ci: rework CI workflows

This commit reworks CI workflows to invoke Release-Please twice: once to create a PR, which later auto-merged and another time to actually create a GitHub Release.

Author: mvprowess

.github/workflows/release.yaml

@@ -26,10 +26,15 @@ jobs:
       created: ${{ steps.release.outputs.release_created }}
       tag: ${{ steps.release.outputs.tag_name }}
     steps:
-      - uses: googleapis/release-please-action@v4
+      - name: Auto-merge Release-Please PR
+        run: |
+          gh pr merge ${{ github.event.client_payload.pr_number }} --squash
+
+      - name: Run Release-Please
+        uses: googleapis/release-please-action@v4
         id: release
         with:
-          token: ${{secrets.GITHUB_TOKEN}}
+          token: ${{ secrets.ACCESS_TOKEN }}
           config-file: "release-please-config.json"
           manifest-file: ".release-please-manifest.json"
           release-type: bazel
@@ -39,14 +44,14 @@ jobs:
     needs: [release]
     if: ${{ needs.release.outputs.created && !failure() }}
     env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GITHUB_TOKEN: ${{ secrets.ACCESS_TOKEN }}
     steps:
       - name: Download Release artifacts
         uses: actions/download-artifact@v4
         with:
           name: distributables
           path: dist
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          github-token: ${{ env.GITHUB_TOKEN }}
           repository: ${{ github.repository }}
           run-id: ${{ github.event.client_payload.run_id }}
 

.github/workflows/testing.yaml

@@ -11,6 +11,7 @@ on:
 
 permissions:
   contents: write
+  pull-requests: write
 
 defaults:
   run:
@@ -27,7 +28,11 @@ jobs:
         os: [ubuntu-latest]
     runs-on: ${{ matrix.os }}
     env:
+      GITHUB_TOKEN: ${{ secrets.ACCESS_TOKEN }}
       CACHE_PATH: ${{ matrix.os == 'macos-latest' && '/private/var/tmp/_bazel_runner/' || '~/.cache/bazel' }}
+    outputs:
+      created: "${{ steps.release.outputs.prs_created }}"
+      pr: "${{ steps.output-pr.outputs.number }}"
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -55,15 +60,30 @@ jobs:
         run: |
           bazel --output_user_root=${{ env.CACHE_PATH }} test //...
 
+      # create a release PR
+      - name: Run Release-Please
+        uses: googleapis/release-please-action@v4
+        id: release
+        with:
+          token: ${{ env.GITHUB_TOKEN }}
+          config-file: "release-please-config.json"
+          manifest-file: ".release-please-manifest.json"
+          release-type: bazel
+
+      - name: Output crated PR number
+        id: output-pr
+        run: |
+          echo "number=${{ fromJSON(steps.release.outputs.pr).number }}" >> "$GITHUB_OUTPUT"
+
       # Fail here if tests didn't succeed
       - name: Generate Release artifacts
-        if: ${{ success() }}
+        if: ${{ success() && steps.release.outputs.prs_created }}
         run: |
           scripts/release.sh executables
           scripts/release.sh tarballs
 
       - name: Upload Release artifacts
-        if: ${{ success() }}
+        if: ${{ success() && steps.release.outputs.prs_created }}
         uses: actions/upload-artifact@v4
         with:
           name: distributables
@@ -73,15 +93,18 @@ jobs:
 
   dispatch:
     runs-on: ubuntu-latest
+    env:
+      GITHUB_TOKEN: ${{ secrets.ACCESS_TOKEN }}
     needs: [test]
     steps:
       - name: Dispatch a release workflow run
-        if: ${{ !failure() }}
+        if: ${{ needs.test.outputs.created }}
         uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          github-token: "${{ env.GITHUB_TOKEN }}"
           script: |
             const payload = {
+              pr_number: "${{ needs.test.outputs.pr }}"
               run_id: "${{ github.run_id }}",
               sha: "${{ github.sha }}"
             }