ci: open PR for post-release version bump instead of direct push (#547)

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: jbachorik

.github/scripts/release.sh

@@ -127,7 +127,21 @@ CANDIDATE=$(./gradlew printVersion -Psnapshot=false | grep 'Version:' | cut -f2
 git add build.gradle.kts
 git commit -m "[Automated] Bump dev version to ${CANDIDATE}"
 
-git push $DRYRUN --atomic --set-upstream origin $BRANCH
+if [ -z "$DRYRUN" ]; then
+  BUMP_BRANCH="automated/bump-${CANDIDATE//./-}"
+  git checkout -b "$BUMP_BRANCH"
+  git push --set-upstream origin "$BUMP_BRANCH"
+  BUMP_PR_URL=$(gh pr create \
+    --title "[Automated] Bump dev version to ${CANDIDATE}" \
+    --body "Automated version bump after releasing v${BASE}. Please review and merge." \
+    --base "$BRANCH" \
+    --head "$BUMP_BRANCH")
+  echo "BUMP_PR_URL=$BUMP_PR_URL" >> "${GITHUB_OUTPUT:-/dev/null}"
+  echo "⚠ Version bump PR requires manual approval: $BUMP_PR_URL"
+else
+  git push $DRYRUN --atomic --set-upstream origin $BRANCH
+fi
+
 git push $DRYRUN --atomic --tags
 
 echo "==================== RELEASE SUMMARY ===================="

.github/workflows/release-validated.yml

@@ -27,6 +27,7 @@ on:
 permissions:
   contents: write
   actions: read
+  pull-requests: write
 
 jobs:
   validate-inputs:
@@ -193,6 +194,7 @@ jobs:
           java-version: '21'
 
       - name: Create release
+        id: create-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
@@ -209,13 +211,21 @@ jobs:
 
       - name: Output Release Summary
         if: ${{ inputs.dry_run != true }}
+        env:
+          BUMP_PR_URL: ${{ steps.create-release.outputs.BUMP_PR_URL }}
         run: |
           echo "## ✅ Release Created Successfully" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "### Release Details" >> $GITHUB_STEP_SUMMARY
           echo "- **Tag**: v_${{ needs.validate-inputs.outputs.release_version }}" >> $GITHUB_STEP_SUMMARY
           echo "- **Branch**: ${{ needs.validate-inputs.outputs.release_branch }}" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
+          if [ -n "$BUMP_PR_URL" ]; then
+            echo "### ⚠ Action Required" >> $GITHUB_STEP_SUMMARY
+            echo "A version bump PR needs review and merge before the next snapshot builds carry the correct version:" >> $GITHUB_STEP_SUMMARY
+            echo "- $BUMP_PR_URL" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+          fi
           echo "### Next Steps (Automatic)" >> $GITHUB_STEP_SUMMARY
           echo "1. 🔨 GitLab pipeline will build multi-platform artifacts" >> $GITHUB_STEP_SUMMARY
           echo "2. 📦 GitLab will publish to Maven Central" >> $GITHUB_STEP_SUMMARY