ci: gate main behind a stable ci-ok context and run real CI on release commits before pushing to protected main

Author: ph33nx

.github/workflows/ci.yml

@@ -4,6 +4,7 @@ on:
   pull_request:
   push:
     branches: [main]
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -53,3 +54,13 @@ jobs:
         run: go test .
         env:
           ROXY_API_KEY: ${{ secrets.ROXY_API_KEY }}
+
+  # Single stable context for branch protection: matrix legs rename as Go versions rotate, this name never does.
+  ci-ok:
+    if: always()
+    needs: [checks, test]
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+          test "${{ needs.checks.result }}" = "success"
+          test "${{ needs.test.result }}" = "success"

.github/workflows/release.yml

@@ -14,6 +14,7 @@ on:
 
 permissions:
   contents: write
+  actions: write
 
 jobs:
   release:
@@ -67,14 +68,29 @@ jobs:
 
       - name: Commit, tag, push
         if: steps.diff.outputs.changed == 'true' || github.event_name == 'workflow_dispatch'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           V=${{ steps.bump.outputs.version }}
           git add specs/openapi.json roxyapi.gen.go roxy.gen.go version.go README.md AGENTS.md docs/llms-full.txt
           git commit -m "release: v$V"
           git tag "v$V"
+          # Protected main requires the ci-ok context green on every pushed SHA, and a direct push can never carry one. So park the commit on a temp branch, run the real CI there via workflow_dispatch (GITHUB_TOKEN pushes trigger no workflows on their own), and push to main only after it reports green.
+          SHA=$(git rev-parse HEAD)
+          git push --force origin "HEAD:refs/heads/release-checks"
+          gh workflow run ci.yml --ref release-checks
+          RUN_ID=""
+          for _ in $(seq 1 24); do
+            sleep 5
+            RUN_ID=$(gh run list --workflow=ci.yml --branch=release-checks --limit 5 --json databaseId,headSha --jq "[.[] | select(.headSha == \"$SHA\")][0].databaseId // empty")
+            [ -n "$RUN_ID" ] && break
+          done
+          [ -n "$RUN_ID" ] || { echo "dispatched CI run never appeared for $SHA"; exit 1; }
+          gh run watch "$RUN_ID" --exit-status
           git push --follow-tags
+          git push origin --delete release-checks || true
 
       - name: Index new version on pkg.go.dev
         if: steps.diff.outputs.changed == 'true' || github.event_name == 'workflow_dispatch'