Sync auto-tag workflow with development process:

- Add pull request write permissions.
- Increase timeout for tag creation job.
- Implement automatic cherry-picking of release commits into development with conflict handling.
- Adjust test workflow triggers for better branch handling.

Author: frequency403

.github/workflows/auto-tag.yml

@@ -9,18 +9,18 @@ on:
 
 permissions:
   contents: write
+  pull-requests: write
 
 concurrency:
   group: auto-tag-${{ github.ref }}
   cancel-in-progress: false
 
 jobs:
   create-tag:
-    name: Create and Push Tag
-    # Only run when a release/* branch was actually merged (not just closed)
+    name: Create Tag and Sync Development
     if: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/')
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -54,3 +54,39 @@ jobs:
             -m "Release ${{ steps.version.outputs.version }}"
           git push origin "${{ steps.version.outputs.tag }}"
           echo "::notice::Tag ${{ steps.version.outputs.tag }} pushed successfully."
+
+      - name: Cherry-pick release commit into development
+        if: steps.check.outputs.exists == 'false'
+        env:
+          GH_TOKEN: ${{ secrets.PAT_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          RELEASE_SHA="${{ github.event.pull_request.head.sha }}"
+          VERSION="${{ steps.version.outputs.version }}"
+
+          git config user.name  "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          git fetch origin development
+          git checkout -B development origin/development
+
+          if git cherry-pick "$RELEASE_SHA"; then
+            git push origin development
+            echo "::notice::Cherry-pick of $RELEASE_SHA into development succeeded."
+          else
+            git cherry-pick --abort
+
+            SYNC_BRANCH="chore/sync-release-${VERSION}-to-development"
+            git checkout -B "$SYNC_BRANCH" origin/development
+            git push origin "$SYNC_BRANCH"
+
+            gh pr create \
+              --base development \
+              --head "$SYNC_BRANCH" \
+              --title "chore: sync release ${VERSION} into development" \
+              --body "$(printf 'Automatic cherry-pick of release \`%s\` (commit \`%s\`) into \`development\` failed due to conflicts.\n\nPlease apply and resolve manually:\n\n```\ngit fetch origin\ngit checkout %s\ngit cherry-pick %s\n# resolve conflicts\ngit push origin %s\n```' \
+                "$VERSION" "$RELEASE_SHA" "$SYNC_BRANCH" "$RELEASE_SHA" "$SYNC_BRANCH")"
+
+            echo "::warning::Cherry-pick conflict. PR created: $SYNC_BRANCH → development."
+          fi

.github/workflows/test.yml

@@ -2,8 +2,14 @@ name: Unit Tests
 
 on:
   push:
+    branches:
+      - master
+      - main
   pull_request:
-    branches: [ main, master, development ]
+    branches:
+      - master
+      - main
+      - development
   workflow_call:
 
 concurrency:
@@ -15,13 +21,16 @@ jobs:
     name: Run Tests
     runs-on: ubuntu-latest
     timeout-minutes: 20
-    # Run on every push except normal (non-forced) pushes to master/main.
-    # Always run when called from another workflow (workflow_call).
+    # Run on:
+    #   - workflow_call (gate for staging + build)
+    #   - pull_request targeting development, master, or main
+    #   - force push to master/main
+    # NOT on normal (non-forced) pushes to master/main — those are handled
+    # by auto-tag.yml or build.yml which call this via workflow_call.
     if: >
       github.event_name == 'workflow_call' ||
       github.event_name == 'pull_request'  ||
-      github.event.forced == true          ||
-      (github.ref != 'refs/heads/master' && github.ref != 'refs/heads/main')
+      (github.event_name == 'push' && github.event.forced == true)
 
     steps:
       - name: Checkout repository