Add release pr workflow

[timreimherr]

This adds a workflow for creating a PR to facilitate the release process.

[Copilot]

Pull request overview

Adds a GitHub Actions workflow to automate creation of a “release PR” by syncing docs/ and README.md from backup-utils-private into this repo and opening (then auto-merging) a PR for the release branch.

Changes:

• Add repository_dispatch-triggered workflow Create Release PR.
• Checkout backup-utils-private, copy docs/ + README.md, commit to release/<version> and push.
• Create (or find) a PR and enable auto-merge via gh.

Comments suppressed due to low confidence (1)

.github/workflows/create-release-pr.yml:71

• Same injection risk here: interpolating github.event.client_payload.version directly into the run: script can allow a crafted repository_dispatch payload to execute arbitrary shell commands. Prefer passing it via env: (or parsing $GITHUB_EVENT_PATH) and validating it before constructing branch names / PR metadata.

          version="${{ github.event.client_payload.version }}"
          branch="release/$version"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

gh pr list ... --jq '.[0].number' returns null (string) when no PRs are found, not an empty string. With the current -z check, pr_number becomes null and the workflow will skip PR creation and later try to merge a PR numbered null. Update the jq filter / conditional to treat null as empty.

Suggested change

	pr_number="$(gh pr list --head "$branch" --base master --json number --jq '.[0].number')"
	pr_number="$(gh pr list --head "$branch" --base master --json number --jq '.[0].number // empty')"

[Copilot]

git push --force-with-lease can fail on reruns when the remote release/$version branch already exists but hasn’t been fetched into a local origin/release/... tracking ref (common with actions/checkout default fetch-depth: 1). If you intend this workflow to be idempotent, fetch the remote branch first (if it exists) or adjust the push strategy so reruns can update the branch reliably.

[Copilot]

The workflow uses ${{ github.repository_owner }} when minting the GitHub App token, but hardcodes repository: github/backup-utils-private for the checkout. Using the same owner variable for the checkout target avoids drift if the repo is ever moved or this workflow is reused elsewhere.

Suggested change

	repository: github/backup-utils-private
	repository: ${{ github.repository_owner }}/backup-utils-private

[Copilot]

github.event.client_payload.version is interpolated directly into the shell script. If the dispatch payload contains characters like quotes/newlines, this can break out of the assignment and lead to shell injection (and potential secret exfiltration). Pass the value via env: (or read it from $GITHUB_EVENT_PATH with jq) and validate/sanitize it (e.g., enforce a semver/allowed-charset pattern) before using it in git/gh commands.

This issue also appears on line 70 of the same file.