fix: auto-trigger CI checks on release-please PR updates

.github/workflows/release.yml

@@ -6,8 +6,13 @@ on:
 
 # Note: release-please uses GITHUB_TOKEN, which doesn't trigger other workflows.
 # CI/CodeQL checks on release PRs are handled by release-pr-checks.yml using
-# pull_request_target. Docker publishing is handled by docker-publish.yml using
-# workflow_run on this workflow (to detect when a release is created).
+# pull_request_target. The close/reopen step below ensures the `reopened` event
+# fires reliably (force-push `synchronize` events are inconsistent with GITHUB_TOKEN).
+# Docker publishing is handled by docker-publish.yml using workflow_run.
+#
+# Ideal fix: use a fine-grained PAT (repo secret RELEASE_TOKEN) with contents:write
+# and pull-requests:write. This makes release-please PRs trigger normal pull_request
+# events, eliminating the need for release-pr-checks.yml entirely.
 
 permissions:
   contents: write
@@ -16,9 +21,32 @@ permissions:
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    outputs:
+      pr: ${{ steps.rp.outputs.pr }}
+      release_created: ${{ steps.rp.outputs.release_created }}
     steps:
       - name: Run release-please
+        id: rp
         uses: googleapis/release-please-action@v4
         with:
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
+
+  # When release-please creates or updates a PR via GITHUB_TOKEN, the
+  # pull_request_target `synchronize` event doesn't always fire. Closing
+  # and reopening the PR ensures the `reopened` event triggers CI checks.
+  trigger-pr-checks:
+    needs: [release-please]
+    if: needs.release-please.outputs.pr != '' && needs.release-please.outputs.release_created != 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Close and reopen release PR to trigger checks
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ fromJSON(needs.release-please.outputs.pr).number }}
+        run: |
+          echo "Triggering checks on release PR #$PR_NUMBER"
+          gh pr close "$PR_NUMBER" --repo "$GITHUB_REPOSITORY"
+          sleep 2
+          gh pr reopen "$PR_NUMBER" --repo "$GITHUB_REPOSITORY"
+          echo "Release PR #$PR_NUMBER reopened — checks should now trigger"