fix(ci): update release README links through PR (#2152)

.github/workflows/update-post-release-readme-urls.yml

@@ -13,17 +13,25 @@ on:
         type: string
 
 permissions:
-  contents: write
+  contents: read
+
+concurrency:
+  group: update-post-release-readme-urls
+  cancel-in-progress: true
 
 jobs:
   update:
     # Keep prereleases from replacing the stable README download buttons.
     if: github.event_name == 'workflow_dispatch' || !github.event.release.prerelease
     runs-on: ubuntu-latest
+    env:
+      README_BRANCH: automation/update-readme-release-links
+      RELEASE_TAG: ${{ github.event.release.tag_name || inputs.tag }}
     steps:
       - uses: actions/checkout@v6
         with:
           ref: main
+          persist-credentials: false
 
       - uses: pnpm/action-setup@v4
         with:
@@ -35,12 +43,125 @@ jobs:
       - run: pnpm install --frozen-lockfile
 
       - name: Update README download links
-        run: pnpm -F @proj-airi/stage-tamagotchi exec tsx scripts/update-readme-download-links.ts ${{ github.event.release.tag_name || inputs.tag }}
+        run: pnpm -F @proj-airi/stage-tamagotchi exec tsx scripts/update-readme-download-links.ts "$RELEASE_TAG"
 
       - name: Pull with rebase
         run: git pull origin main --rebase --autostash
 
-      - uses: stefanzweifel/git-auto-commit-action@v6
+      - name: Prepare README release update
+        id: prepare
+        env:
+          GH_TOKEN: ${{ secrets.PAT_SLASH_COMMAND_DISPATCH }}
+        run: |
+          # The updater is only allowed to publish the generated README link changes.
+          if ! git diff --quiet -- . ':(exclude)README.md' ':(exclude)docs/README*.md'; then
+            echo "::error::Unexpected non-README changes were generated."
+            git status --short
+            exit 1
+          fi
+
+          git add README.md 'docs/README*.md'
+          if git diff --cached --quiet; then
+            echo "No README release links changed."
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [ -z "$GH_TOKEN" ]; then
+            echo "::error::PAT_SLASH_COMMAND_DISPATCH is required so the README update PR triggers required checks."
+            exit 1
+          fi
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+
+          REMOTE_BRANCH="$(git ls-remote --heads origin "refs/heads/${README_BRANCH}")"
+          if [ -n "$REMOTE_BRANCH" ]; then
+            git fetch origin "${README_BRANCH}:refs/remotes/origin/${README_BRANCH}"
+          fi
+
+          git checkout -B "$README_BRANCH"
+          PR_TITLE="chore: update README release artifacts to ${RELEASE_TAG}"
+          git commit -m "$PR_TITLE"
+          git push --force-with-lease origin "$README_BRANCH"
+
+          echo "changed=true" >> "$GITHUB_OUTPUT"
+          echo "pr_title=$PR_TITLE" >> "$GITHUB_OUTPUT"
+
+      - name: Create or update README release PR
+        if: steps.prepare.outputs.changed == 'true'
+        uses: actions/github-script@v8
+        env:
+          PR_TITLE: ${{ steps.prepare.outputs.pr_title }}
         with:
-          commit_message: 'chore: update README release artifacts to ${{ github.event.release.tag_name || inputs.tag }}'
-          commit_author: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
+          github-token: ${{ secrets.PAT_SLASH_COMMAND_DISPATCH }}
+          script: |
+            const { owner, repo } = context.repo;
+            const head = `${owner}:${process.env.README_BRANCH}`;
+            const body = [
+              '## Description',
+              '',
+              `Updates stable desktop download links after the ${process.env.RELEASE_TAG} release.`,
+              '',
+              '## Linked Issues',
+              '',
+              'None.',
+              '',
+              '## Additional Context',
+              '',
+              'Generated by the post-release README workflow.',
+            ].join('\n');
+
+            const { data: openPullRequests } = await github.rest.pulls.list({
+              owner,
+              repo,
+              state: 'open',
+              base: 'main',
+              head,
+              per_page: 1,
+            });
+
+            let pullRequest;
+            if (openPullRequests.length > 0) {
+              const { data } = await github.rest.pulls.update({
+                owner,
+                repo,
+                pull_number: openPullRequests[0].number,
+                title: process.env.PR_TITLE,
+                body,
+              });
+              pullRequest = data;
+              core.info(`Updated pull request #${pullRequest.number}.`);
+            }
+            else {
+              const { data } = await github.rest.pulls.create({
+                owner,
+                repo,
+                base: 'main',
+                head: process.env.README_BRANCH,
+                title: process.env.PR_TITLE,
+                body,
+              });
+              pullRequest = data;
+              core.info(`Created pull request #${pullRequest.number}.`);
+            }
+
+            if (!pullRequest.auto_merge) {
+              await github.graphql(
+                `mutation EnableAutoMerge($pullRequestId: ID!) {
+                  enablePullRequestAutoMerge(input: {
+                    pullRequestId: $pullRequestId
+                    mergeMethod: SQUASH
+                  }) {
+                    pullRequest {
+                      number
+                    }
+                  }
+                }`,
+                {
+                  pullRequestId: pullRequest.node_id,
+                },
+              );
+              core.info(`Enabled squash auto-merge for pull request #${pullRequest.number}.`);
+            }