Merge pull request #643 from aws/fabisev/fix-ric-release-protected-branch

fix(ric): route release commits through PR to avoid protected main

Author: fabisev

.github/workflows/release-runtime-interface-client.yml

@@ -23,8 +23,9 @@ on:
         default: false
 
 permissions:
-  contents: write   # push release commit and tag
-  id-token: write   # assume the OIDC role for secret retrieval
+  contents: write        # push the release tag and the version-bump branch
+  id-token: write        # assume the OIDC role for secret retrieval
+  pull-requests: write   # open the post-release version-bump PR into main
 
 # Share the repo-wide "release" group with release.yml so RIC and the pure-Java
 # modules can never publish concurrently. Never cancel in-flight: it could leave
@@ -323,14 +324,35 @@ jobs:
             -Dgpg.keyname="$GPG_KEYNAME" -Dgpg.passphrase="$GPG_PASSPHRASE" \
             --file "$MODULE/pom.xml"
 
+      # main is protected (no direct push), so push the tag (tag pushes aren't
+      # gated by branch protection) and route the release + next-development
+      # version-bump commits through a PR, mirroring release.yml. A direct
+      # `git push ... HEAD:main` here is rejected with GH006 (protected branch).
       - name: Tag and push (only after publish succeeds)
         if: ${{ github.event.inputs.skip_publish != 'true' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
+          RELEASE_BRANCH="release/${TAG_NAME}"
+
+          # Release commit + tag (the tag points at the release version).
           git commit -am "chore(ric): release ${EFFECTIVE_RELEASE_VERSION}"
           git tag "$TAG_NAME"
+
+          # Next development version commit.
           mvn versions:set -DnewVersion="$NEXT_DEV_VERSION" -DgenerateBackupPoms=false --file "$MODULE/pom.xml"
           git commit -am "chore(ric): prepare next development ${NEXT_DEV_VERSION}"
-          git push --atomic origin "HEAD:${GITHUB_REF_NAME}" "refs/tags/${TAG_NAME}"
+
+          # Tag push isn't gated by branch protection; the version-bump commits
+          # go to a release branch and land on main via PR.
+          git push origin "refs/tags/${TAG_NAME}"
+          git push origin "HEAD:refs/heads/${RELEASE_BRANCH}"
+
+          gh pr create \
+            --base "${GITHUB_REF_NAME}" \
+            --head "${RELEASE_BRANCH}" \
+            --title "chore(release): ${MODULE} ${EFFECTIVE_RELEASE_VERSION}" \
+            --body "Post-release version bump for ${MODULE} ${EFFECTIVE_RELEASE_VERSION} (already on Maven Central, tag ${TAG_NAME} pushed)."
 
       # Dry-run: validate assembly, no publish/push.
       - name: Dry-run assemble (no publish)