ci: plain release push and manual dependabot merges, drop auto-merge and its required check gate

Author: ph33nx

.github/workflows/ci.yml

@@ -4,7 +4,6 @@ on:
   pull_request:
   push:
     branches: [main]
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -54,13 +53,3 @@ jobs:
         run: go test .
         env:
           ROXY_API_KEY: ${{ secrets.ROXY_API_KEY }}
-
-  # Single stable context for branch protection: matrix legs rename as Go versions rotate, this name never does.
-  ci-ok:
-    if: always()
-    needs: [checks, test]
-    runs-on: ubuntu-latest
-    steps:
-      - run: |
-          test "${{ needs.checks.result }}" = "success"
-          test "${{ needs.test.result }}" = "success"

.github/workflows/dependabot-auto-merge.yml

@@ -14,7 +14,6 @@ on:
 
 permissions:
   contents: write
-  actions: write
 
 jobs:
   release:
@@ -68,29 +67,14 @@ jobs:
 
       - name: Commit, tag, push
         if: steps.diff.outputs.changed == 'true' || github.event_name == 'workflow_dispatch'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           V=${{ steps.bump.outputs.version }}
           git add specs/openapi.json roxyapi.gen.go roxy.gen.go version.go README.md AGENTS.md docs/llms-full.txt
           git commit -m "release: v$V"
           git tag "v$V"
-          # Protected main requires the ci-ok context green on every pushed SHA, and a direct push can never carry one. So park the commit on a temp branch, run the real CI there via workflow_dispatch (GITHUB_TOKEN pushes trigger no workflows on their own), and push to main only after it reports green.
-          SHA=$(git rev-parse HEAD)
-          git push --force origin "HEAD:refs/heads/release-checks"
-          gh workflow run ci.yml --ref release-checks
-          RUN_ID=""
-          for _ in $(seq 1 24); do
-            sleep 5
-            RUN_ID=$(gh run list --workflow=ci.yml --branch=release-checks --limit 5 --json databaseId,headSha --jq "[.[] | select(.headSha == \"$SHA\")][0].databaseId // empty")
-            [ -n "$RUN_ID" ] && break
-          done
-          [ -n "$RUN_ID" ] || { echo "dispatched CI run never appeared for $SHA"; exit 1; }
-          gh run watch "$RUN_ID" --exit-status
           git push --follow-tags
-          git push origin --delete release-checks || true
 
       - name: Index new version on pkg.go.dev
         if: steps.diff.outputs.changed == 'true' || github.event_name == 'workflow_dispatch'