fix(ci): trigger release workflow on main branch push

release-please-action needs to run on branch pushes (not tag pushes)
to properly create and manage Release PRs. When a Release PR is merged,
it creates the tag and GitHub release, then builds binaries.

Changes:
- Trigger on push to main instead of tag push
- Add pull-requests: write permission for creating Release PRs
- Add release-please-action step before checkout/precompile
- Make checkout and precompile conditional on release_created

Author: boneskull

.github/workflows/ci.yml

@@ -2,13 +2,18 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches:
+      - main # limit to main, because pushes to pull-requested branches are triggered below
   pull_request:
-    branches: [main]
+    # any pull request
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   lint:
     name: Lint

.github/workflows/release.yml

@@ -2,21 +2,33 @@ name: Release
 
 on:
   push:
-    tags:
-      - "v*"
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}
 
 permissions:
   contents: write
+  pull-requests: write
   id-token: write
   attestations: write
 
 jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Release Please
+        id: release
+        uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
+
+      - name: Checkout
+        if: ${{ steps.release.outputs.release_created }}
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
-      - uses: cli/gh-extension-precompile@v2
+      - name: Build and upload binaries
+        if: ${{ steps.release.outputs.release_created }}
+        uses: cli/gh-extension-precompile@v2
         with:
           generate_attestations: true
           go_version_file: go.mod