ci(release): restore uinaf-releaser version push-back (#18)

* ci(release): restore uinaf-releaser version push-back

Add @semantic-release/git bump commits authored by uinaf-releaser, mint App tokens for git/GitHub writes, and keep npm on Trusted Publishing. Rulesets bypass the App while humans still require signed commits.

Co-authored-by: Cursor <cursoragent@cursor.com>

* ci(release): address Copilot feedback on App identity

Scope the App token from github context, resolve the bot user id at runtime for linked noreply emails, and gate release to the canonical repo.

Co-authored-by: Cursor <cursoragent@cursor.com>

* ci(release): drop canonical-repo name gate

Forks already lack the release Environment App credentials; hard-coding the repository name is unnecessary.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: altaywtf

.github/workflows/release.yml

@@ -3,10 +3,9 @@ name: Release
 # Canonical verify -> release on push to main. Publishing uses npm Trusted
 # Publishing (OIDC): npmjs.com lists this workflow filename (release.yml)
 # and the "release" environment as the package's trusted publisher — see
-# docs/releasing.md. Versioning is tag-only (no bump-back commits: the main
-# ruleset requires signed commits, so semantic-release computes the version
-# from Conventional Commits and stamps it into the published tarball; the
-# checked-in package.json version is not authoritative).
+# docs/releasing.md. Version push-back and GitHub Release writes use a
+# short-lived uinaf-releaser installation token (rulesets bypass that App
+# for unsigned bot commits/tags while humans still require signed commits).
 
 on:
   push:
@@ -16,6 +15,7 @@ permissions: {}
 
 jobs:
   verify:
+    if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
@@ -39,11 +39,13 @@ jobs:
       - run: vp run verify # vp check + vp test + vp pack + cli smoke
 
   secrets:
+    if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }}
     permissions:
       contents: read
     uses: ./.github/workflows/secrets.yml
 
   release:
+    if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }}
     needs: [verify, secrets]
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -53,7 +55,7 @@ jobs:
       group: release-${{ github.repository }}-main
       cancel-in-progress: false
     permissions:
-      contents: write # GitHub release + v* tag
+      contents: read
       id-token: write # OIDC for npm trusted publishing
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -72,6 +74,39 @@ jobs:
           node-version-file: ".node-version"
           run-install: |
             - args: ["--frozen-lockfile"]
+      - name: Create release bot token
+        id: release-bot
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.UINAF_RELEASE_APP_ID }}
+          private-key: ${{ secrets.UINAF_RELEASE_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: ${{ github.event.repository.name }}
+          permission-contents: write
+      - name: Authorize release writes
+        env:
+          GH_TOKEN: ${{ steps.release-bot.outputs.token }}
+        run: gh auth setup-git
+      # GitHub links bot commits when the noreply email uses `{user-id}+{slug}[bot]@…`.
+      - name: Resolve release bot identity
+        id: release-bot-identity
+        env:
+          GH_TOKEN: ${{ steps.release-bot.outputs.token }}
+          APP_SLUG: ${{ steps.release-bot.outputs.app-slug }}
+        run: echo "user-id=$(gh api "/users/${APP_SLUG}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
       - uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90 # v6.0.0
+        with:
+          extra_plugins: |
+            @semantic-release/commit-analyzer@13.0.1
+            @semantic-release/release-notes-generator@14.1.1
+            @semantic-release/npm@13.1.5
+            @semantic-release/git@10.0.1
+            @semantic-release/github@12.0.8
+            conventional-changelog-conventionalcommits@9.3.1
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.release-bot.outputs.token }}
+          GH_TOKEN: ${{ steps.release-bot.outputs.token }}
+          GIT_AUTHOR_NAME: ${{ steps.release-bot.outputs.app-slug }}[bot]
+          GIT_AUTHOR_EMAIL: ${{ steps.release-bot-identity.outputs.user-id }}+${{ steps.release-bot.outputs.app-slug }}[bot]@users.noreply.github.com
+          GIT_COMMITTER_NAME: ${{ steps.release-bot.outputs.app-slug }}[bot]
+          GIT_COMMITTER_EMAIL: ${{ steps.release-bot-identity.outputs.user-id }}+${{ steps.release-bot.outputs.app-slug }}[bot]@users.noreply.github.com

