Update release finalization to push postrelease branch (apache#33467)

* Update release finalization to push postrelease branch

* Update republish_released_docker_containers.yml

* Protect newly created branch

.github/workflows/finalize_release.yml

@@ -138,6 +138,7 @@ jobs:
       env:
         VERSION_TAG: "v${{ github.event.inputs.RELEASE }}"
         RC_TAG: "v${{ github.event.inputs.RELEASE }}-RC${{ github.event.inputs.RC }}"
+        POST_RELEASE_BRANCH: "release-${{ github.event.inputs.RELEASE }}-postrelease"
       run: |
         # Ensure local tags are in sync. If there's a mismatch, it will tell you.
         git fetch --all --tags --prune
@@ -152,3 +153,27 @@ jobs:
         # Tag for repo root.
         git tag "$VERSION_TAG" "$RC_TAG"^{} -m "Tagging release" --local-user="${{steps.import_gpg.outputs.name}}"
         git push https://github.com/apache/beam "$VERSION_TAG"
+
+        git checkout -b "$POST_RELEASE_BRANCH" "$VERSION_TAG"
+        git push https://github.com/apache/beam "$POST_RELEASE_BRANCH"
+
+  update_master:
+    needs: push_git_tags
+    runs-on: ubuntu-latest
+    env:
+        POST_RELEASE_BRANCH: "release-${{ github.event.inputs.RELEASE }}-postrelease"
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+      - name: Set git config
+        run: |
+          git config user.name $GITHUB_ACTOR
+          git config user.email actions@"$RUNNER_NAME".local
+      - name: Update .asf.yaml to protect new postrelease branch from force push
+        run: |
+          sed -i -e "s/master: {}/master: {}\n    ${POST_RELEASE_BRANCH}: {}/g" .asf.yaml
+      - name: Commit and Push to master branch files with Next Version
+        run: |
+          git add .asf.yaml
+          git commit -m "Moving to ${NEXT_VERSION_IN_BASE_BRANCH}-SNAPSHOT on master branch."
+          git push origin ${MASTER_BRANCH}

.github/workflows/republish_released_docker_containers.yml

@@ -43,7 +43,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          ref: "v${{ env.release }}-RC${{ env.rc }}"
+          ref: "release-${{ env.release }}-postrelease"
           repository: apache/beam
       - name: Free Disk Space (Ubuntu)
         uses: jlumbroso/free-disk-space@v1.3.0