Update CI

.github/workflows/release.yml

@@ -1,5 +1,8 @@
 name: Release
 
+# Stage 1 of the release flow: opens a version-bump PR against 2.x.
+# When that PR is merged, tag-release.yml (stage 2) creates the tag and
+# the GitHub release automatically.
 on:
   workflow_dispatch:
     inputs:
@@ -19,16 +22,21 @@ on:
 
 permissions:
   contents: write
+  pull-requests: write
 
 jobs:
-  release:
-    name: Bump version, tag and release
+  release-pr:
+    name: Open version bump PR
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
           ref: 2.x
           fetch-depth: 0
+          # Optional: set a RELEASE_TOKEN repo secret (fine-grained PAT with
+          # contents + pull-requests write) so the bump PR triggers CI checks.
+          # PRs created with the default github.token do not trigger workflows.
+          token: ${{ secrets.RELEASE_TOKEN || github.token }}
 
       - name: Determine new version
         id: version
@@ -62,7 +70,7 @@ jobs:
           echo "Bumping $current -> $new"
           echo "new=$new" >> "$GITHUB_OUTPUT"
 
-      - name: Commit bump and push tag
+      - name: Push bump commit to release branch
         env:
           NEW_VERSION: ${{ steps.version.outputs.new }}
         run: |
@@ -70,13 +78,20 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git commit -am "Bump version to $NEW_VERSION"
-          git tag "v$NEW_VERSION"
-          git push origin HEAD:2.x "refs/tags/v$NEW_VERSION"
+          git push --force origin "HEAD:refs/heads/release/v$NEW_VERSION"
 
-      - name: Create GitHub release
+      - name: Open pull request
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.RELEASE_TOKEN || github.token }}
+          NEW_VERSION: ${{ steps.version.outputs.new }}
         run: |
-          gh release create "v${{ steps.version.outputs.new }}" \
-            --title "v${{ steps.version.outputs.new }}" \
-            --generate-notes
+          existing=$(gh pr list --head "release/v$NEW_VERSION" --base 2.x --state open --json number -q '.[0].number')
+          if [ -n "$existing" ]; then
+            echo "PR #$existing is already open for release/v$NEW_VERSION"
+          else
+            gh pr create \
+              --base 2.x \
+              --head "release/v$NEW_VERSION" \
+              --title "Bump version to $NEW_VERSION" \
+              --body "Automated version bump. Merging this PR will tag v$NEW_VERSION and publish the GitHub release. Merge it last, once everything for the release is on 2.x."
+          fi

.github/workflows/tag-release.yml

@@ -0,0 +1,41 @@
+name: Tag and release
+
+# Stage 2 of the release flow: whenever the version in config/app.php changes
+# on 2.x (normally by merging the PR opened by release.yml, but a hand-made
+# bump PR works too), create the matching tag and GitHub release.
+on:
+  push:
+    branches:
+      - 2.x
+    paths:
+      - config/app.php
+
+permissions:
+  contents: write
+
+jobs:
+  tag-release:
+    name: Tag and publish release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Create release if version is untagged
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          version=$(sed -nE "s/^[[:space:]]*'version' => '([0-9]+\.[0-9]+\.[0-9]+)',/\1/p" config/app.php)
+          if [ -z "$version" ]; then
+            echo "::error::Could not read version from config/app.php"
+            exit 1
+          fi
+          if git rev-parse -q --verify "refs/tags/v$version" > /dev/null; then
+            echo "Tag v$version already exists — nothing to do"
+            exit 0
+          fi
+          gh release create "v$version" \
+            --target "$GITHUB_SHA" \
+            --title "v$version" \
+            --generate-notes

.github/workflows/tag-version-check.yml

@@ -1,8 +1,8 @@
 name: Tag version check
 
 # Safety net for manually pushed tags: fails if the tag doesn't match the
-# version in config/app.php. Tags created by the Release workflow are pushed
-# with GITHUB_TOKEN and therefore don't trigger this (they always match anyway).
+# version in config/app.php. Tags created by tag-release.yml use GITHUB_TOKEN
+# and therefore don't trigger this (they always match anyway).
 on:
   push:
     tags: