The Googler check moved out of `pack-and-upload-artifact` and into the
pull request labeling action, which runs in a privileged
`pull_request_target` context where secrets are available. The build job
runs on `pull_request` and never receives secrets, so it no longer needs
`angular-robot-key` or `triggering-label`, and the `bypassed_for_forks`
placeholder can go away. Bumps the dev-infra pins to pick up that change.
(cherry picked from commit 1b7dcc854a)
Adds `# main` version comments after SHA references for `angular/dev-infra` GitHub Actions across workflows so that Renovate tracks the main branch and proposes updates when digests change.
(cherry picked from commit 32815d5472)
Updates the reusable workflow reference to target the merged dev-infra commit e9faacd5b4df391f59989b6fb448b2c24115d592. Passes the ANGULAR_ROBOT_PRIVATE_KEY secret as angular-robot-key. Downgrades default contents permission to read as write access is handled by the App token in the custom action.
Introduce the caller GitHub Actions workflow for release publishing, which delegates the build and publish steps to the centralized reusable workflow in dev-infra. This targets the merged reusable workflow in dev-infra by SHA.
Angular Robot