chore(workflows): split release workflow into two for SOC 2 compliance

.github/workflows/creating_pr.yml

@@ -0,0 +1,42 @@
+name: Create Release PR
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to release'
+        required: true
+
+jobs:
+  create-release-pr:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure Git
+        run: |
+          git config user.name "${{ github.actor }}"
+          git config user.email "${{ github.actor }}@users.noreply.github.com"
+
+      - name: Update Chart and Values Versions
+        run: |
+          sed -i "s/^version:.*/version: ${{ github.event.inputs.tag }}/" Chart.yaml
+          sed -i "s/^appVersion:.*/appVersion: '${{ github.event.inputs.tag }}'/" Chart.yaml
+          sed -i "s/^version:.*/version: ${{ github.event.inputs.tag }}/" values.yaml
+
+      - name: Commit changes
+        run: |
+          git checkout -b release/${{ github.event.inputs.tag }}
+          git add Chart.yaml values.yaml
+          git commit -m "chore(release): update to ${{ github.event.inputs.tag }}"
+          git push origin release/${{ github.event.inputs.tag }}
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v7
+        with:
+          commit-message: "chore(release): update to ${{ github.event.inputs.tag }}"
+          branch: release/${{ github.event.inputs.tag }}
+          title: "Release ${{ github.event.inputs.tag }}"
+          body: "This PR updates the chart versions to ${{ github.event.inputs.tag }}."
+          labels: release

.github/workflows/release.yml

@@ -1,17 +1,16 @@
-name: Release Charts
+name: Release Charts on Merge
 
 on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Tag to release'
-        required: true
-        default: '1.0.0'
+  pull_request:
+    types: [closed]
+    branches:
+      - main
 
 jobs:
-  release:
-    permissions:
-      contents: write
+  release-on-merge:
+    if: >
+      github.event.pull_request.merged == true &&
+      contains(github.event.pull_request.labels.*.name, 'release')
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -21,23 +20,14 @@ jobs:
 
       - name: Configure Git
         run: |
-          git config user.name "$GITHUB_ACTOR"
-          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+          git config user.name "${{ github.actor }}"
+          git config user.email "${{ github.actor }}@users.noreply.github.com"
 
       - name: Lint Chart - Main chart
-        run: helm lint .  
+        run: helm lint .
 
       - name: Update Dependencies
-        run: helm dependency update .  
-
-      - name: Update Chart and Values Versions
-        run: |
-          sed -i "s/^version:.*/version: ${{ github.event.inputs.tag }}/" Chart.yaml
-          sed -i "s/^appVersion:.*/appVersion: '${{ github.event.inputs.tag }}'/" Chart.yaml
-          sed -i "s/^version:.*/version: ${{ github.event.inputs.tag }}/" values.yaml
-          git add Chart.yaml values.yaml
-          git commit -m "chore(release): update chart, appVersion, and values versions to ${{ github.event.inputs.tag }}"
-          git push origin main
+        run: helm dependency update .
 
       - name: Run chart-releaser
         uses: helm/[email protected]
@@ -49,8 +39,8 @@ jobs:
       - name: Deploy to GitHub Pages
         run: |
           git checkout gh-pages
-          git pull origin main --rebase --autostash 
+          git pull origin main --rebase --autostash
           helm repo index . --url https://getlago.github.io/charts
           git add .
-          git commit -m "Update Helm repo index for tag ${{ github.event.inputs.tag }}"
+          git commit -m "Update Helm repo index after release"
           git push origin gh-pages