feat: add update-major-version-tag reusable composite action

.github/actions/update-major-version-tag/action.yml

@@ -0,0 +1,41 @@
+name: Update Major Version Tag
+description: 'Create or update the major version shorthand tag (e.g., v1) to point to HEAD, for use when releasing a GitHub Action.'
+
+inputs:
+  release-version:
+    required: true
+    description: 'Full release version (e.g., 1.2.3).'
+  github-token:
+    required: true
+    description: 'GitHub token with contents write permission.'
+
+runs:
+  using: composite
+  steps:
+    - name: Update major version tag
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.github-token }}
+        RELEASE_VERSION: ${{ inputs.release-version }}
+      run: |
+        set -euo pipefail
+
+        MAJOR_VERSION_TAG="v${RELEASE_VERSION/\.*/}"
+        SHA=$(git rev-parse HEAD)
+
+        # Try to update the existing tag; create it if it doesn't exist yet.
+        if gh api --method PATCH \
+          "/repos/${GITHUB_REPOSITORY}/git/refs/tags/${MAJOR_VERSION_TAG}" \
+          --field "sha=${SHA}" \
+          --field "force=true" \
+          2>/dev/null; then
+          echo "Updated existing tag \"${MAJOR_VERSION_TAG}\"."
+        else
+          echo "Tag \"${MAJOR_VERSION_TAG}\" does not exist, creating it from scratch."
+          gh api --method POST \
+            "/repos/${GITHUB_REPOSITORY}/git/refs" \
+            --field "ref=refs/tags/${MAJOR_VERSION_TAG}" \
+            --field "sha=${SHA}"
+        fi
+
+        echo "Updated shorthand major version tag."

.github/workflows/main.yml

@@ -62,7 +62,8 @@ jobs:
     if: needs.is-release.outputs.IS_RELEASE == 'true'
     name: Publish release
     permissions:
-      contents: write
+      contents: read
+      id-token: write
     uses: ./.github/workflows/publish-release.yml
     secrets:
       SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

.github/workflows/publish-release.yml

@@ -19,6 +19,9 @@ on:
       SLACK_WEBHOOK_URL:
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   announce-release:
     name: Announce release
@@ -64,10 +67,11 @@ jobs:
 
   publish-release:
     name: Publish release
-    environment: npm-publish
+    environment: action-publish
     needs: announce-release
     permissions:
-      contents: write
+      contents: read
+      id-token: write
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -78,13 +82,22 @@ jobs:
           fetch-depth: 0
           ref: ${{ github.sha }}
 
+      - name: Get token
+        id: get-token
+        uses: ./.github/actions/get-token
+        with:
+          token-exchange-url: ${{ vars.TOKEN_EXCHANGE_URL }}
+          permissions: |
+            contents: write
+
       - name: Publish release
         uses: MetaMask/action-publish-release@v3
         id: publish-release
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.get-token.outputs.token }}
 
       - name: Update shorthand major version tag
-        run: |
-          ./.github/workflows/scripts/update-major-version-tag.sh \
-            ${{ steps.publish-release.outputs.release-version }}
+        uses: ./.github/actions/update-major-version-tag
+        with:
+          release-version: ${{ steps.publish-release.outputs.release-version }}
+          github-token: ${{ steps.get-token.outputs.token }}