ci: release from main and retire dev

.github/workflows/ci.yml

@@ -1,10 +1,11 @@
 name: CI
 
 on:
-  push:
-    branches: ["**"]
   pull_request:
     branches: ["**"]
+  # release-plz opens its pull request under GITHUB_TOKEN, which starts no
+  # workflow, so the release workflow dispatches CI on the release branch.
+  workflow_dispatch:
 
 env:
   CARGO_TERM_COLOR: always
@@ -182,3 +183,21 @@ jobs:
       - uses: taiki-e/install-action@cargo-machete
 
       - run: cargo machete
+
+  # The one required check on `main`: it passes only when every job above did.
+  ci-result:
+    name: CI result
+    if: always()
+    needs: [lint, test, wasm, minimal-versions, coverage, feature-checks, audit, unused-deps]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check job results
+        env:
+          RESULTS: ${{ join(needs.*.result, ', ') }}
+          FAILED: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
+        run: |
+          echo "job results: $RESULTS"
+          if [ "$FAILED" = "true" ]; then
+            echo "::error::one or more jobs failed or were cancelled"
+            exit 1
+          fi

.github/workflows/release.yml

@@ -1,19 +1,16 @@
 name: Release
 
-# `release` publishes what a push to `main` carries; the required checks on
-# `main` already proved the merged commit. `release-pr` keeps the version bump
-# and changelog pull request open against `dev` on every push to `dev`. The
-# bump belongs on `dev` because a pull request opened with the default
-# `GITHUB_TOKEN` starts no workflow runs, so one targeting `main` could never
-# satisfy the required check there.
+# Every push to `main` runs both jobs: `release` publishes what the push
+# carries (the required `CI result` check on `main` already proved the merged
+# commit), and `release-pr` opens or refreshes the version bump and changelog
+# pull request against `main`. Merging that pull request is the release.
 on:
   push:
-    branches: [main, dev]
+    branches: [main]
 
 jobs:
   release:
     name: Publish release
-    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -46,37 +43,35 @@ jobs:
 
   release-pr:
     name: Prepare next release
-    if: github.ref == 'refs/heads/dev'
     runs-on: ubuntu-latest
     permissions:
       contents: write
       pull-requests: write
+      # The dispatch below starts CI on the release branch.
+      actions: write
     concurrency:
-      group: release-plz-dev
+      group: release-plz-pr
       cancel-in-progress: false
     steps:
-      - name: Checkout the pushed dev commit
+      - name: Checkout the pushed main commit
         uses: actions/checkout@v6
         with:
-          ref: dev
           fetch-depth: 0
           persist-credentials: false
-      - name: Verify pushed commit
-        env:
-          EXPECTED_SHA: ${{ github.sha }}
-        run: |
-          actual_sha="$(git rev-parse HEAD)"
-          if [[ "$actual_sha" != "$EXPECTED_SHA" ]]; then
-            echo "::error::dev moved after this push: expected $EXPECTED_SHA, checked out $actual_sha"
-            exit 1
-          fi
       - *rust-toolchain
-      # The pull request lands the bump on `dev`; the release itself is the
-      # `dev` -> `main` pull request that carries it, which runs the full
-      # check set.
       - name: Create or update release PR
+        id: release-plz
         uses: release-plz/[email protected]
         with:
           command: release-pr
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # A pull request opened or pushed under GITHUB_TOKEN starts no
+      # workflow, so the required `CI result` would never report on it;
+      # dispatching CI on its branch is the exception GITHUB_TOKEN allows.
+      - name: Run CI on the release branch
+        if: steps.release-plz.outputs.prs_created == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR: ${{ steps.release-plz.outputs.pr }}
+        run: gh workflow run ci.yml -R "$GITHUB_REPOSITORY" --ref "$(jq -er .head_branch <<<"$PR")"