fix: avoid direct push on protected branches

.github/workflows/backmerge-main-to-dev.yml

@@ -0,0 +1,60 @@
+name: backmerge-main-to-dev
+
+on:
+  pull_request_target:
+    branches:
+      - main
+    types:
+      - closed
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  open-backmerge-pr:
+    if: >-
+      github.event.pull_request.merged == true &&
+      startsWith(github.event.pull_request.head.ref, 'hotfix/') &&
+      github.event.pull_request.head.ref != 'hotfix/release-main'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Open back-merge pull request
+        run: |
+          repo="${{ github.repository }}"
+          api_url="https://api.github.com/repos/${repo}/pulls"
+          title="chore(backmerge): main into dev after ${{ github.event.pull_request.head.ref }}"
+          head_branch="main"
+          base_branch="dev"
+
+          existing_pr="$(curl --silent \
+            --url "${api_url}?state=open&head=${{ github.repository_owner }}:${head_branch}&base=${base_branch}" \
+            --header "Authorization: Bearer ${GITHUB_TOKEN}" \
+            --header "Accept: application/vnd.github+json" \
+            --header "X-GitHub-Api-Version: 2022-11-28")"
+
+          if echo "$existing_pr" | grep -q '"number":'; then
+            echo "An open back-merge PR from main to dev already exists."
+            exit 0
+          fi
+
+          payload="$(cat <<EOF
+          {
+            "title": "${title}",
+            "head": "${head_branch}",
+            "base": "${base_branch}",
+            "body": "Automatic back-merge PR created after merging `${{ github.event.pull_request.head.ref }}` into `main`."
+          }
+          EOF
+          )"
+
+          curl --fail-with-body \
+            --request POST \
+            --url "$api_url" \
+            --header "Authorization: Bearer ${GITHUB_TOKEN}" \
+            --header "Accept: application/vnd.github+json" \
+            --header "X-GitHub-Api-Version: 2022-11-28" \
+            --data "$payload"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/prepare-release-pr.yml

