ci: release automation follow-ups (self-pin push, remove deploy-key rotation reminder) (#645)

* ci: don't attempt gh pr create for self-pin (org blocks it)

The Azure org permanently disables 'Allow GitHub Actions to create and approve
pull requests', so gh pr create failed every release with a misleading
'PR may already exist' fallback. Remove the doomed call and instead print a
::notice:: with the compare link so the releaser opens the PR in one click.
Also drop the now-unused pull-requests: write permission and GH_TOKEN env from
the self-pin jobs (they only use git via the deploy key), and rename the step
to 'push branch'.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* ci: send deploy-key rotation reminder to Teams instead of a public issue

Azure/login is public, so a GitHub issue reminder to rotate the release deploy
key is publicly visible. Post to a private Teams channel via a Power Automate
'Workflows' webhook (TEAMS_WEBHOOK_URL secret) instead. Needs no GitHub
permissions (empty permissions block, no GITHUB_TOKEN) - the webhook URL is the
only credential.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Delete deploy-key-rotation-reminder.yml

---------

Co-authored-by: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: MaddyMicrosoft

.github/workflows/deploy-key-rotation-reminder.yml

@@ -185,7 +185,6 @@ jobs:
     environment: release
     permissions:
       contents: write
-      pull-requests: write
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
@@ -194,9 +193,8 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
-      - name: Bump azure/login self-references and open PR
+      - name: Bump azure/login self-references and push branch
         env:
-          GH_TOKEN: ${{ github.token }}
           V: ${{ inputs.version }}
         run: |
           SHA=$(git rev-parse "refs/tags/$V^{commit}")
@@ -218,8 +216,6 @@ jobs:
           # Force-push: this version-specific bot branch is safe to overwrite if a
           # prior run left it behind, and there is no other writer to protect.
           git push --force --set-upstream origin "$BRANCH"
-          # Tolerate an existing PR for this branch (e.g. on a re-run) without failing.
-          gh pr create --base master --head "$BRANCH" \
-            --title "Pin azure/login self-references to $V" \
-            --body "Automated post-release update: repoints \`azure/login@…\` in workflow files to the built release commit \`$SHA\` (\`$V\`)." \
-            || echo "PR for $BRANCH may already exist; skipping create."
+          # The org blocks Actions from creating PRs, so open it manually from the
+          # pushed branch. Print the compare link for the releaser.
+          echo "::notice::Self-pin branch pushed. Open a PR: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/compare/master...${BRANCH}?expand=1"

.github/workflows/release.yml

@@ -115,7 +115,6 @@ jobs:
     environment: release
     permissions:
       contents: write
-      pull-requests: write
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
@@ -124,9 +123,8 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
-      - name: Roll back azure/login self-references and open PR
+      - name: Roll back azure/login self-references and push branch
         env:
-          GH_TOKEN: ${{ github.token }}
           V: ${{ inputs.target_version }}
         run: |
           TARGET_MAJOR="${V%%.*}"   # v3.0.1 -> v3
@@ -161,8 +159,6 @@ jobs:
           # Force-push: this version-specific bot branch is safe to overwrite if a
           # prior run left it behind, and there is no other writer to protect.
           git push --force --set-upstream origin "$BRANCH"
-          # Tolerate an existing PR for this branch (e.g. on a re-run) without failing.
-          gh pr create --base master --head "$BRANCH" \
-            --title "Roll back azure/login self-references to $V" \
-            --body "Automated post-rollback update: repoints \`azure/login@…\` in workflow files to the rolled-back release commit \`$SHA\` (\`$V\`)." \
-            || echo "PR for $BRANCH may already exist; skipping create."
+          # The org blocks Actions from creating PRs, so open it manually from the
+          # pushed branch. Print the compare link for the releaser.
+          echo "::notice::Self-pin branch pushed. Open a PR: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/compare/master...${BRANCH}?expand=1"