Fix protected branch release tagging

.github/workflows/release.yml

@@ -40,12 +40,9 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          if [[ "$GITHUB_REF" != refs/heads/* ]]; then
-            echo "Create release must be run from a branch, not '$GITHUB_REF'." >&2
-            exit 1
-          fi
           BASE_VERSION="$(python3 -c 'import json; print(json.load(open("tools/release.json", encoding="utf-8"))["version"])')"
           RELEASE_VERSION="$(git ls-remote --tags --refs origin | python3 tools/next_release_version.py --base-version "$BASE_VERSION")"
+          PACKAGE_NAME="$(python3 -c 'import json; print(json.load(open("tools/release.json", encoding="utf-8"))["name"])')"
           RELEASE_CHANNEL="$(python3 -c 'import json; print(json.load(open("tools/release.json", encoding="utf-8")).get("release_channel", "stable"))')"
           case "$RELEASE_CHANNEL" in
             alpha|stable) ;;
@@ -63,19 +60,10 @@ jobs:
             echo "A GitHub release already exists for $RELEASE_TAG." >&2
             exit 1
           fi
-          python3 - "$RELEASE_VERSION" <<'PY'
-          import json
-          import sys
-          from pathlib import Path
-
-          manifest_path = Path("tools/release.json")
-          manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
-          manifest["version"] = sys.argv[1]
-          manifest_path.write_text(json.dumps(manifest, indent=2) + "\n", encoding="utf-8")
-          PY
           printf 'RELEASE_VERSION=%s\n' "$RELEASE_VERSION" >> "$GITHUB_ENV"
           printf 'RELEASE_TAG=%s\n' "$RELEASE_TAG" >> "$GITHUB_ENV"
           printf 'RELEASE_CHANNEL=%s\n' "$RELEASE_CHANNEL" >> "$GITHUB_ENV"
+          printf 'RELEASE_ARCHIVE=tools/dist/%s-%s.zip\n' "$PACKAGE_NAME" "$RELEASE_VERSION" >> "$GITHUB_ENV"
           printf 'release_version=%s\n' "$RELEASE_VERSION" >> "$GITHUB_OUTPUT"
           printf 'release_tag=%s\n' "$RELEASE_TAG" >> "$GITHUB_OUTPUT"
           printf 'release_channel=%s\n' "$RELEASE_CHANNEL" >> "$GITHUB_OUTPUT"
@@ -99,7 +87,7 @@ jobs:
           fi
 
       - name: Create deterministic release archive
-        run: python3 tools/package_release.py
+        run: python3 tools/package_release.py --output "$RELEASE_ARCHIVE"
 
       - name: Upload release files
         uses: actions/upload-artifact@v4
@@ -119,13 +107,7 @@ jobs:
           fi
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add tools/release.json
-          if ! git diff --cached --quiet; then
-            git commit --message "chore(release): $RELEASE_TAG"
-            git push origin "HEAD:$GITHUB_REF"
-          fi
-          RELEASE_COMMIT="$(git rev-parse HEAD)"
-          git tag --annotate "$RELEASE_TAG" --message "ZygorPlus ${RELEASE_TAG#v} (${RELEASE_CHANNEL})" "$RELEASE_COMMIT"
+          git tag --annotate "$RELEASE_TAG" --message "ZygorPlus ${RELEASE_TAG#v} (${RELEASE_CHANNEL})" "$GITHUB_SHA"
           git push origin "refs/tags/$RELEASE_TAG"
 
       - name: Publish GitHub release

tools/README.md

@@ -145,8 +145,9 @@ select that branch in **Actions → Create release → Run workflow**. The versi
 sets the release's major/minor stream and minimum patch. The workflow checks
 remote tags and uses that version when it is free; otherwise it automatically
 selects the next patch after the highest `vX.Y.Z` tag in that stream. It writes
-the selected version into `release.json` and commits that change on the chosen
-branch before tagging it.
+the selected version into the archive filename and tags the selected commit;
+it does not push a release commit to the chosen branch. This lets the workflow
+run from a protected branch.
 
 The workflow runs the complete automated suite and strict addon validation,
 builds the deterministic ZIP and checksum, preserves them as workflow