Evergreen tracks: taint action should also flag the release on GitHub Releases and dev.dotcms.com

Description

evergreen-tracks-admin (.github/workflows/cicd_evergreen-tracks-admin.yml) supports a taint action that marks a bad GA version so the promote planner (evergreen-tracks-promote) never advances standard/trailing onto it. See README.md and RUNBOOK.md § 1.

Today taint only adds a <version>_tainted marker tag in the Docker registry. That's invisible everywhere except the registry — confirmed live on 2026-08-31 when v26.08.28-01 and v26.08.31-01 were tainted after the Users portlet regression (#37311): the Docker tag moved, but neither the GitHub Release nor the dev site showed anything.

Support, customers, and other engineers checking release status look at the GitHub Releases page or the dev site, not Docker Hub tags — so a tainted release currently looks perfectly fine everywhere a human would actually check.

Proposed change

When evergreen-tracks-admin runs with action=taint and apply=true, in addition to the existing registry marker tag, it should also:

1. github.com/dotcms/core/releases — flag the corresponding GitHub Release as tainted. GitHub Releases have no label support, so this means the release title and/or body (e.g. prepend "⚠️ TAINTED — known bad release, do not use").

2. dev.dotcms.com — flag it everywhere the dev site lists versions. Per Erick Gonzalez (see Slack thread), that's at least:

   • Change logs
   • All Releases
   • Current Releases

   Mechanism is unknown today — needs investigation into what drives those pages (static content vs. an API vs. pulling from GitHub Releases directly, which could make this free once step 1 is done).

action=untaint should reverse both, mirroring how it already removes the registry marker tag. Dry-run (apply=false) should preview both changes without mutating anything, consistent with existing behavior.

Acceptance Criteria

• Running taint with apply=true visibly flags the release as tainted on github.com/dotcms/core/releases.
• Running taint with apply=true visibly flags the release as tainted on all three dev.dotcms.com pages above (Change logs, All Releases, Current Releases).
• Running untaint reverses both of the above.
• Dry-run (apply=false) previews the GitHub Release and dev-site changes without mutating either.
• Existing Docker-registry taint/untaint behavior is unchanged.

Additional Context

• Relevant files: .github/workflows/cicd_evergreen-tracks-admin.yml, .github/actions/core-cicd/evergreen-tracks/ (README.md, RUNBOOK.md, and the evergreen-tracks CLI it runs).
• First investigation step: confirm what content source dev.dotcms.com's release pages actually read from before designing the write path.
• Also flagged in the same thread: the changelogs automation isn't running currently — worth checking whether that's related.

Start with .github/workflows/cicd_evergreen-tracks-admin.yml and the README.md, RUNBOOK.md, and CLI under .github/actions/core-cicd/evergreen-tracks/. First confirm how dev.dotcms.com generates its three release pages and trace the existing taint, untaint, and dry-run paths. Done means both GitHub Releases and all three dev-site pages visibly reverse their taint state while Docker behavior remains unchanged.