[bpamiri]

Summary

Follow-ups from r2's review of #4679 (both LOW), ahead of the next GA. Gating and the empty-secret skip are unchanged and verified as before: the step still runs only for refs/heads/main after Create GitHub Release succeeded, so the snapshot workflow_call never posts.

1. Bump-type agnostic text. The mrkdwn text hardcoded “patch release”, which would mislabel 4.3.0 or any minor/major GA. It is now:

   {"text":"*Wheels 4.3.0* is released.\n<https://github.com/wheels-dev/wheels/releases/tag/v4.3.0|Release notes on GitHub>"}

2. Bounded webhook call. curl now uses --connect-timeout 10 --max-time 20, so a stalled webhook cannot delay the downstream Dispatch downstream package managers / Dispatch Linux repo buckets / bump-develop steps further down the job. The existing ::warning:: + exit 0 path handles failures.

3. Payload build guarded too. A jq failure now logs ::warning::Could not build the Slack release payload; skipping notification. and exits 0, matching the delivery-failure behaviour.

curl still posts to $SLACK_WEBHOOK_URL with -fsS; no webhook or secret value is in the repo. .github/RELEASE_PLAYBOOK.md already describes the behaviour without the word “patch”, so it needed no edit.

Validation

• Ruby YAML parse: YAML OK.
• actionlint .github/workflows/release.yml → exit 0; findings are byte-for-byte the same pre-existing shellcheck advisories as origin/develop (2× SC2001, 5× SC2086, 2× SC2155 — none in the new step).
• Dry-run of the exact extracted step run block (Ruby YAML → /tmp/slack_step_followup.sh), with a fake secret token:
  • no secret → no SLACK_WEBHOOK_URL — skipping release notification, exit 0;
  • local HTTP sink → POST received, valid JSON (jq -e), message printed, secret not echoed (0 occurrences in output), exit 0;
  • unreachable URL → ::warning::Slack release notification failed; the release itself is unaffected., exit 0 (fails immediately; the timeouts only bound a stalled connection).
• No changelog (CI-only).

Refs #4679