Update CI for prerelease and backports (#646)

* Update CI for prerelease and backports

* Fix

* Update permissions

* Apply suggestions from code review

Co-authored-by: Mateusz Burzyński <mateuszburzynski@gmail.com>

* comment

---------

Co-authored-by: Mateusz Burzyński <mateuszburzynski@gmail.com>

.github/workflows/ci.yml

@@ -7,6 +7,9 @@ on:
   merge_group:
     branches:
       - main
+      - next
+      # merge group rulesets don't allow wildcards so in settings each maintenance branch needs to be added separately
+      - "maintenance/v*" # branch rulesets don't support v[0-9]+
 
 permissions:
   contents: read
@@ -37,9 +40,8 @@ jobs:
 
   test:
     name: Test
-    timeout-minutes: 20
     runs-on: ubuntu-latest
-
+    timeout-minutes: 20
     steps:
       - name: Check out repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -53,9 +55,8 @@ jobs:
 
   typecheck:
     name: Typecheck
-    timeout-minutes: 20
     runs-on: ubuntu-latest
-
+    timeout-minutes: 20
     steps:
       - name: Check out repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -69,9 +70,8 @@ jobs:
 
   lint:
     name: Lint
-    timeout-minutes: 20
     runs-on: ubuntu-latest
-
+    timeout-minutes: 20
     steps:
       - name: Check out repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/publish.yml

@@ -4,6 +4,8 @@ on:
   push:
     branches:
       - main
+      - next
+      - "maintenance/v*" # branch rulesets don't support v[0-9]+
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -21,9 +23,7 @@ jobs:
     outputs:
       hasChangesets: ${{ steps.changesets.outputs.hasChangesets }}
     permissions:
-      contents: write # to create release (changesets/action)
+      contents: read # to check out repo (actions/checkout)
-      issues: write # to post issue comments (changesets/action)
-      pull-requests: write # to create pull request (changesets/action)
     steps:
       - name: Check out repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -42,6 +42,8 @@ jobs:
         with:
           client-id: ${{ vars.APP_CLIENT_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write # to create version commits (changesets/action)
+          permission-pull-requests: write # to create pull request (changesets/action)
 
       - name: Create or update release pull request
         id: changesets
@@ -65,12 +67,12 @@ jobs:
         with:
           client-id: ${{ vars.APP_CLIENT_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write # to bypass branch and tag protection rules (release.ts)
 
       - name: Check out repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          persist-credentials: true
+          persist-credentials: false
-          # we need this token to bypass the branch and tag protection rules
           token: ${{ steps.app-token.outputs.token }}
 
       - uses: ./.github/actions/ci-setup