Replace push-protected with direct push via TEAM4-0 bypass

[CasperWA]

Summary

• Replaces CasperWA/push-protected@v2 with a direct git push authenticated as TEAM4-0.
• actions/checkout now uses token: RELEASE_PAT so the persisted credential is already TEAM4-0's PAT — no remote URL manipulation needed.
• A repository ruleset (master branch protection, id 15349357) enforces the 6 required status checks on master with TEAM4-0 as an explicit always-bypass actor (configured out-of-band via the GitHub API).
• The classic branch protection's required_status_checks has been cleared (enforcement_level: off) so the ruleset is the sole enforcer.
• Removes the now-dead push-action/** branch trigger from ci_tests.yml.

Why push-protected stopped working

push-protected works by pushing the commit to a temp push-action/** branch, waiting for CI to run there, then pushing to master. GitHub no longer triggers new workflow runs for pushes made from within a running workflow — even when using a PAT instead of GITHUB_TOKEN. As a result the temp branch CI never starts, push-protected declares all 0 jobs complete, and the push to master fails with GH006: 6 of 6 required status checks are expected.

Why direct push now works

The new ruleset adds TEAM4-0 to the bypass list with bypass_mode: always. Because the checkout step persists RELEASE_PAT as the git credential, the subsequent git push is authenticated as TEAM4-0 and is exempt from the status check requirement. All other pushes (PR merges by humans) still require the 6 checks to pass.

Test plan

• Merge this PR and confirm the next CD release run pushes the [bot] Update version and CHANGELOG commit to master without the GH006 error.

Click to view squash commit message

Replace push-protected with direct push via TEAM4-0 bypass

The push-protected action relies on CI running on the push-action/**
temp branch to satisfy required status checks before pushing to master.
GitHub no longer triggers workflows for pushes made from within a
running workflow, so the temp branch CI never runs, push-protected
declares all checks vacuously complete, and the push fails.

Instead, a repository ruleset now enforces required status checks on
master with TEAM4-0 as an explicit bypass actor. The checkout step uses
RELEASE_PAT so the persisted credential is already TEAM4-0's token,
and the CD workflow pushes directly via git push — no remote URL
manipulation needed.

Also removes the dead push-action/** trigger from ci_tests.yml, which
only existed to support push-protected's temp branches.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.34%. Comparing base (0a48c4e) to head (68904ae).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #721   +/-   ##
=======================================
  Coverage   84.34%   84.34%           
=======================================
  Files          26       26           
  Lines         805      805           
=======================================
  Hits          679      679           
  Misses        126      126           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR updates the CD release workflow to stop using CasperWA/push-protected@v2 and instead push directly to master using a PAT intended to authenticate as the TEAM4-0 bot user, relying on a repository ruleset bypass for required status checks.

Changes:

• Replaced CasperWA/push-protected@v2 with a shell step that sets an authenticated origin URL and runs git push to the default branch.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.