Fix release workflow to use PR auto-merge instead of direct push (#48)

Replace direct push to main (blocked by branch protection) with a
PR-based flow: version bump is pushed to a temporary release branch,
a PR is opened with auto-merge enabled, and publish jobs trigger
after the PR merges.

Author: antosubash

.github/workflows/release.yml

@@ -18,6 +18,10 @@ on:
     types: [completed]
     branches: [main]
 
+  pull_request:
+    types: [closed]
+    branches: [main]
+
 concurrency:
   group: release
   cancel-in-progress: false
@@ -30,17 +34,16 @@ jobs:
     runs-on: ubuntu-latest
     if: >-
       github.event_name == 'workflow_dispatch' ||
-      (github.event.workflow_run.conclusion == 'success' &&
+      (github.event_name == 'workflow_run' &&
+       github.event.workflow_run.conclusion == 'success' &&
        github.event.workflow_run.head_branch == 'main')
     outputs:
       version: ${{ steps.bump.outputs.version }}
       skip: ${{ steps.check.outputs.skip }}
-      sha: ${{ steps.push.outputs.sha }}
     steps:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Check if release commit
         id: check
@@ -88,27 +91,42 @@ jobs:
           echo "version=${NEW_VERSION}" >> "$GITHUB_OUTPUT"
           echo "Bumped $CURRENT -> $NEW_VERSION ($BUMP)"
 
-      - name: Commit and tag
+      - name: Create release PR
         if: steps.check.outputs.skip != 'true'
         id: push
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           VERSION="${{ steps.bump.outputs.version }}"
+          BRANCH="release-v${VERSION}"
+
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          git checkout -b "$BRANCH"
           git add version.json
-          git commit -m "release: v${VERSION}"
-          git tag -a "v${VERSION}" -m "v${VERSION}"
-          git push origin main --follow-tags
-          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+          git commit -m "release: v${VERSION} [no ci]"
+          git push origin "$BRANCH"
+
+          gh pr create \
+            --base main \
+            --head "$BRANCH" \
+            --title "release: v${VERSION}" \
+            --body "Automated release v${VERSION}"
+          gh pr merge "$BRANCH" --auto --squash --delete-branch
 
   publish-nuget:
     runs-on: ubuntu-latest
-    needs: version
-    if: needs.version.outputs.skip != 'true'
+    if: >-
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.merged == true &&
+      startsWith(github.event.pull_request.title, 'release: v')
     steps:
       - uses: actions/checkout@v6
-        with:
-          ref: ${{ needs.version.outputs.sha }}
+
+      - name: Extract version
+        id: version
+        run: echo "version=$(jq -r .version version.json)" >> "$GITHUB_OUTPUT"
 
       - name: Setup .NET
         uses: actions/setup-dotnet@v5
@@ -128,19 +146,23 @@ jobs:
         run: dotnet restore
 
       - name: Pack
-        run: dotnet pack -c Release -p:Version=${{ needs.version.outputs.version }} --no-restore -o ./nupkgs
+        run: dotnet pack -c Release -p:Version=${{ steps.version.outputs.version }} --no-restore -o ./nupkgs
 
       - name: Push to NuGet
         run: dotnet nuget push ./nupkgs/*.nupkg --api-key ${{ secrets.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json --skip-duplicate
 
   publish-npm:
     runs-on: ubuntu-latest
-    needs: version
-    if: needs.version.outputs.skip != 'true'
+    if: >-
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.merged == true &&
+      startsWith(github.event.pull_request.title, 'release: v')
     steps:
       - uses: actions/checkout@v6
-        with:
-          ref: ${{ needs.version.outputs.sha }}
+
+      - name: Extract version
+        id: version
+        run: echo "version=$(jq -r .version version.json)" >> "$GITHUB_OUTPUT"
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
@@ -159,29 +181,34 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
-          VERSION="${{ needs.version.outputs.version }}"
+          VERSION="${{ steps.version.outputs.version }}"
           for pkg in packages/SimpleModule.Client packages/SimpleModule.UI packages/SimpleModule.Theme.Default; do
             (cd "$pkg" && npm version "$VERSION" --no-git-tag-version && npm publish --access public)
           done
 
   github-release:
     runs-on: ubuntu-latest
-    needs: [version, publish-nuget, publish-npm]
-    if: needs.version.outputs.skip != 'true'
+    needs: [publish-nuget, publish-npm]
+    if: >-
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.merged == true &&
+      startsWith(github.event.pull_request.title, 'release: v')
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@v6
         with:
-          ref: v${{ needs.version.outputs.version }}
           fetch-depth: 0
 
-      - name: Create GitHub Release
+      - name: Create tag and GitHub Release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          VERSION="${{ needs.version.outputs.version }}"
+          VERSION="$(jq -r .version version.json)"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag -a "v${VERSION}" -m "v${VERSION}"
+          git push origin "v${VERSION}"
           gh release create "v${VERSION}" \
             --title "v${VERSION}" \
-            --generate-notes \
-            --verify-tag
+            --generate-notes