Merge branch 'dev' into jj/W-15639759

.github/workflows/create-release-branch.yml

@@ -61,8 +61,8 @@ jobs:
         with:
           node-version: 'lts/*' # Always use Node LTS for building dependencies.
       - run: yarn
-      # Increment the version as desired.
-      - name: Increment version
+      # Increment the version as desired locally, without actually committing anything.
+      - name: Locally increment version
         run: |
           # A workflow dispatch event lets the user specify what release type they want.
           if [[ "${{ github.event_name }}" = "workflow_dispatch" ]]; then
@@ -73,16 +73,17 @@ jobs:
           fi
           # Increment the version as needed
           npm --no-git-tag-version version $RELEASE_TYPE
-      # Create the new branch as a direct copy of `dev` and push it to GitHub so the API can
-      # interact with it later.
-      - id: create-branch
+      # The branch protection rule for `release-x.y.z` branches prevents pushing commits directly. To work around this,
+      # we create an interim branch that we _can_ push commits to, and we'll do our version bookkeeping in that branch
+      # instead.
+      - id: create-interim-branch
         run: |
           NEW_VERSION=$(jq -r ".version" package.json)
-          git checkout -b release-$NEW_VERSION
-          # Push the branch immediately without committing anything.
-          git push --set-upstream origin release-$NEW_VERSION
-          # Output the branch name so we can use it in later jobs.
-          echo "branch_name=release-$NEW_VERSION" >> "$GITHUB_OUTPUT"
+          INTERIM_BRANCH_NAME=${NEW_VERSION}-interim
+          # Create and check out the interim branch.
+          git checkout -b $INTERIM_BRANCH_NAME
+          # Immediately push the interim branch with no changes, so GraphQL can push to it later.
+          git push --set-upstream origin $INTERIM_BRANCH_NAME
       # Update our dependencies
       - run: yarn upgrade
       # Use the GraphQL API to create a signed commmit with our changes.
@@ -125,6 +126,21 @@ jobs:
                 }
               }
             }'
+      # Now that we've done our bookkeeping commits on the interim branch, use it as the base for the real release branch.
+      - name: Create release branch
+        id: create-branch
+        run: |
+          # The commit happened on the remote end, not ours, so we need to clean the directory and pull.
+          git checkout -- .
+          git pull
+          # Now we can create the actual release branch.
+          NEW_VERSION=$(jq -r ".version" package.json)
+          git checkout -b release-$NEW_VERSION
+          git push --set-upstream origin release-$NEW_VERSION
+          # Now that we're done with the interim branch, delete it.
+          git push -d ${NEW_VERSION}-interim
+          # Output the release branch name so we can use it in later jobs.
+          echo "branch_name=release-$NEW_VERSION" >> "$GITHUB_OUTPUT"
   # Build the scanner tarball so it can be installed locally when we run tests.
   build-scanner-tarball:
     name: 'Build scanner tarball'