fix: address release workflow review feedback

Author: Copilot

.github/workflows/release-tests.yml

@@ -35,38 +35,47 @@ on:
         default: Verbose
 
 permissions:
-  id-token: write
   contents: read
 
 jobs:
+  validate-main:
+    name: Validate Main Branch
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require refs/heads/main
+        run: |
+          if [ "${GITHUB_REF}" != "refs/heads/main" ]; then
+            echo "Release Tests must run from refs/heads/main; received ${GITHUB_REF}." >&2
+            exit 1
+          fi
+
   ci:
     name: CI (Unit + Build Package Tests)
+    needs: validate-main
     uses: ./.github/workflows/ci.yml
 
   all-types-integration:
     name: All-Types Integration Test
     needs: ci
+    permissions:
+      id-token: write
+      contents: read
     uses: ./.github/workflows/integration-test.yml
     with:
       sku: ${{ inputs.sku }}
       location: ${{ inputs.location }}
       log_level: ${{ inputs.log_level }}
-    secrets:
-      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
-      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-      APIM_PUBLISHER_EMAIL: ${{ secrets.APIM_PUBLISHER_EMAIL }}
+    secrets: inherit
 
   redact-secrets-integration:
     name: Redact Secrets Integration Test
     needs: all-types-integration
+    permissions:
+      id-token: write
+      contents: read
     uses: ./.github/workflows/integration-redact-secrets.yml
     with:
       sku: ${{ inputs.sku }}
       location: ${{ inputs.location }}
       log_level: ${{ inputs.log_level }}
-    secrets:
-      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
-      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-      APIM_PUBLISHER_EMAIL: ${{ secrets.APIM_PUBLISHER_EMAIL }}
+    secrets: inherit