ci(release): restore uinaf-releaser version push-back

[altaywtf]

Summary

• Restore @semantic-release/git push-back for package.json
• Mint short-lived uinaf-releaser tokens for git/GitHub writes (npm stays OIDC)
• Gate verify/secrets/release on [skip ci]; document App + ruleset bypass

Test plan

• Seed release Environment with UINAF_RELEASE_APP_ID + UINAF_RELEASE_APP_PRIVATE_KEY
• Add Integration bypass for App 4474917 on protect-main + protect-release-tags
• Verify CI on this PR (actionlint/zizmor + verify)
• After merge, next releasable push bumps package.json as uinaf-releaser[bot]

Review aids

flowchart LR
  verify[verify] --> mint[create-github-app-token]
  mint --> auth[gh auth setup-git]
  auth --> sr[semantic-release]
  sr --> npmOidc[npm OIDC publish]
  sr --> pushback["package.json bump as uinaf-releaser"]
  sr --> ghRel[GitHub Release]

Loading

Before/after: tag-only releases with non-authoritative package.json → push-back bump commits attributed to uinaf-releaser[bot]; resolveKitVersion still uses max(manifest, tags).

Made with Cursor

---

Summary by cubic

Restores automated package.json version push-back using @semantic-release/git, authored by uinaf-releaser[bot], while npm publishing stays on Trusted Publishing (OIDC). CI skips bump commits via [skip ci], and the release job no longer hard-codes the canonical repo (it runs where the release env App creds exist).

• New Features
  • Use uinaf-releaser GitHub App token for tags/releases and git writes; drop workflow contents: write and scope the token to this repo from context.
  • Add @semantic-release/git to bump package.json with [skip ci]; author/committer set to ${app-slug}[bot] with a linked noreply email resolved from the bot user ID.
  • Gate verify, secrets, and release on [skip ci]; remove the canonical-repo gate.
  • Update docs/releasing.md with push-back behavior, App setup (UINAF_RELEASE_APP_ID, UINAF_RELEASE_APP_PRIVATE_KEY), ruleset bypass, and versioning notes.

^{Written for commit 1ad1677. Summary will update on new commits.}

[coderabbitai]

📝 Walkthrough

Walkthrough

The release workflow skips jobs for [skip ci] commits, uses a GitHub App installation token for write operations, and configures semantic-release to commit package.json version updates. The release documentation describes the updated process and required credentials.

Changes

Release automation

Layer / File(s)	Summary
Workflow gating and App authentication .github/workflows/release.yml	The workflow skips release jobs for [skip ci] commits, uses read-only repository permissions, creates a scoped GitHub App token, and passes it to semantic-release.
Version writeback and release process .releaserc.json, docs/releasing.md	semantic-release commits package.json updates. The documentation describes version resolution, App credentials, Trusted Publishing, and ruleset bypasses.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• uinaf/autoreview#41 — Both changes use a scoped GitHub App token and semantic-release automation; that issue also covers signed CLI artifacts and Homebrew publication.

Suggested reviewers: copilot

Poem

A rabbit checks the release gate,
And skips the commits marked to wait.
An App token hops in sight,
Version bumps commit just right.
Tags and docs now share one trail.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the restored release version push-back, which is the primary change in the pull request.
Description check	✅ Passed	The description explains the changes and verification plan in detail, although it does not use all template headings.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR restores semantic-release “push-back” so package.json is version-bumped and committed to main, and updates the release workflow to perform Git/GitHub writes using a short-lived GitHub App installation token (keeping npm publish via OIDC). Documentation is updated to reflect the new release mechanics, including [skip ci] gating and ruleset bypass expectations.

Changes:

• Add @semantic-release/git to commit back the bumped package.json with a [skip ci] message.
• Update release.yml to mint and use a GitHub App token for release/tag creation and push-back commits, and skip verify/secrets/release jobs when [skip ci] is present.
• Update docs/releasing.md to document the restored push-back flow, App token usage, and ruleset bypass.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
docs/releasing.md	Updates release documentation to reflect push-back commits, [skip ci] gating, and GitHub App-based write access.
.releaserc.json	Restores @semantic-release/git to commit the bumped package.json back to main with [skip ci].
.github/workflows/release.yml	Switches Git/GitHub writes to a minted GitHub App token and gates jobs on [skip ci].

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/release.yml (1)

18-18: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Skip-ci condition duplication is acceptable but redundant on the release job.

The release job already declares needs: [verify, secrets]. When those jobs are skipped by their own [skip ci] condition, release is skipped automatically by default needs semantics, so the duplicated if on Line 48 is redundant. This is not a bug, just duplicated logic across three jobs.

Also applies to: 42-48

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml at line 18, Remove the redundant [skip ci]
condition from the release job’s if expression, while retaining its needs
dependency on verify and secrets so default GitHub Actions needs semantics
continue to skip release when either prerequisite is skipped.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/release.yml:
- Line 18: Remove the redundant [skip ci] condition from the release job’s if
expression, while retaining its needs dependency on verify and secrets so
default GitHub Actions needs semantics continue to skip release when either
prerequisite is skipped.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8a9b0dc9-22b9-4036-af38-9e0ade7d83a2

📥 Commits

Reviewing files that changed from the base of the PR and between 07d9420 and 62a37d4.

📒 Files selected for processing (3)

• .github/workflows/release.yml
• .releaserc.json
• docs/releasing.md