chore: Update release actions to run on Release env

Author: lahirumaramba

.github/workflows/ci.yml

@@ -1,7 +1,10 @@
 name: Continuous Integration
-on: pull_request
-jobs:
+on:
+  pull_request:
+  push:
+    branches: [dev]
 
+jobs:
   module:
     name: Module build
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -18,31 +18,34 @@ on:
   # Only run the workflow when a PR is updated or when a developer explicitly requests
   # a build by sending a 'firebase_build' event.
   pull_request:
-    types: [opened, synchronize, closed]
+    types: [opened, synchronize]
 
   repository_dispatch:
     types:
       - firebase_build
 
+  # Run the release candidate action when code is pushed to dev and only if firebase.go is changed
+  push:
+    branches:
+      - dev
+    paths:
+      - 'firebase.go'
+
 jobs:
   stage_release:
     # To publish a release, merge the release PR with the label 'release:publish'.
     # To stage a release without publishing it, send a 'firebase_build' event or apply
     # the 'release:stage' label to a PR.
     if: github.event.action == 'firebase_build' ||
       contains(github.event.pull_request.labels.*.name, 'release:stage') ||
-      (github.event.pull_request.merged &&
-        contains(github.event.pull_request.labels.*.name, 'release:publish'))
+      (github.event_name == 'push' && github.ref == 'refs/heads/dev' &&
+        startsWith(github.event.head_commit.message, '[chore] Release '))
 
     runs-on: ubuntu-latest
 
-    # When manually triggering the build, the requester can specify a target branch or a tag
-    # via the 'ref' client parameter.
     steps:
     - name: Check out code
       uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-      with:
-        ref: ${{ github.event.client_payload.ref || github.ref }}
 
     - name: Set up Go
       uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
@@ -65,26 +68,22 @@ jobs:
   publish_release:
     needs: stage_release
 
-    # Check whether the release should be published. We publish only when the trigger PR is
-    #   1. merged
-    #   2. to the dev branch
-    #   3. with the label 'release:publish', and
-    #   4. the title prefix '[chore] Release '.
-    if: github.event.pull_request.merged &&
-      github.ref == 'refs/heads/dev' &&
-      contains(github.event.pull_request.labels.*.name, 'release:publish') &&
-      startsWith(github.event.pull_request.title, '[chore] Release ')
+    # Run this ONLY when code is pushed/merged to dev
+    # This automatically satisfies the 'Release' environment protection
+    if: github.event_name == 'push' && github.ref == 'refs/heads/dev' &&
+      startsWith(github.event.head_commit.message, '[chore] Release ')
 
     runs-on: ubuntu-latest
     environment: Release
     permissions:
-      contents: write
+      pull-requests: write
 
     steps:
     - name: Checkout source for publish
       uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         persist-credentials: false
+        fetch-depth: 0
 
     - name: Publish preflight check
       id: preflight
@@ -94,10 +93,11 @@ jobs:
     - name: Create Release PR
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        RELEASE_BODY: ${{ steps.preflight.outputs.changelog }}
+        RELEASE_TITLE: "[chore] Release ${{ steps.preflight.outputs.version }}"
       run: |
         gh pr create \
           --base master \
           --head dev \
-          --title "[chore] Release ${{ steps.preflight.outputs.version }}" \
-          --body "${{ steps.preflight.outputs.changelog }}" \
-          --label "release:tag"
+          --title "$RELEASE_TITLE" \
+          --body "$RELEASE_BODY"

.github/workflows/tag_release.yml

@@ -15,19 +15,15 @@
 name: Tag Release
 
 on:
-  pull_request:
-    types: [closed]
+  push:
+    branches:
+      - master
+    paths:
+      - 'firebase.go'
 
 jobs:
   tag_release:
-    # Trigger only when:
-    # 1. The PR is merged.
-    # 2. The PR targets the master branch.
-    # 3. The PR has the label 'release:tag'.
-    if: github.event.pull_request.merged &&
-      github.event.pull_request.base.ref == 'master' &&
-      contains(github.event.pull_request.labels.*.name, 'release:tag') &&
-      startsWith(github.event.pull_request.title, '[chore] Release ')
+    if: startsWith(github.event.head_commit.message, '[chore] Release ')
 
     runs-on: ubuntu-latest
     environment: Release
@@ -38,17 +34,18 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
-        ref: master
+        fetch-depth: 0
 
     - name: Publish preflight check
       id: preflight
       run: ./.github/scripts/publish_preflight_check.sh
 
-    # See: https://cli.github.com/manual/gh_release_create
     - name: Create release tag
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: gh release create ${{ steps.preflight.outputs.version }}
-            --title "Firebase Admin Go SDK ${{ steps.preflight.outputs.version }}"
-            --notes '${{ steps.preflight.outputs.changelog }}'
+        RELEASE_VER: ${{ steps.preflight.outputs.version }}
+        RELEASE_NOTES: ${{ steps.preflight.outputs.changelog }}
+      run: gh release create "$RELEASE_VER" \
+            --title "Firebase Admin Go SDK $RELEASE_VER" \
+            --notes "$RELEASE_NOTES" \
             --target "master"