Make release/publish workflows branch-aware across main and future release branches

[Copilot]

This ports the generic branch-aware release/publish plumbing to main so long-lived non-main branches can cut and publish releases without branch-specific workflow hacks. It also removes the highest-risk behavior: post-release dev-bump commits are no longer forced to main when a release is published from another branch.

• Release action plumbing (actions/github/release*)

  • Added branch input (default main) to:
    • actions/github/release/action.yml
    • actions/github/release/publish/action.yml
  • Threaded branch through to release.sh via BRANCH.
  • Updated release.sh to use BRANCH for fetch/checkout/push; defaults to main for backward compatibility.

• Release workflow targeting (release.yml / _release.yml)

  • release.yml now passes branch: ${{ github.ref_name }} into _release.yml.
  • _release.yml now takes explicit branch input (default main) and uses it for:
    • checkout branch
    • PR base branch
  • Release PR branch names now suffix -{branch} when branch != main to avoid cross-branch branch-name collisions.

• Publish workflow plumbing (_publish_release.yml / _publish.yml)

  • _publish_release.yml now accepts branch (default main), checks out that branch, and passes it into actions/github/release.
  • _publish.yml now accepts:
    • branch (default main)
    • release-types (default actions bazel bins docker python)
    • workflows (default current 5 required workflows)
  • Publish matrix is filtered by release-types, and required workflow wait-list is now input-driven.

• Data-driven branch config (publish.yml)

  • Added a config job that resolves branch publish policy from a declarative map:
    • run (whether branch is publish-enabled)
    • release-types
    • workflows (newline-joined)
  • publish now gates on fromJSON(needs.config.outputs.run) and passes resolved branch config into _publish.yml.
  • main behavior is preserved as the default map entry.
  • Included commented example for adding future long-lived release/backport branches (e.g. workspace) as a one-entry change.

• Branch policy sync comments

  • Added comments next to push.branches: [main] in bazel.yml, docker.yml, actions.yml, py.yml, and rust.yml to keep CI branch triggers aligned with publish.yml branch config.

# _publish.yml (matrix gating)
if: >-
  inputs.conclusion == 'success'
  && ! inputs.skip
  && contains(format(' {0} ', inputs.release-types), format(' {0} ', matrix.name))

Sequencing note (important): this PR introduces branch-aware inputs and wiring in actions/github/release*, but _publish_release.yml currently pins actions/github/release by SHA. Effective rollout is: (1) merge this, (2) cut a new actions release so pinned internals include branch-aware release.sh, then (3) on each release branch, add itself to publish.yml config + CI push.branches and bump action pins. Approach is based on the generic half of the prototype in #5232.

[netlify]

✅ Deploy Preview for nifty-bassi-e26446 ready!

Name	Link
🔨 Latest commit	0f2a091
🔍 Latest deploy log	https://app.netlify.com/projects/nifty-bassi-e26446/deploys/6aa8200341dec3000871bb69
😎 Deploy Preview	https://deploy-preview-5256--nifty-bassi-e26446.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.