fix(release): read checks with workflow token

[tkkhq]

Tracking

• Related: release: 0.23.1 #178
• Related: fix(release): bypass reviews after checks #179

Why

• release automation cannot merge a ready release PR because the scoped app token receives HTTP 403 when it reads branch protection
• feature-ref workflow dispatches can currently mint the privileged app token and run the release merge path
• a review-bypass merge must remain blocked by every release CI signal

Summary

• read required PR checks with the read-only workflow token
• keep release PR discovery and merge on the scoped app token
• require the complete nine-check server-enforced set before the app merge
• wait for all reported checks and reject failed, cancelled, or pending results
• restrict the release job to main and serialize all release runs in one concurrency group
• run the release workflow guard in CI and reject unsafe token, ref, check, and merge behavior
• configure main branch protection to require the nine current CI signals at merge time

Verification

• make release-workflow-check
• actionlint .github/workflows/release-please.yml .github/workflows/check.yml
• shellcheck scripts/ci/check-release-workflow.sh
• make check
• verified gh pr checks --required reports all nine server-required checks for PR fix(release): read checks with workflow token #180
• verified https://github.com/Kong/volcano-cli/actions/runs/33471286813 passed the required check / check and check / localmode-e2e jobs at commit f72c002
• verified https://github.com/Kong/volcano-cli/actions/runs/33469705022 skipped every privileged step for a feature-ref dispatch
• verified https://github.com/Kong/volcano-cli/actions/runs/33468639558 used the real workflow and app tokens to merge release PR release: 0.23.1 #178 on the checks-passed path
• final independent review found no actionable P0-P3 findings at commit f72c002

[Copilot]

Pull request overview

Updates release automation to read required PR checks with the workflow token while retaining the scoped app token for release operations.

Changes:

• Grants read-only check and pull-request permissions.
• Uses github.token for required-check discovery and waiting.
• Adds workflow guards against branch-protection API usage.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/release-please.yml	Separates check reads from app-authorized release writes.
scripts/ci/check-release-workflow.sh	Validates token usage and required-check handling.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[swkeever]

Reviewed the workflow-token/app-token separation, main-ref guard, complete required-check gating, all-check fail-closed behavior, and head-SHA pinning. Local checks pass and the current required server checks match the enforced set.