@@ -0,0 +1,208 @@
+name: prepare-release-pr
+
+on:
+  pull_request_target:
+    branches:
+      - dev
+      - main
+    types:
+      - closed
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: prepare-release-${{ github.event.pull_request.base.ref }}
+  cancel-in-progress: false
+
+jobs:
+  prepare-dev-release-pr:
+    if: >-
+      github.event.pull_request.merged == true &&
+      github.event.pull_request.base.ref == 'dev' &&
+      github.event.pull_request.head.ref != 'release/dev'
+    runs-on: ubuntu-latest
+    environment:
+      name: release-rc
+
+    steps:
+      - name: Check out dev
+        uses: actions/checkout@v4
+        with:
+          ref: dev
+          fetch-depth: 0
+
+      - name: Fetch tags
+        run: git fetch --force --tags origin
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install release tooling
+        run: python -m pip install --upgrade pip commitizen tomlkit
+
+      - name: Prepare release branch
+        id: prepare
+        run: |
+          tag="$(./scripts/next-tag.sh rc)"
+          python_version="$(./scripts/tag-to-python-version.sh "$tag")"
+          release_branch="release/dev"
+
+          cz changelog --unreleased-version="$tag"
+          ./scripts/check-versions.sh --fix "$tag"
+          git add CHANGELOG.md pyproject.toml
+
+          if git diff --cached --quiet; then
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+            echo "release_branch=$release_branch" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -B "$release_branch"
+          git commit -m "chore(release): ${python_version}"
+          git push --force-with-lease origin HEAD:"$release_branch"
+
+          echo "has_changes=true" >> "$GITHUB_OUTPUT"
+          echo "release_branch=$release_branch" >> "$GITHUB_OUTPUT"
+          echo "python_version=$python_version" >> "$GITHUB_OUTPUT"
+
+      - name: Open or update release PR
+        if: steps.prepare.outputs.has_changes == 'true'
+        run: |
+          repo="${{ github.repository }}"
+          head_branch="${{ steps.prepare.outputs.release_branch }}"
+          base_branch="dev"
+          title="chore(release): ${{ steps.prepare.outputs.python_version }}"
+          body="Automated release preparation PR for \`dev\`."
+          api_url="https://api.github.com/repos/${repo}/pulls"
+
+          existing_pr="$(curl --silent \
+            --url "${api_url}?state=open&head=${{ github.repository_owner }}:${head_branch}&base=${base_branch}" \
+            --header "Authorization: Bearer ${GITHUB_TOKEN}" \
+            --header "Accept: application/vnd.github+json" \
+            --header "X-GitHub-Api-Version: 2022-11-28")"
+
+          if echo "$existing_pr" | grep -q '"number":'; then
+            echo "Release PR from ${head_branch} to ${base_branch} already exists."
+            exit 0
+          fi
+
+          payload="$(cat <<EOF
+          {
+            "title": "${title}",
+            "head": "${head_branch}",
+            "base": "${base_branch}",
+            "body": "${body}"
+          }
+          EOF
+          )"
+
+          curl --fail-with-body \
+            --request POST \
+            --url "$api_url" \
+            --header "Authorization: Bearer ${GITHUB_TOKEN}" \
+            --header "Accept: application/vnd.github+json" \
+            --header "X-GitHub-Api-Version: 2022-11-28" \
+            --data "$payload"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  prepare-main-release-pr:
+    if: >-
+      github.event.pull_request.merged == true &&
+      github.event.pull_request.base.ref == 'main' &&
+      github.event.pull_request.head.ref != 'hotfix/release-main'
+    runs-on: ubuntu-latest
+    environment:
+      name: release
+
+    steps:
+      - name: Check out main
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: Fetch tags
+        run: git fetch --force --tags origin
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install release tooling
+        run: python -m pip install --upgrade pip commitizen tomlkit
+
+      - name: Prepare release branch
+        id: prepare
+        run: |
+          tag="$(./scripts/next-tag.sh stable)"
+          python_version="$(./scripts/tag-to-python-version.sh "$tag")"
+          release_branch="hotfix/release-main"
+
+          cz changelog --unreleased-version="$tag"
+          ./scripts/check-versions.sh --fix "$tag"
+          git add CHANGELOG.md pyproject.toml
+
+          if git diff --cached --quiet; then
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+            echo "release_branch=$release_branch" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -B "$release_branch"
+          git commit -m "chore(release): ${python_version}"
+          git push --force-with-lease origin HEAD:"$release_branch"
+
+          echo "has_changes=true" >> "$GITHUB_OUTPUT"
+          echo "release_branch=$release_branch" >> "$GITHUB_OUTPUT"
+          echo "python_version=$python_version" >> "$GITHUB_OUTPUT"
+
+      - name: Open or update release PR
+        if: steps.prepare.outputs.has_changes == 'true'
+        run: |
+          repo="${{ github.repository }}"
+          head_branch="${{ steps.prepare.outputs.release_branch }}"
+          base_branch="main"
+          title="chore(release): ${{ steps.prepare.outputs.python_version }}"
+          body="Automated release preparation PR for \`main\`."
+          api_url="https://api.github.com/repos/${repo}/pulls"
+
+          existing_pr="$(curl --silent \
+            --url "${api_url}?state=open&head=${{ github.repository_owner }}:${head_branch}&base=${base_branch}" \
+            --header "Authorization: Bearer ${GITHUB_TOKEN}" \
+            --header "Accept: application/vnd.github+json" \
+            --header "X-GitHub-Api-Version: 2022-11-28")"
+
+          if echo "$existing_pr" | grep -q '"number":'; then
+            echo "Release PR from ${head_branch} to ${base_branch} already exists."
+            exit 0
+          fi
+
+          payload="$(cat <<EOF
+          {
+            "title": "${title}",
+            "head": "${head_branch}",
+            "base": "${base_branch}",
+            "body": "${body}"
+          }
+          EOF
+          )"
+
+          curl --fail-with-body \
+            --request POST \
+            --url "$api_url" \
+            --header "Authorization: Bearer ${GITHUB_TOKEN}" \
+            --header "Accept: application/vnd.github+json" \
+            --header "X-GitHub-Api-Version: 2022-11-28" \
+            --data "$payload"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}