Sync .github/workflows/next-changelog.yml and tagging.yml to main

These two workflow files are auto-generated (# Generated file. DO NOT EDIT.).
Restoring them to match origin/main so the revert PR introduces no workflow
drift versus main.

Changes since v1.113.0 that produced the divergence (now discarded):

next-changelog.yml:
  - #5570 (5ea18ac): added pull_request_target types filter, dependabot
    skip, bumped actions/checkout v3.6.0 -> v6.0.2
  - #5621 (ba1223c): runner-group switch deco-testing -> protected-runner

tagging.yml:
  - #5621 (ba1223c): runner-group switch + Upload created tags artifact step
  - #5656 (5dc7b31): added packages workflow input + conditional tagging.py call
  - #5665 (eebe29b): removed duplicate '# Generated file' comment

Author: tanmay-db

.github/workflows/next-changelog.yml

@@ -4,16 +4,19 @@ name: Check for NEXT_CHANGELOG.md Changes
 on:
   # Use pull_request_target to have access to GitHub API
   pull_request_target:
+    types: [opened, synchronize, reopened, edited]
 
 jobs:
   check-next-changelog:
+    # Allow Dependabot PRs to pass without a changelog entry
+    if: github.actor != 'dependabot[bot]'
     runs-on:
-      group: databricks-deco-testing-runner-group
-      labels: ubuntu-latest-deco
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Fetch list of changed files
         id: changed-files

.github/workflows/tagging.yml

@@ -4,7 +4,12 @@ name: tagging
 on:
   # Manual dispatch.
   workflow_dispatch:
-    # No inputs are required for the manual dispatch.
+    inputs:
+      packages:
+        description: 'Comma-separated list of packages to tag (e.g. "pkg1,pkg2"). Leave empty to tag all packages with pending releases.'
+        required: false
+        type: string
+        default: ''
 
   # NOTE: Temporarily disable automated releases.
   #
@@ -32,8 +37,8 @@ jobs:
       github.repository == 'databricks/databricks-sdk-java'
     environment: "release-is"
     runs-on:
-      group: databricks-deco-testing-runner-group
-      labels: ubuntu-latest-deco
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
     steps:
       - name: Generate GitHub App Token
         id: generate-token
@@ -61,4 +66,18 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
           GITHUB_REPOSITORY: ${{ github.repository }}
-        run: uv run --locked tagging.py
+          PACKAGES: ${{ inputs.packages }}
+        run: |
+          if [ -n "$PACKAGES" ]; then
+            uv run --locked tagging.py --package "$PACKAGES"
+          else
+            uv run --locked tagging.py
+          fi
+
+      - name: Upload created tags artifact
+        if: always()
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        with:
+          name: created-tags
+          path: created_tags.json
+          if-no-files-found: ignore