feat: refactor release workflow to use candidate branch

.github/release-please-config.json

@@ -5,7 +5,7 @@
       "release-type": "python",
       "package-name": "google-adk-community",
       "include-component-in-tag": false,
-      "draft": true,
+      "skip-github-release": true,
       "changelog-path": "CHANGELOG.md",
       "changelog-sections": [
         {"type": "feat", "section": "Features"},

.github/workflows/cherry-pick-to-release.yml → .github/workflows/release-cherry-pick.yml

@@ -1,12 +1,10 @@
-name: Cherry-pick to Release
+# Cherry-picks a commit from main to the release/candidate branch.
+# Use this to include bug fixes in an in-progress release.
+name: "Release: Cherry-pick"
 
 on:
   workflow_dispatch:
     inputs:
-      version:
-        description: 'Release version (e.g., 0.3.0)'
-        required: true
-        type: string
       commit_sha:
         description: 'Commit SHA to cherry-pick'
         required: true
@@ -22,7 +20,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: release/v${{ inputs.version }}
+          ref: release/candidate
           fetch-depth: 0
 
       - name: Configure git
@@ -32,19 +30,17 @@ jobs:
 
       - name: Cherry-pick commit
         run: |
-          echo "Cherry-picking ${{ inputs.commit_sha }} to release/v${{ inputs.version }}"
+          echo "Cherry-picking ${{ inputs.commit_sha }} to release/candidate"
           git cherry-pick ${{ inputs.commit_sha }}
 
       - name: Push changes
         run: |
-          git push origin release/v${{ inputs.version }}
-          echo "Successfully cherry-picked commit to release/v${{ inputs.version }}"
+          git push origin release/candidate
+          echo "Successfully cherry-picked commit to release/candidate"
 
       - name: Trigger Release Please
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh workflow run release-please.yml \
-            --repo ${{ github.repository }} \
-            -f version=${{ inputs.version }}
-          echo "Triggered Release Please workflow for version ${{ inputs.version }}"
+          gh workflow run release-please.yml --repo ${{ github.repository }}
+          echo "Triggered Release Please workflow"

.github/workflows/release-cut.yml

@@ -0,0 +1,46 @@
+# Starts the release process by creating a release/candidate branch.
+# Triggers release-please to generate a changelog PR.
+name: "Release: Cut"
+
+on:
+  workflow_dispatch:
+    inputs:
+      commit_sha:
+        description: 'Commit SHA to cut from (leave empty for latest main)'
+        required: false
+        type: string
+
+permissions:
+  contents: write
+  actions: write
+
+jobs:
+  cut-release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.commit_sha || 'main' }}
+
+      - name: Check for existing release/candidate branch
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if git ls-remote --exit-code --heads origin release/candidate &>/dev/null; then
+            echo "Error: release/candidate branch already exists"
+            echo "Please finalize or delete the existing release candidate before starting a new one"
+            exit 1
+          fi
+
+      - name: Create and push release/candidate branch
+        run: |
+          git checkout -b release/candidate
+          git push origin release/candidate
+          echo "Created branch: release/candidate"
+
+      - name: Trigger Release Please
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh workflow run release-please.yml --repo ${{ github.repository }}
+          echo "Triggered Release Please workflow"

