Handlebars.conf: Convert release to trigger-actions pattern (BRE-1935 Phase 2/3)

[AmyLGalles]

Summary

This is Phase 2 of 3 (finalize-source) for migrating Handlebars.conf's release workflow to the centralized deploy repo as part of BRE-1935.

What This PR Does

Converts the release.yml workflow to emit a deployment event that triggers bitwarden/deploy's release-handlebars-conf.yml receiver workflow.

Migration Context

• Phase 1 ✅: Created release-handlebars-conf.yml in bitwarden/deploy
• Phase 2 (this PR): Convert source workflow to trigger-actions caller
• Phase 3 ⏳: Wire trigger-actions.yml receiver job

Changes Applied

1. Trigger Pattern Conversion

Before (89 lines):

• Full release workflow with version checking, artifact downloads, and GitHub release creation
• Job name: release
• Steps:
  1. Branch check
  2. Checkout repo
  3. Check Release Version
  4. Download all Release artifacts
  5. Create release

After (50 lines):

• Thin trigger-actions caller
• Job name: trigger-release
• Steps:
  1. Branch check (preserved)
  2. Trigger release workflow in deploy repo

2. What Moved to Deploy Repo

The following steps moved to bitwarden/deploy/release-handlebars-conf.yml:

• ✅ Repository checkout
• ✅ Version resolution from .csproj
• ✅ Artifact downloads from build.yml
• ✅ GitHub release creation with ncipollo/release-action
• ✅ All BW-GHAPP token handling

3. What Stayed in Source Repo

• ✅ Branch check (main-only for non-Dry Run)
• ✅ Manual dispatch trigger
• ✅ Release type choice (Release vs Dry Run)
• ✅ Trigger initiation

4. Security Updates

• Added workflow-level permissions: block
  • contents: read
  • id-token: write (for Azure OIDC)
• Job-level permissions explicitly declared
• All trigger-actions inputs handled safely

5. Data Contract

Passes single input to deploy repo:

{
  "release_type": "Release" | "Dry Run"
}

Upstream Changes Incorporated

This PR is based on the latest main which includes:

• Simplified artifact pattern (hbs_*.zip wildcard instead of explicit list)
• Updated action versions
• Runner updates to ubuntu-24.04

Testing Plan

After this PR merges and Phase 3 completes:

1. Test Dry Run:

   gh workflow run release.yml \
     --repo bitwarden/Handlebars.conf \
     --ref main \
     -f release_type="Dry Run"

   Verify: Dry Run completes without creating release

2. Test actual release:

   gh workflow run release.yml \
     --repo bitwarden/Handlebars.conf \
     --ref main \
     -f release_type="Release"

   Verify:

   • Deployment event emitted to deploy repo
   • release-handlebars-conf.yml runs in deploy repo
   • Draft release created on Handlebars.conf
   • All artifacts attached

Next Steps

⏳ Phase 3: Add trigger-release-handlebars-conf job to trigger-actions.yml:

• Validate expected source repo: Handlebars.conf
• Extract release_type input from deployment payload
• Dispatch release-handlebars-conf.yml and monitor

Related

• Jira: BRE-1935 - Centralize deploy workflows in bitwarden/deploy
• Phase 1: Receiver workflow exists in bitwarden/deploy
• Deploy Workflow: bitwarden/deploy/.github/workflows/release-handlebars-conf.yml

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the conversion of .github/workflows/release.yml from a self-contained release workflow into a thin bitwarden/gh-actions/trigger-actions caller for BRE-1935 Phase 2. The retained branch check still uses $GITHUB_REF and no longer needs a checkout, the added id-token: write is required for the Azure OIDC login inside trigger-actions, and dropping job-level contents: write is correct now that release creation happens in bitwarden/deploy. The release_type interpolation into the data payload is safe because workflow_dispatch type: choice constrains the value to the declared options. Note that until Phase 3 wires the trigger-actions.yml receiver job, release.yml on main will emit an event with no handler — the PR description acknowledges this sequencing.

Code Review Details

• ❓ : Trigger payload drops the ref/commit context the removed download-artifacts and release-action steps relied on
  • .github/workflows/release.yml:46