chore: update actions workflow to ignore dependabot branches for CI r…

.github/workflows/build.yml

@@ -1,6 +1,11 @@
 name: Build Lua Distributions
 
-on: [push, workflow_dispatch]
+on:
+  push:
+    branches-ignore:
+      - 'dependabot/**' # prevents multiple ci actions from running on dependabot PRs
+  pull_request:
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -175,11 +180,66 @@ jobs:
         uses: dependabot/fetch-metadata@v2
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
-      - run: |
+      # NOTE: Merges performed via the default GITHUB_TOKEN do NOT trigger other workflows (e.g. `on: push`),
+      # so we publish the release from THIS workflow run instead of relying on a post-merge run.
+      - name: Approve + merge PR, then wait for merge commit SHA
+        id: merge
+        shell: bash
+        run: |
+          set -euo pipefail
+
           gh pr review --approve "$PR_URL"
-          gh pr merge --squash --auto "$PR_URL"
+
+          # Since this job only runs after all build jobs succeeded, the PR should be mergeable immediately.
+          # If it isn't, fail fast so we don't accidentally create a release without a merge.
+          gh pr merge --squash --delete-branch "$PR_URL"
+
+          # Squash merge creates a NEW commit on the default branch; capture it so the release tag points at it.
+          for i in {1..30}; do
+            merged="$(gh pr view "$PR_URL" --json merged --jq '.merged')"
+            if [[ "$merged" == "true" ]]; then
+              sha="$(gh pr view "$PR_URL" --json mergeCommit --jq '.mergeCommit.oid')"
+              echo "merge_sha=$sha" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+            sleep 2
+          done
+
+          echo "PR did not report merged in time" >&2
+          exit 1
         env:
-          PR_URL: ${{github.event.pull_request.html_url}}
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Merge artifacts
+        uses: actions/upload-artifact/merge@v6
+        with:
+          name: crosslua-build-dependabot
+          pattern: 'lua*'
+          separate-directories: true
+          delete-merged: true
+          compression-level: 9
+
+      - name: Download merged artifact
+        uses: actions/download-artifact@v7
+        with:
+          name: crosslua-build-dependabot
+          path: crosslua-build
+
+      - name: Generate .zip file with archives
+        run: zip -r -9 crosslua-build.zip crosslua-build/*
+
+      - name: Create release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: v${{ github.run_number }}
+          name: CrossLua Build ${{ github.run_number }}
+          body: This release was automatically generated by a build script.
+          files: crosslua-build.zip
+          fail_on_unmatched_files: true
+          prerelease: false
+          draft: false
+          make_latest: true
+          target_commitish: ${{ steps.merge.outputs.merge_sha }}