ci(release): merge the version bump through a pull request

Merged
GU
4d ago
+23-4

What is this Contribution About?

main is about to require a pull request (repository ruleset, 0 approvals). The determine-tag job pushes the version bump (Update version to X.Y.Z) straight to main with GITHUB_TOKEN, and a ruleset cannot list GitHub Actions as a bypass actor, so that push would be rejected and releases would stop.

This lands the bump through a pull request instead, still with GITHUB_TOKEN:

  • commit the bump on release/X.Y.Z, open a PR to main, and squash-merge it right away (retries while GitHub computes mergeability);
  • tag the bump PR's merge commit instead of the local HEAD;
  • skip PRs titled Update version to … when looking for the PR that triggered the push, so a bump PR is never mistaken for the one carrying the tagging reaction.

Nothing else changes: the reaction on the "Tagging Options" comment still picks the version, and the release/publish dispatches are the same. PRs opened and merged with GITHUB_TOKEN don't trigger workflows, so there's no new run and no loop, same as the direct push today. Each release now leaves a merged Update version to X.Y.Z (#N) PR in the history.

The next prerelease job is untouched (next is not protected).

Rollout

  1. Merge this.
  2. Turn on the main: require pull request ruleset (same as deco-cx/admin).
  3. Watch the next release: bump PR merged, tag on its merge commit, release + publish dispatched.

Verification

  • YAML parses; the new run script passes bash -n.
  • Repo allows GitHub Actions to create PRs (can_approve_pull_request_reviews: true), and the workflow already has contents: write + pull-requests: write.
  • Not run end to end: it only runs on a push to main.

🤖 Generated with Claude Code

Summary by cubic

main is about to require pull requests, and the release workflow was pushing the version bump straight to main with GITHUB_TOKEN, which a ruleset can't bypass. The bump now lands through a squash-merged PR, and the tag is created on the PR's merge commit instead of the local HEAD.

  • Commits the bump on release/X.Y.Z, opens a PR to main, and squash-merges it with retries while GitHub computes mergeability.
  • Filters out Update version to … PRs when finding the PR that triggered the tagging reaction, so the bump PR is never mistaken for it.
  • PRs opened and merged with GITHUB_TOKEN don't trigger workflows, so there's no new run or loop.
  • Each release leaves a merged Update version to X.Y.Z (#N) PR in history.

Rollout

  • Merge this PR, then enable the main: require pull request ruleset before the next release.