ci: gate stable and RC releases on the Redis chaos load test

The chaos test only ran on a weekly cron, so a release could be cut from a
commit it had never covered. Making it callable lets create-release.yml run it
against the exact commit being tagged and refuse to tag if it fails.

Dev, nightly, alpha and beta tags skip the gate: they are cut far more often
than stable and RC tags, and the weekly schedule already covers the default
branch. Input validation moves into the gate job so a malformed tag or SHA
fails before spending a multi-minute chaos run.

Co-Authored-By: Claude Code <noreply@anthropic.com>

.github/workflows/create-release.yml

@@ -15,11 +15,14 @@ on:
 permissions: {}
 
 jobs:
-  release:
-    name: Create Release
+  # Stable and RC tags are gated on the Redis chaos load test; dev, nightly, alpha and beta
+  # tags are cut too often to spend a multi-minute chaos run on each one, and the weekly
+  # schedule already covers the default branch.
+  gate:
+    name: Validate inputs and decide whether this tag is gated
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
+    outputs:
+      gated: ${{ steps.decide.outputs.gated }}
     steps:
       - name: Validate inputs
         env:
@@ -35,6 +38,37 @@ jobs:
             exit 1
           fi
 
+      - name: Decide
+        id: decide
+        env:
+          TAG: ${{ inputs.tag }}
+        run: |
+          if echo "${TAG}" | grep -qiE '(nightly|alpha|beta|[-.]dev)'; then
+            echo "gated=false" >> "$GITHUB_OUTPUT"
+            echo "${TAG} is a pre-release that skips the chaos gate"
+          else
+            echo "gated=true" >> "$GITHUB_OUTPUT"
+            echo "${TAG} is a stable or RC tag and must pass the chaos gate"
+          fi
+
+  redis-chaos-gate:
+    name: Redis Chaos E2E
+    needs: gate
+    if: needs.gate.outputs.gated == 'true'
+    permissions:
+      contents: read
+    uses: ./.github/workflows/test-e2e-redis-chaos.yml
+    with:
+      ref: ${{ inputs.commit_hash }}
+
+  release:
+    name: Create Release
+    needs: [gate, redis-chaos-gate]
+    if: always() && needs.gate.result == 'success' && (needs.redis-chaos-gate.result == 'success' || needs.redis-chaos-gate.result == 'skipped')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
       - name: Create release
         env:
           TAG: ${{ inputs.tag }}

.github/workflows/test-e2e-redis-chaos.yml

@@ -4,6 +4,12 @@ on:
   schedule:
     - cron: "0 12 * * 6"
   workflow_dispatch:
+  workflow_call:
+    inputs:
+      ref:
+        description: "Commit SHA or ref to test. Defaults to the ref the workflow was triggered on"
+        required: false
+        type: string
 
 permissions:
   contents: read
@@ -45,6 +51,7 @@ jobs:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           persist-credentials: false
+          ref: ${{ inputs.ref || github.sha }}
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0