fix: keep release green when auto PR creation is blocked

.github/workflows/ci.yml

@@ -6,7 +6,33 @@ on:
   pull_request:
     branches: ["main"]
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      tauri_build: ${{ steps.filter.outputs.tauri_build }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - id: filter
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            tauri_build:
+              - 'src/**'
+              - 'src-tauri/**'
+              - 'package.json'
+              - 'package-lock.json'
+              - 'index.html'
+              - 'vite.config.*'
+              - 'tsconfig*.json'
+              - 'scripts/**'
+
   lint:
     runs-on: ubuntu-latest
     steps:
@@ -102,10 +128,12 @@ jobs:
     name: Tauri build (${{ matrix.platform.name }})
     runs-on: ${{ matrix.platform.os }}
     needs:
+      - changes
       - lint
       - typecheck
       - test-js
       - test-tauri
+    if: github.event_name != 'pull_request' || needs.changes.outputs.tauri_build == 'true'
     strategy:
       fail-fast: false
       matrix:

.github/workflows/release.yml

@@ -688,8 +688,21 @@ jobs:
           git commit -m "chore: bump version to ${NEXT_VERSION}"
           git push origin "chore/bump-version-${NEXT_VERSION}"
 
-          gh pr create \
+          PR_CREATE_LOG=$(mktemp)
+          if ! gh pr create \
             --title "chore: bump version to ${NEXT_VERSION}" \
             --body "Post-release version bump to ${NEXT_VERSION}." \
             --base main \
-            --head "chore/bump-version-${NEXT_VERSION}"
+            --head "chore/bump-version-${NEXT_VERSION}" >"$PR_CREATE_LOG" 2>&1; then
+            if grep -q "GitHub Actions is not permitted to create or approve pull requests" "$PR_CREATE_LOG"; then
+              echo "::warning::GitHub Actions could not create the post-release PR due to repository policy. The branch chore/bump-version-${NEXT_VERSION} was pushed successfully; open the PR manually."
+              cat "$PR_CREATE_LOG"
+            else
+              cat "$PR_CREATE_LOG"
+              rm -f "$PR_CREATE_LOG"
+              exit 1
+            fi
+          else
+            cat "$PR_CREATE_LOG"
+          fi
+          rm -f "$PR_CREATE_LOG"