ci: commit version bump directly via @semantic-release/git

[kgogov]

What

Replace the bespoke bump-version composite action + PR flow with the standard @semantic-release/git plugin. semantic-release now commits the version bump (package.json, package-lock.json, app/manifest.json, CHANGELOG.md) straight to master as part of the release job.

Why

Every release currently produces a housekeeping PR (chore: release X.Y.Z) that has to be reviewed and merged manually. When that step is skipped, master's version files fall behind the published release — exactly what happened with PR #364 (which sat open from 2026-07-15 until yesterday, leaving package.json at 1.9.2 while v1.10.0 was live on the Releases page).

@semantic-release/git is the standard plugin for exactly this case. Since it's already declared in devDependencies at ^10.0.1, no new dependency is introduced.

Changes

File	Change
.releaserc.json	registered @semantic-release/git between exec (writes version files) and github (publishes)
.github/workflows/release.yml	removed the Bump Version step; retained pull-requests: write for @semantic-release/github release comments; fixed two typos in the release-step comment
.github/actions/bump-version/action.yml	deleted (unreachable)
.github/actions/bump-version/index.js	deleted (unreachable)

Commit-message template: chore(release): ${nextRelease.version} — the concise override is required because the plugin's release-notes body can violate this repository's body-max-line-length commitlint rule. Release notes remain in CHANGELOG.md and the GitHub release.

Validation

Ran the complete workflow_dispatch job locally with act and Docker against an isolated Git remote and a mock GitHub API. This was a real, non-dry-run semantic-release execution; no production repository, tag, release, or PR was modified by the simulation.

A synthetic feat: commit after v1.10.0 produced and verified all expected effects:

• all 589 tests passed;
• semantic-release selected version 1.11.0;
• @semantic-release/git committed exactly package.json, package-lock.json, app/manifest.json, and CHANGELOG.md;
• the generated commit was chore(release): 1.11.0 and passed Husky/commitlint;
• local master and tag v1.11.0 both pointed to the release commit;
• all three version fields and the packaged ZIP manifest contained 1.11.0;
• @semantic-release/github created a mocked release, uploaded ui5inspector-v1.11.0.zip, commented on the associated PR, and added the released label.

The simulation also confirmed that pull-requests: write must remain because the GitHub plugin posts the included-in-release PR comment and label.

Notes worth flagging

1. Bot identity for the bump commit changes from github-actions[bot] (used by the old custom action) to semantic-release-bot (the plugin's default). Direct pushes to master are not subject to the SAP CLA (which only gates PRs), so no CLA breakage.
2. master branch protection is currently disabled — this flow requires unprotected push access. If required-PR protection is ever added, the plugin will need a bot with bypass rights or the workflow will need reworking.
3. First run happens on the next monthly cron (2026-09-15) unless triggered earlier via workflow_dispatch. Ordering is safe: @semantic-release/git runs before @semantic-release/github, so a failed commit blocks the release cleanly.

Fixes

Closes the underlying problem behind #364 (the manual-merge bump PR).

[NakataCode]

Heads-up: pull-requests: write might still be needed

Nice cleanup removing pull-requests: write now that gh pr create is gone! One thing worth double-checking though: @semantic-release/github also uses that permission to post its "included in release" comments on merged PRs. It's a separate consumer from the old bump-version action, so those comments might quietly stop working once the permission is gone. Might be worth keeping it around for that reason.

[kgogov]

Heads-up: pull-requests: write might still be needed

Good catch. I restored pull-requests: write in fa1e609 so @semantic-release/github can continue posting its included-in-release comments.