ci(security): route releases through protected main

.github/workflows/bump.yaml

@@ -13,11 +13,13 @@ on:
           - major
 
 permissions:
+  actions: write
   contents: write
+  pull-requests: write
 
 jobs:
   bump:
-    name: Bump & Tag
+    name: Bump & Open PR
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -52,11 +54,22 @@ jobs:
           sed -i 's/^version:.*/version: ${{ steps.version.outputs.new }}/' charts/flywheel/Chart.yaml
           sed -i 's/^appVersion:.*/appVersion: "${{ steps.version.outputs.new }}"/' charts/flywheel/Chart.yaml
 
-      - name: Commit and tag
+      - name: Commit and open pull request
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
+          branch="release/v${{ steps.version.outputs.new }}"
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
+          git switch --create "$branch"
           git add Cargo.toml Cargo.lock charts/flywheel/Chart.yaml
-          git commit -m "release: v${{ steps.version.outputs.new }}"
-          git tag "v${{ steps.version.outputs.new }}"
-          git push origin main --tags
+          git commit -m "chore(release): bump to v${{ steps.version.outputs.new }}"
+          git push --set-upstream origin "$branch"
+
+          pr_url=$(gh pr create \
+            --base main \
+            --head "$branch" \
+            --title "chore(release): bump to v${{ steps.version.outputs.new }}" \
+            --body "Prepare the v${{ steps.version.outputs.new }} release. CI was dispatched explicitly because pull requests created with GITHUB_TOKEN do not emit another workflow event.")
+          gh workflow run ci.yaml --ref "$branch"
+          echo "Created $pr_url" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/ci.yaml

@@ -3,6 +3,10 @@ name: CI
 on:
   pull_request:
     branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/main.yaml

@@ -4,6 +4,9 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: false

.github/workflows/release.yaml

@@ -2,10 +2,8 @@ name: Release
 
 on:
   workflow_dispatch:
-  workflow_run:
-    workflows: ["Bump Version"]
-    types:
-      - completed
+  push:
+    branches: [main]
 
 permissions:
   contents: write
@@ -14,32 +12,50 @@ permissions:
 env:
   CARGO_TERM_COLOR: always
 
+concurrency:
+  group: release
+  cancel-in-progress: false
+
 jobs:
   resolve-tag:
     name: Resolve Tag
-    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
     runs-on: ubuntu-latest
     outputs:
       tag: ${{ steps.tag.outputs.tag }}
+      release: ${{ steps.tag.outputs.release }}
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - name: Get latest tag
+      - name: Resolve release tag
         id: tag
         run: |
-          tag=$(git tag --sort=-v:refname | grep '^v' | head -1)
-          if [ -z "$tag" ]; then
-            echo "::error::No version tag found"
-            exit 1
+          version=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
+          tag="v${version}"
+
+          if git rev-parse --verify --quiet "refs/tags/$tag" >/dev/null; then
+            if [[ "${{ github.event_name }}" == "push" ]]; then
+              echo "Tag $tag already exists; there is nothing to release."
+              echo "release=false" >> "$GITHUB_OUTPUT"
+            else
+              echo "release=true" >> "$GITHUB_OUTPUT"
+            fi
+          else
+            git config user.name "github-actions[bot]"
+            git config user.email "github-actions[bot]@users.noreply.github.com"
+            git tag "$tag"
+            git push origin "$tag"
+            echo "release=true" >> "$GITHUB_OUTPUT"
           fi
+
           echo "tag=$tag" >> "$GITHUB_OUTPUT"
           echo "Resolved tag: $tag"
 
   ci:
     name: CI
     needs: [resolve-tag]
+    if: needs.resolve-tag.outputs.release == 'true'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -58,6 +74,7 @@ jobs:
   docker:
     name: Docker
     needs: [resolve-tag, ci]
+    if: needs.resolve-tag.outputs.release == 'true'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -86,6 +103,7 @@ jobs:
   helm:
     name: Helm Chart
     needs: [resolve-tag, docker]
+    if: needs.resolve-tag.outputs.release == 'true'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -131,6 +149,7 @@ jobs:
   release:
     name: GitHub Release
     needs: [resolve-tag, docker, helm]
+    if: needs.resolve-tag.outputs.release == 'true'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4