🐛 fix(release): finish recovered releases from main

.github/workflows/finalize-github-release.yaml

@@ -23,16 +23,17 @@ on:
         required: true
         type: string
 permissions:
-  actions: read
-  contents: write
+  contents: read
 concurrency:
   group: release-refs/tags/${{ inputs.tag }}
   cancel-in-progress: false
 jobs:
   finalize:
     name: 🚀 Finalize GitHub Release
     runs-on: ubuntu-26.04
-    environment: release
+    permissions:
+      actions: read
+      contents: write
     steps:
       - name: 🔍 Verify the original tag run
         id: source
@@ -89,3 +90,74 @@ jobs:
           title: ${{ inputs.tag }}
           notes-file: ${{ runner.temp }}/notes/release-notes.md
           assets-directory: dist
+  post-release-prepare:
+    name: 🏷️ Prepare post-release version bump
+    needs: finalize
+    runs-on: ubuntu-26.04
+    permissions:
+      contents: read
+    outputs:
+      base-commit: ${{ steps.change.outputs.base-commit }}
+      candidate-commit: ${{ steps.change.outputs.candidate-commit }}
+      branch: ${{ steps.change.outputs.branch }}
+      next-version: ${{ steps.change.outputs.next-version }}
+      artifact-id: ${{ steps.upload.outputs.artifact-id }}
+    steps:
+      - name: 📥 Check out code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: main
+          fetch-depth: 0
+          persist-credentials: false
+      - name: 🏷️ Prepare the exact version change
+        id: change
+        uses: tox-dev/github-workflows/prepare-jetbrains-post-release@2c1f5e4ceda37c41eb8367b5cbeaa741aa60a566 # 6.5.2
+        with:
+          tag: ${{ inputs.tag }}
+          app-slug: tox-dev-pyvenvmanage-release
+          github-token: ${{ github.token }}
+          output-dir: ${{ runner.temp }}/post-release
+      - name: 📤 Upload the version change
+        id: upload
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: post-release-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/post-release/*
+          if-no-files-found: error
+  post-release:
+    name: 🔀 Open post-release version bump PR
+    needs: post-release-prepare
+    runs-on: ubuntu-26.04
+    permissions:
+      contents: read
+    environment: release-auth
+    steps:
+      - name: 🔑 Create release App token
+        id: token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: ${{ github.event.repository.name }}
+          permission-contents: write
+          permission-pull-requests: write
+          permission-issues: write
+      - name: 📩 Download the version change
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          artifact-ids: ${{ needs.post-release-prepare.outputs.artifact-id }}
+          path: ${{ runner.temp }}/post-release
+      - name: 🔀 Open the post-release PR
+        uses: tox-dev/github-workflows/publish-post-release-pr@2c1f5e4ceda37c41eb8367b5cbeaa741aa60a566 # 6.5.2
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        with:
+          base-commit: ${{ needs.post-release-prepare.outputs.base-commit }}
+          branch: ${{ needs.post-release-prepare.outputs.branch }}
+          title: Bump version to ${{ needs.post-release-prepare.outputs.next-version }}
+          body-file: ${{ runner.temp }}/post-release/body.md
+          paths-file: ${{ runner.temp }}/post-release/paths.tsv
+          allowed-paths: gradle.properties
+          bundle: ${{ needs.post-release-prepare.outputs.candidate-commit != '' && format('{0}/post-release/candidate.bundle', runner.temp) || '' }}
+          candidate-commit: ${{ needs.post-release-prepare.outputs.candidate-commit }}