.releaserc.json

@@ -5,6 +5,13 @@
     "@semantic-release/commit-analyzer",
     "@semantic-release/release-notes-generator",
     "@semantic-release/npm",
+    [
+      "@semantic-release/git",
+      {
+        "assets": ["package.json"],
+        "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
+      }
+    ],
     [
       "@semantic-release/github",
       {

docs/releasing.md

@@ -3,34 +3,43 @@
 Releases are **fully automatic**: every push to `main` runs verification and
 then semantic-release, which computes the next version from Conventional
 Commits (`fix:` → patch, `feat:` → minor, `BREAKING CHANGE:` → major),
-publishes to npm, and creates the `v*` tag and GitHub release with notes.
-Commits that don't warrant a release (`docs:`, `chore:`, `test:`, …) publish
-nothing.
+publishes to npm, bumps `package.json`, and creates the `v*` tag and GitHub
+release with notes. Commits that don't warrant a release (`docs:`, `chore:`,
+`test:`, …) publish nothing. Release bump commits include `[skip ci]` so they
+do not re-enter verify/release.
 
 Publishing uses **npm Trusted Publishing (OIDC)**: GitHub Actions proves its
 identity to npm per-run and provenance attestations are generated
 automatically. No npm token exists in this repository, its secrets, or any
 maintainer machine.
 
-## Versioning is tag-only
+GitHub Release and version push-back commits are authored by
+`uinaf-releaser[bot]` via a short-lived App installation token minted in the
+`release` Environment (`UINAF_RELEASE_APP_ID` /
+`UINAF_RELEASE_APP_PRIVATE_KEY`). The `protect-main` and
+`protect-release-tags` rulesets still require signed commits/tags for humans,
+and grant an Integration bypass to that App for unsigned bot writeback.
 
-The `main` ruleset requires signed commits, so there are no bot bump-back
-commits: the checked-in `package.json` version is **not authoritative**.
-Full source checkouts use the greater of that placeholder and the latest
-reachable strict `vX.Y.Z` tag; builds bake that effective version into the CLI.
-Shallow clones and source archives fail with a tag-history instruction instead
-of silently stamping the placeholder version.
-Semantic-release derives the next version, stamps `package.json` before the
-prepack gate, and therefore bakes the release version into the published
-tarball. Look up the released version with
-`npm view @uinaf/workspace-kit version` or the latest tag, not package.json.
+## Versioning
+
+`@semantic-release/git` commits the bumped `package.json` back to `main`.
+Full source checkouts still resolve the greater of the checked-in manifest and
+the latest reachable strict `vX.Y.Z` tag (see `src/version.ts`); builds bake
+that effective version into the CLI. Shallow clones and source archives fail
+with a tag-history instruction instead of silently stamping a stale
+placeholder. Look up the released version with
+`npm view @uinaf/workspace-kit version` or the latest tag when in doubt.
 
 ## Configuration record (already done)
 
 - Trusted publisher registered on npm for `@uinaf/workspace-kit`:
   repository `uinaf/workspace-kit`, workflow `release.yml`, environment
   `release`, permission `publish`.
 - GitHub `release` environment restricted to `main` branch runs.
+- `release` Environment holds `UINAF_RELEASE_APP_ID` (variable) and
+  `UINAF_RELEASE_APP_PRIVATE_KEY` (secret) for git/GitHub writeback.
+- Rulesets bypass Integration `uinaf-releaser` (`4474917`) for bot push-back
+  and release tags.
 - `v0.1.0` was the one-time manual bootstrap publish (trusted publishing
   requires an existing package); it carries no provenance. Every CI-published
   version does.