refactor release pipeline: TAG_TOKEN, skip-checks gate, dependabot/zizmor cleanup (#5003)

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

.github/workflows/release.yaml

@@ -21,6 +21,11 @@ on:
         options:
           - "all"
           - "install-script-only"
+      skip-checks:
+        description: skip the check-gate (release even if checks haven't passed on main)
+        type: boolean
+        default: false
+        required: false
 
 jobs:
   version-available:
@@ -32,7 +37,7 @@ jobs:
       version: ${{ github.event.inputs.version }}
 
   check-gate:
-    if: ${{ github.event.inputs.phase == 'all' }}
+    if: ${{ github.event.inputs.phase == 'all' && !inputs.skip-checks }}
     permissions:
       contents: read
       checks: read # required for getting the status of specific check names
@@ -45,7 +50,14 @@ jobs:
 
   release:
     needs: [check-gate, version-available]
-    if: ${{ github.event.inputs.phase == 'all' }}
+    # run even when check-gate is skipped, but never when version-available
+    # failed/was skipped, nor when check-gate failed or was cancelled. note:
+    # always() disables the implicit success() gate on ALL needs, so the
+    # version-available requirement must be re-asserted explicitly here.
+    if: >-
+      ${{ always()
+          && needs.version-available.result == 'success'
+          && !contains(fromJSON('["failure", "cancelled"]'), needs.check-gate.result) }}
     environment: release
     # runs-on.com: compute instances for parallel builds
     #   spot disabled: reliability for build workflows (used for releases too)
@@ -82,8 +94,8 @@ jobs:
       - name: Build & publish release artifacts
         run: make ci-release
         env:
-          # used for pushing tags
-          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
+          # for pushing tags (does not inherit workflow permissions)
+          TAG_TOKEN: ${{ secrets.TAG_TOKEN }}
           RELEASE_VERSION: ${{ github.event.inputs.version }}
           # for mac signing and notarization...
           QUILL_SIGN_P12: ${{ secrets.ANCHORE_APPLE_DEVELOPER_ID_CERT_CHAIN }}