-evm-key-scan-hook.sh accepts install|status|uninstall; prepare exits 2 with a usage error, which would fail the release job. This predates the recent hook work — the bootstrap took the same three verbs when this PR was opened — but it is now worth correcting before merge.

Two things also changed on main since this branch was cut, which may make the change unnecessary:

1. The hook now bootstraps from a thin stub that fetches the pinned policy on demand (ci(hooks): replace the duplicated bootstrap with a thin stub #194), so there is no separate prepare step to run ahead of it.
2. release.yml on main already sets HUSKY: "0" for the semantic-release step, with a comment explaining that the pre-push hook is not prepared in CI and would fail the release push. That appears to solve the same problem this PR is aimed at.

If the intent is to have the release job actually scan rather than skip, install is the verb — but note it installs a git hook into the runner's checkout, which is probably not what a release job wants. Happy to take a closer look if you want it repurposed rather than closed.

Assisted-by: AI