ci: align release draft workflow with rokt-widget pattern

[nickolas-dimitrakas]

Background

The release draft workflow used peter-evans/create-pull-request without pinned action SHAs, no changelog generation, and the pull-request CI workflow only triggered on pull_request events. This meant CI did not run consistently across branches and the release PR lacked a changelog summary.

What Has Changed

• Rewrote draft-release-publish.yml to align with the standard Rokt release draft pattern
• Pinned all action SHAs for supply-chain security
• Added changelog generation via ROKT/rokt-workflows/actions/generate-changelog with release notes included in the PR body
• Upgraded peter-evans/create-pull-request to v8.1.0
• Updated pull-request CI workflow triggers to pull_request + push on main and workstation/* branches
• Bumped Xcode version to 26.2

Checklist

• I have performed a self-review of my own code.
• I have made corresponding changes to the documentation.
• I have added tests that prove my fix is effective or that my feature works.
• I have tested this locally.

Reference Issue (For employees only. Ignore if you are an outside contributor)

• Closes NO-JIRA

[cursor]

PR Summary

Medium Risk
Updates release-automation and CI workflow triggers/pinned actions; mistakes here could prevent release PR creation or break CI (notably the Xcode version change).

Overview
Updates the draft release workflow to a standardized “prepare release” flow: pins action SHAs, fetches full git history, bumps VERSION and the podspec version, generates release notes from git history, and opens a release PR against the current branch.

Extends the CI workflow to also run on pushes to main and workstation/*, and changes the configured XCODE_VERSION used by the test job.

^{Reviewed by Cursor Bugbot for commit e6a52d5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e6a52d5. Configure here.}

[cursor]

Missing chore/release* push trigger defeats PR's stated purpose

High Severity

The push.branches trigger adds main and workstation/* but is missing chore/release*, which is the branch pattern that peter-evans/create-pull-request in draft-release-publish.yml creates (via branch: chore/release-${{ steps.bump-version.outputs.new_version }}). The PR description explicitly states the intent is to add chore/release* to bypass GitHub's restriction on GITHUB_TOKEN-created PRs not triggering pull_request events, but this pattern was omitted from the implementation. CI will still not fire on release PRs.

 

^{Reviewed by Cursor Bugbot for commit e6a52d5. Configure here.}

[cursor]

PR-specific jobs lack guards for new push trigger

Medium Severity

The new push trigger causes pr-branch-check-name and pr-title-check jobs to run on push events (e.g., every merge to main), where no pull request context exists. These reusable workflows rely on PR data (github.event.pull_request) to check branch names and titles. Unlike pr-notify, which correctly guards with if: github.event_name == 'pull_request', these jobs have no such condition and will likely fail on every push-triggered run, creating persistent CI noise.

 

^{Reviewed by Cursor Bugbot for commit e6a52d5. Configure here.}