.github/workflows/release-finalize.yml

@@ -0,0 +1,55 @@
+# Triggers when release-please PR is merged to release/candidate.
+# Creates the final release/v{version} branch and deletes the candidate branch.
+name: "Release: Finalize"
+
+on:
+  pull_request:
+    types: [closed]
+    branches:
+      - release/candidate
+
+permissions:
+  contents: write
+
+jobs:
+  finalize:
+    if: github.event.pull_request.merged == true
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check for release-please PR
+        id: check
+        env:
+          LABELS: ${{ toJson(github.event.pull_request.labels.*.name) }}
+        run: |
+          if echo "$LABELS" | grep -q "autorelease: pending"; then
+            echo "is_release_pr=true" >> $GITHUB_OUTPUT
+          else
+            echo "Not a release-please PR, skipping"
+            echo "is_release_pr=false" >> $GITHUB_OUTPUT
+          fi
+
+      - uses: actions/checkout@v4
+        if: steps.check.outputs.is_release_pr == 'true'
+        with:
+          ref: release/candidate
+
+      - name: Extract version from manifest
+        if: steps.check.outputs.is_release_pr == 'true'
+        id: version
+        run: |
+          VERSION=$(jq -r '.["."]' .github/.release-please-manifest.json)
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Extracted version: $VERSION"
+
+      - name: Create release branch
+        if: steps.check.outputs.is_release_pr == 'true'
+        run: |
+          git checkout -b "release/v${{ steps.version.outputs.version }}"
+          git push origin "release/v${{ steps.version.outputs.version }}"
+          echo "Created branch: release/v${{ steps.version.outputs.version }}"
+
+      - name: Delete release/candidate branch
+        if: steps.check.outputs.is_release_pr == 'true'
+        run: |
+          git push origin --delete release/candidate
+          echo "Deleted branch: release/candidate"

.github/workflows/release-please.yml

@@ -1,15 +1,12 @@
-name: Release Please
+# Runs release-please to create/update a PR with version bump and changelog.
+# Triggered by pushes to release/candidate or manually.
+name: "Release: Please"
 
 on:
   push:
     branches:
-      - 'release/**'
+      - release/candidate
   workflow_dispatch:
-    inputs:
-      version:
-        description: 'Release version (e.g., 0.3.0)'
-        required: true
-        type: string
 
 permissions:
   contents: write
@@ -19,49 +16,13 @@ jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
-      - name: Determine version and branch
-        id: vars
-        run: |
-          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
-            VERSION="${{ inputs.version }}"
-            BRANCH="release/v${{ inputs.version }}"
-          else
-            VERSION="${GITHUB_REF_NAME#release/v}"
-            BRANCH="${GITHUB_REF_NAME}"
-          fi
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "branch=$BRANCH" >> $GITHUB_OUTPUT
-          echo "Version: $VERSION, Branch: $BRANCH"
-
       - uses: actions/checkout@v4
         with:
-          ref: ${{ steps.vars.outputs.branch }}
-
-      - name: Check if release already exists
-        id: check
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          VERSION="${{ steps.vars.outputs.version }}"
-          if gh release view "v$VERSION" --repo ${{ github.repository }} &>/dev/null; then
-            echo "Release v$VERSION already exists, skipping"
-            echo "skip=true" >> $GITHUB_OUTPUT
-          else
-            echo "skip=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Set release-as version
-        if: steps.check.outputs.skip != 'true'
-        run: |
-          jq --arg version "${{ steps.vars.outputs.version }}" \
-            '.packages["."]["release-as"] = $version' \
-            .github/release-please-config.json > tmp.json && mv tmp.json .github/release-please-config.json
+          ref: release/candidate
 
       - uses: googleapis/release-please-action@v4
-        if: steps.check.outputs.skip != 'true'
-        id: release
         with:
           token: ${{ secrets.RELEASE_PAT }}
           config-file: .github/release-please-config.json
           manifest-file: .github/.release-please-manifest.json
-          target-branch: ${{ steps.vars.outputs.branch }}
+          target-branch: release/candidate

.github/workflows/publish-pypi.yml → .github/workflows/release-publish.yml

@@ -1,4 +1,6 @@
-name: Publish to PyPI
+# Builds and publishes the package to PyPI from a release branch.
+# Creates a merge-back PR to sync release changes to main.
+name: "Release: Publish to PyPi"
 
 on:
   workflow_dispatch:
@@ -18,7 +20,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: v${{ inputs.version }}
+          ref: release/v${{ inputs.version }}
 
       - name: Install uv
         uses: astral-sh/setup-uv@v4
@@ -40,7 +42,7 @@ jobs:
 
       - name: Create merge-back PR
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.RELEASE_PAT }}
         run: |
           gh pr create \
             --base main \