fix(ci): handle branch protection in release workflow

The publish-crates job failed pushing the version bump commit to main
because GITHUB_TOKEN cannot bypass required status checks. Now attempts
the push first, and falls back to creating a PR if blocked.

Also bumps version to 0.4.11 for next development cycle (the 26.02_4
release workflow couldn't complete this step).

Author: raffaelschneider

.github/workflows/release.yml

@@ -224,11 +224,26 @@ jobs:
           git add Cargo.toml crates/*/Cargo.toml
           git commit -m "chore: bump version to ${{ needs.validate.outputs.new-semver }} for release ${{ needs.validate.outputs.calver }}"
 
-          # Push to main branch
-          git push origin HEAD:main
-
           echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
 
+      - name: Push version bump to main
+        id: push
+        continue-on-error: true
+        run: git push origin HEAD:main
+
+      - name: Create PR for version bump if push was blocked
+        if: steps.push.outcome == 'failure'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          BRANCH="chore/bump-${{ needs.validate.outputs.new-semver }}"
+          git checkout -b "$BRANCH"
+          git push origin "$BRANCH"
+          gh pr create \
+            --title "chore: bump version to ${{ needs.validate.outputs.new-semver }} for release ${{ needs.validate.outputs.calver }}" \
+            --body "Automated version bump after release ${{ needs.validate.outputs.calver }}. Direct push to main was blocked by branch protection." \
+            --base main
+
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
 

Cargo.toml

@@ -18,7 +18,7 @@ exclude = [
 resolver = "2"
 
 [workspace.package]
-version = "0.4.10"
+version = "0.4.11"
 edition = "2021"
 authors = ["Sentinel Contributors"]
 license = "MIT OR Apache-2.0"