ci(workflows): gate release behind dev experience

Trigger Release from successful Developer Experience push runs on main/next.
Update Developer Experience to run on push.
Guard PR-only comment steps so both pull_request_target and push events work.

Author: mrclrchtr

.github/workflows/dev-experience.yml

@@ -1,6 +1,10 @@
 name: Developer Experience
 on:
   workflow_dispatch:
+  push:
+    branches:
+      - main
+      - next
   pull_request_target:
     types:
       - opened
@@ -68,7 +72,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+          ref: ${{ github.event_name == 'pull_request_target' && format('refs/pull/{0}/merge', github.event.pull_request.number) || github.sha }}
       - name: Configure IaC plugin cache
         run: |
           echo 'plugin_cache_dir = "$HOME/.terraform.d/plugin-cache"' > ~/.terraformrc
@@ -110,7 +114,7 @@ jobs:
         run: ${{ matrix.cli }} validate -no-color
         continue-on-error: true
       - name: Find Comment
-        if: matrix.engine == 'terraform'
+        if: matrix.engine == 'terraform' && github.event_name == 'pull_request_target'
         uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4
         id: find-comment
         with:
@@ -119,7 +123,7 @@ jobs:
           body-includes: |
             Terraform-Check (version: ${{ steps.terraform-version.outputs.TERRAFORM_VERSION }})
       - name: Create or update comment
-        if: matrix.engine == 'terraform'
+        if: matrix.engine == 'terraform' && github.event_name == 'pull_request_target'
         uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5
         with:
           comment-id: ${{ steps.find-comment.outputs.comment-id }}
@@ -183,7 +187,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+          ref: ${{ github.event_name == 'pull_request_target' && format('refs/pull/{0}/merge', github.event.pull_request.number) || github.sha }}
       - name: Setup Node and Yarn Cache
         uses: ./.github/actions/setup-node-and-yarn-cache
         with:
@@ -202,19 +206,19 @@ jobs:
           yarn commitlint --from ${{ github.event.pull_request.head.sha }}~${{ github.event.pull_request.commits }} --to ${{ github.event.pull_request.head.sha }} --verbose > commitlint_output.txt
         working-directory: ./.github/commitlint
       - name: Print commitlint output
-        if: ${{ always() }}
+        if: ${{ always() && github.event_name == 'pull_request_target' }}
         run: |
           echo $(cat ./.github/commitlint/commitlint_output.txt)
       - name: Set commitlint output to env
-        if: ${{ always() }}
+        if: ${{ always() && github.event_name == 'pull_request_target' }}
         run: |
           {
             echo 'commitlint_output<<EOF'
             cat ./.github/commitlint/commitlint_output.txt
             echo EOF
           } >> "$GITHUB_ENV"
       - name: Find Comment
-        if: ${{ always() }}
+        if: ${{ always() && github.event_name == 'pull_request_target' }}
         uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4
         id: find-comment
         with:
@@ -223,7 +227,7 @@ jobs:
           body-includes: |
             Commitlint-Check
       - name: Create or update commitlint comment on failure
-        if: ${{ failure() }}
+        if: ${{ failure() && github.event_name == 'pull_request_target' }}
         uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5
         with:
           comment-id: ${{ steps.find-comment.outputs.comment-id }}
@@ -242,7 +246,7 @@ jobs:
             Please update the commit messages accordingly.
           reactions: eyes
       - name: Create or update commitlint comment on success
-        if: ${{ success() }}
+        if: ${{ success() && github.event_name == 'pull_request_target' }}
         uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5
         with:
           comment-id: ${{ steps.find-comment.outputs.comment-id }}

.github/workflows/release.yml

@@ -1,19 +1,24 @@
 name: Release
 on:
   workflow_dispatch:
-  push:
+  workflow_run:
+    workflows:
+      - Developer Experience
+    types:
+      - completed
     branches:
       - main
       - next
 
 permissions: read-all
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch || github.ref }}
   cancel-in-progress: false
 
 jobs:
   release:
+    if: ${{ github.event_name == 'workflow_dispatch' || (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push') }}
     runs-on: ubuntu-latest
     steps:
       - name: Create GitHub App Token
@@ -26,6 +31,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
       - name: Semantic Release
         uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90 # v6.0.0
         env: