Fix: Let release-sync satisfy the main guard without a PAT

A pull request opened with GITHUB_TOKEN triggers no workflows, so the required
only-release-into-main check never reported and the release PR could never
merge. release-sync now sets that status on the release commit it generated.
Same change as python-multiplatform.

Author: b-re-w

.github/workflows/release-sync.yml

@@ -10,6 +10,7 @@ on:
 permissions:
   contents: write
   pull-requests: write
+  statuses: write
 
 concurrency:
   group: release-sync
@@ -33,9 +34,8 @@ jobs:
 
       - name: Open or update PR release -> main
         env:
-          # PRs created with GITHUB_TOKEN do not trigger other workflows, so the
-          # main-source-guard check would never run on this PR. Set the optional
-          # secret RELEASE_PR_TOKEN (PAT or app token) to make it run.
+          # Needs "Allow GitHub Actions to create and approve pull requests" in the
+          # repository's Actions settings. RELEASE_PR_TOKEN is optional.
           GH_TOKEN: ${{ secrets.RELEASE_PR_TOKEN || github.token }}
         run: |
           set -eu
@@ -51,3 +51,17 @@ jobs:
           else
             gh pr create --head release --base main --title "$title" --body "$body"
           fi
+
+      # A PR opened with GITHUB_TOKEN triggers no workflows, so main-source-guard
+      # never runs on it. Report the guard's verdict for the release commit here:
+      # this job just generated it from develop, which is exactly what the guard
+      # requires. A status set with GITHUB_TOKEN satisfies a required check.
+      - name: Mark release as passing the main source guard
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -eu
+          if ! git rev-parse -q --verify refs/heads/release >/dev/null; then exit 0; fi
+          gh api "repos/${GITHUB_REPOSITORY}/statuses/$(git rev-parse release)" \
+            -f state=success -f context=only-release-into-main \
+            -f description="generated from develop ${GITHUB_SHA::7} by release-sync"

tools/release/README.md

@@ -12,11 +12,13 @@ ignored and overwritten.
    whose tree is the develop tree minus the files below. This happens even when nothing
    is dropped. It is a no-op only if `release` already has that tree and that parent.
    The push uses `--force-with-lease` pinned to the remote sha the run observed.
-2. The workflow opens (or updates) a pull request `release` -> `main`. PRs created with
-   the default `GITHUB_TOKEN` do not trigger other workflows, so `main-source-guard`
-   would not run on them. To make it run, add a repository secret `RELEASE_PR_TOKEN`
-   (a PAT or GitHub App token with pull-request write access); the workflow uses it
-   when present and falls back to `github.token` otherwise.
+2. The workflow opens (or updates) a pull request `release` -> `main` with the default
+   `GITHUB_TOKEN`. This needs the repository setting *Actions -> General -> Allow GitHub
+   Actions to create and approve pull requests*. A PR opened with `GITHUB_TOKEN`
+   triggers no workflows, so `main-source-guard` would never run on it; the workflow
+   therefore sets the `only-release-into-main` commit status on the release commit
+   itself, which satisfies the required check. No PAT is needed; an optional
+   `RELEASE_PR_TOKEN` secret is used for the PR step when present.
 3. Merging that PR is the only way to change `main`. `main-source-guard.yml` fails
    any PR into `main` whose head is not `release`.
 4. On push to `main`, `pages.yml` deploys `docs/guide/` to GitHub Pages.