chore(main): release 1.4.0

[github-actions]

🤖 I have created a release beep boop

1.4.0 (2026-09-02)

Features

• add reusable auto-merge-release-pr workflow (ece8904)
• add reusable auto-merge-release-pr workflow (a9ead54)
• chained release-publish-oci workflow + release.yml outputs (6bab43c)
• chained release-publish-oci workflow for service repos (62f4ed5)
• docker-build-push-ecr: add opt-in also_tag_latest input (abbc3c6)
• docker-build-push-ecr: opt-in also_tag_latest input (a8e1a6e)
• docker-build-push-ecr: optional submodules checkout (3788418)
• docker-build-push-ecr: optional submodules checkout (8dce282)
• pr-checks-go: add require-private-modules to fail fast on a missing credential (44e5f13)
• pr-checks-go: allow resolving private nullplatform Go modules (f908b50)
• pr-checks: mint a GitHub App token for private dependency access (73908ff)
• pr-checks: resolve private nullplatform Go modules via a GitHub App token (7cf4b2a)
• release-publish-oci: publish tag, changelog and OCI annotations (e96e2f6)
• release-publish-oci: publish tag, changelog and OCI annotations (2b0be41)
• shellcheck auto-discovers extensionless scripts by shebang (d36fbfc)
• shellcheck auto-discovers extensionless scripts by shebang (e9bffbc)
• support explicit pr_number input in auto-merge-release-pr (618f904)
• support explicit pr_number input in auto-merge-release-pr (9c05415)

Bug Fixes

• add DEPENDABOT_TOKEN fallback for Dependabot PR CI runs (5e062ec)
• add DEPENDABOT_TOKEN fallback for Dependabot PR CI runs (79f4200)
• auto-merge-release-pr fails randomly when a release PR has zero checks yet (2bb005f)
• auto-merge-release: use --admin to bypass base branch policy on merge (4678465)
• auto-merge-release: use --admin to bypass base branch policy on merge (f3bf16b)
• avoid self-deadlock in auto-merge-release-pr (2d3deeb)
• avoid self-deadlock waiting on the release PR's checks (0f94afa)
• branch-validation: skip validation for dependabot branches (5c0f5d4)
• branch-validation: skip validation for dependabot branches (1310eeb)
• docker-ecr: keep prerelease suffix in the published image tag (0520a07)
• docker-ecr: keep prerelease suffix in the published image tag (028ced6)
• don't hard-fail when a previously-checked PR briefly reports no checks (4944ab9)
• only treat the specific 'no checks reported' error as checkless, never merge unverified (200fc0e)
• pr-checks: gate the App token behind an opt-in input, not the org secret (33e32f0)
• read only first line for shebang check (avoids SC2015, heredoc false positives) (b979cf7)
• release-publish-oci: address review — recovery path, artifact (2dc2925)
• tolerate a release PR having zero checks registered yet (e1349e0)

---

This PR was generated with Release Please. See documentation.