automatic release updated

.github/workflows/release.yml

@@ -14,6 +14,7 @@ jobs:
 
     permissions:
       contents: write
+      pull-requests: write
 
     outputs:
       version: ${{ steps.get_version.outputs.VERSION }}
@@ -68,17 +69,60 @@ jobs:
           git-cliff --unreleased --strip all --tag "v${{ steps.get_version.outputs.VERSION }}" > RELEASE_NOTES.md
           git-cliff --unreleased --tag "v${{ steps.get_version.outputs.VERSION }}" --prepend CHANGELOG.md
 
-      - name: Commit and push CHANGELOG.md
+      - name: Open CHANGELOG.md PR and wait for merge
+        id: changelog_pr
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          VERSION="${{ steps.get_version.outputs.VERSION }}"
+          BRANCH="chore/changelog-v${VERSION}"
+
           git config user.name "github-actions"
           git config user.email "github-actions@github.com"
+          git checkout -b "$BRANCH"
           git add CHANGELOG.md
-          git commit -m "chore: update CHANGELOG.md for v${{ steps.get_version.outputs.VERSION }}"
-          git push origin HEAD:main
+          git commit -m "chore: update CHANGELOG.md for v${VERSION}"
+          git push origin "$BRANCH"
+
+          # main is a protected branch (requires a PR), so open one instead
+          # of pushing directly, and try to auto-merge it.
+          PR_URL=$(gh pr create \
+            --base main \
+            --head "$BRANCH" \
+            --title "chore: update CHANGELOG.md for v${VERSION}" \
+            --body "Automated CHANGELOG.md update for the v${VERSION} release.")
+          echo "PR_URL=$PR_URL"
+
+          # Requires "Allow auto-merge" enabled on the repo. If main also
+          # requires human approval, this queues the merge but won't force it.
+          gh pr merge "$PR_URL" --squash --auto || true
+
+          echo "Waiting for $PR_URL to merge (up to 15 minutes)..."
+          MERGED=false
+          for i in $(seq 1 60); do
+            STATE=$(gh pr view "$PR_URL" --json state -q .state)
+            if [ "$STATE" = "MERGED" ]; then
+              MERGED=true
+              break
+            fi
+            if [ "$STATE" = "CLOSED" ]; then
+              echo "::error::PR was closed without merging: $PR_URL"
+              exit 1
+            fi
+            sleep 15
+          done
+
+          if [ "$MERGED" != "true" ]; then
+            echo "::error::Timed out waiting for the CHANGELOG.md PR to merge. It may need manual approval/merge: $PR_URL"
+            exit 1
+          fi
+
+          MERGE_SHA=$(gh pr view "$PR_URL" --json mergeCommit -q .mergeCommit.oid)
+          echo "MERGE_SHA=$MERGE_SHA" >> "$GITHUB_OUTPUT"
 
       - name: Create Git tag
         run: |
-          git tag v${{ steps.get_version.outputs.VERSION }}
+          git tag v${{ steps.get_version.outputs.VERSION }} ${{ steps.changelog_pr.outputs.MERGE_SHA }}
           git push origin v${{ steps.get_version.outputs.VERSION }}
 
       - name: Create GitHub Release