Switch Front to PR-gated shared release workflows

.github/workflows/create-draft-release.yml

@@ -3,15 +3,10 @@ name: Release Drafter
 on:
   pull_request:
     types: [closed]
-permissions:
-  contents: read
 
 jobs:
-  update_release_draft:
-    if: github.event.pull_request.merged == true
-    permissions: write-all
-    runs-on: ubuntu-latest
-    steps:
-      - uses: release-drafter/release-drafter@v5
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  draft:
+    uses: edalzell/github-workflows/.github/workflows/release-draft.yml@9f72f0b77303abff9903b16da75346b1eb1c3785 # v1.4.0
+    permissions:
+      contents: write
+      pull-requests: write

.github/workflows/label-pr.yml

@@ -1,12 +1,12 @@
 name: PR Labeler
+
 on:
   pull_request:
-    types: [opened]
+    types: [opened, reopened, synchronize]
 
 jobs:
-  pr-labeler:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: TimonVS/pr-labeler-action@v4
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  label:
+    uses: edalzell/github-workflows/.github/workflows/label-pr.yml@9f72f0b77303abff9903b16da75346b1eb1c3785 # v1.4.0
+    permissions:
+      contents: read
+      pull-requests: write

.github/workflows/release-prepare.yml

@@ -0,0 +1,28 @@
+name: Release Prepare
+
+on:
+  workflow_dispatch:
+
+jobs:
+  authorize:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Require transformstudios/maintainers
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+        run: |
+          state=$(gh api "orgs/transformstudios/teams/maintainers/memberships/${GITHUB_ACTOR}" --jq .state 2>/dev/null || true)
+          if [ "$state" != "active" ]; then
+            echo "::error::Only @transformstudios/maintainers can run Release Prepare (actor: ${GITHUB_ACTOR})"
+            exit 1
+          fi
+
+  prepare:
+    needs: authorize
+    uses: edalzell/github-workflows/.github/workflows/release-prepare.yml@9f72f0b77303abff9903b16da75346b1eb1c3785 # v1.4.0
+    permissions:
+      contents: write
+    secrets:
+      release_token: ${{ secrets.RELEASE_TOKEN }}

.github/workflows/release-publish.yml

@@ -0,0 +1,13 @@
+name: Release Publish
+
+on:
+  pull_request:
+    types: [closed]
+
+jobs:
+  publish:
+    uses: edalzell/github-workflows/.github/workflows/release-publish.yml@9f72f0b77303abff9903b16da75346b1eb1c3785 # v1.4.0
+    permissions:
+      contents: write
+    with:
+      upload_assets: true