fix(ci): release through protected main via explicit dispatch

[abrichr]

The failure

Release and PyPI Publish has failed on every push to main since 2026-02-18. The cause is in the log of the newest run:

GitCommandError: Cmd('git') failed due to: exit code(1)
  cmdline: git push ***github.com/OpenAdaptAI/<repo>.git main
  stderr: 'remote: error: GH006: Protected branch update failed for refs/heads/main.
  remote: - Changes must be made through a pull request.
  ! [remote rejected] main -> main (protected branch hook declined)'
##[error] Failed to push branch (main) to remote

python-semantic-release computes the next version, commits the bump, tags it, and pushes to main. main requires a pull request, and the default GITHUB_TOKEN is not an admin, so the push is rejected. Branch protection was enabled some time after the last successful release run (2026-01-29); the workflow file and token were unchanged.

Nothing was silently unpublished

The rejected push is the step before build and publish, and every later step is gated on steps.release.outputs.released == 'true'. So no failing run ever published. The published state and the repository state still agree — PyPI version = git tag = GitHub Release = pyproject.toml. What stopped is releasing, not correctness; and the commits since the last tag are CI config, .gitignore, and docs only, with no library code changed.

openadapt-privacy hit the identical failure on the same day and was repaired on 2026-07-15 (fix(ci): release through protected main, #5). Its release runs have been green since. This is the same repair, applied to the three repositories that were left behind.

The change

1. secrets.ADMIN_TOKEN — the organization-scoped release credential (visibility all) already used by openadapt-flow and openadapt-privacy. Branch protection here sets enforce_admins: false, so an admin credential can push the release commit and tag; GITHUB_TOKEN cannot.
2. workflow_dispatch instead of push — matching the canonical openadapt-flow release workflow. Releasing becomes an explicit act rather than a side effect of merging a README edit, and release minutes come off every push (AGENTS.md 5.1).

Also repoints the README build badge at release.yml. It referenced a publish.yml workflow that does not exist in this repository, so the badge was permanently broken.

Release safety

Merging this publishes nothing. With the push trigger removed, merging cannot start a release run. The next release happens only when a maintainer runs:

gh workflow run "Release and PyPI Publish" --repo OpenAdaptAI/<repo> --ref main

This is deliberate: with the push trigger kept, merging this PR would itself have cut a patch release whose only content since the last tag is a CI-config change.

Known follow-up

The last Release and PyPI Publish run on main remains red in bin/oa-green, because a dispatch-only workflow produces no new run to supersede it. It clears on the first dispatched release.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NyCHrzA1psrKMFfroYbzaM