From ba740124a648700ebd0e5d3c7430332f8c9ffd13 Mon Sep 17 00:00:00 2001
From: dynamder <igaster@163.com>
Date: Wed, 19 Aug 2026 19:18:56 +0800
Subject: [PATCH] fix(cd): release via PR on protected main; bump cargo-deny
 action to v2

The main-protect ruleset requires pushes to main to come through a pull
request (only admins may bypass), so the CD workflow's direct
'git push origin main --follow-tags' was declined after cargo-release had
already committed the version bump and pushed the v0.3.0 tag. Rework the
flow: push the release commit to a release/vX.Y.Z branch, open a PR, and
merge it through the protected flow; push the (unprotected) tag afterwards.
Also grant the job pull-requests: write.

Security Audit: EmbarkStudios/cargo-deny-action@v1 bundles cargo-deny
0.14.21 (2023), which fails to parse newer rustsec advisory entries
(RUSTSEC-2026-0066: TOML parse error) and makes every audit red. Bump to
@v2 and add a workflow_dispatch trigger so the audit can be re-run and
verified manually.
---
 .github/workflows/audit.yml |  5 ++++-
 .github/workflows/cd.yml    | 23 ++++++++++++++++++++++-
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 8b19088..31efff0 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -3,6 +3,7 @@ name: Security Audit
 on:
   schedule:
     - cron: '0 8 * * 1'
+  workflow_dispatch:
   push:
     branches: [main]
     paths:
@@ -15,4 +16,6 @@ jobs:
     continue-on-error: false
     steps:
       - uses: actions/checkout@v4
-      - uses: EmbarkStudios/cargo-deny-action@v1
+      # v2 bundles a current cargo-deny; the old v1 (cargo-deny 0.14.21)
+      # fails to parse newer entries in the rustsec advisory database.
+      - uses: EmbarkStudios/cargo-deny-action@v2
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 5432c17..c82b832 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -29,6 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      pull-requests: write
 
     steps:
       - uses: actions/checkout@v4
@@ -75,9 +76,29 @@ jobs:
         if: always()
         run: rm -rf semver-checks
 
+      # `main` is protected by the `main-protect` ruleset (pushes must come
+      # through a pull request; only repository admins may bypass), so a direct
+      # `git push origin main` is declined. Instead: push the release commit to
+      # a `release/vX.Y.Z` branch, open a PR, and merge it through the normal
+      # protected flow. Tags are not protected and are pushed afterwards.
+      - name: Open release PR and merge
+        if: ${{ !inputs.skip_bump }}
+        run: |
+          VERSION="$(cargo pkgid -p funera-core | sed 's/.*#//')"
+          BRANCH="release/v${VERSION}"
+          git push origin "HEAD:${BRANCH}"
+          PR_URL="$(gh pr create --base main --head "${BRANCH}" \
+            --title "chore: release v${VERSION}" \
+            --body "Automated release prepared by the CD workflow (version bump to v${VERSION}).")"
+          gh pr merge --merge --delete-branch "${PR_URL}"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Push tag
         if: ${{ !inputs.skip_bump }}
-        run: git push origin main --follow-tags
+        run: |
+          VERSION="$(cargo pkgid -p funera-core | sed 's/.*#//')"
+          git push origin "refs/tags/v${VERSION}"
 
       - name: Publish funera_core
         run: cargo publish -p funera-core --token ${{ secrets.CARGO_REGISTRY_TOKEN }}