ci: fix release branch-off permissions and gate releases on maintainer role (deepset-ai#11485)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: julian-risch

.github/workflows/branch_off.yml

@@ -1,7 +1,6 @@
 name: Branch off
 
 on:
-  workflow_dispatch:
   workflow_call:
     outputs:
       bump_version_pr_url:
@@ -24,6 +23,11 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: main
+          # Persist the bot token so the branch/tag pushes below authenticate as
+          # HaystackBot (a ruleset-bypass actor) instead of the default
+          # github-actions[bot], which only has contents:read and is blocked by
+          # the release rulesets.
+          token: ${{ secrets.HAYSTACK_BOT_TOKEN }}
 
       - name: Define all versions
         id: versions

.github/workflows/release.yml

@@ -17,7 +17,30 @@ permissions:
   contents: read
 
 jobs:
+  authorize:
+    # Releasing acts as HaystackBot (a ruleset-bypass actor), so the ruleset
+    # cannot enforce *who* started the release. Gate on the triggering user's
+    # role instead: only maintainers/admins may run this workflow, even though
+    # workflow_dispatch itself is available to anyone with write access.
+    runs-on: ubuntu-slim
+    steps:
+      - name: Verify the triggering user may release
+        env:
+          GH_TOKEN: ${{ secrets.HAYSTACK_BOT_TOKEN }}
+          ACTOR: ${{ github.triggering_actor }}
+        run: |
+          ROLE=$(gh api "repos/${{ github.repository }}/collaborators/${ACTOR}/permission" --jq '.role_name')
+          echo "::notice::${ACTOR} has repository role '${ROLE}'"
+          case "$ROLE" in
+            admin|maintain)
+              echo "✅ ${ACTOR} is authorized to trigger a release." ;;
+            *)
+              echo "::error::${ACTOR} has role '${ROLE}'. A release can only be triggered by a user with the 'maintain' or 'admin' role."
+              exit 1 ;;
+          esac
+
   parse-validate-version:
+    needs: ["authorize"]
     runs-on: ubuntu-slim
     outputs:
       version: ${{ steps.parse-validate.outputs.version }}