fix: sign semantic-release version commits

[altaywtf]

Summary

Move package-version pushback into semantic-release prepare so the release tag points at the GitHub-signed version commit.

Changed

• add @jno21/semantic-release-github-commit@1.0.1
• remove the post-publication Ubuntu staging and commit steps
• correct release ordering documentation

Risks

The first merged release is the runtime proof. The same plugin/configuration already released successfully in uinaf/design.

Verification

• pnpm exec vp run verify
• actionlint
• semantic-release 25.0.3 dry run loaded every pinned plugin

Complexity

Deletes the separate post-release writeback path.

---

Summary by cubic

Sign version bump commits so the release tag points to the GitHub‑signed App commit. Remove the post‑publish write‑back, pin semantic-release to 25.0.3, and update docs for the new flow and App config.

• Bug Fixes
  • Add @jno21/semantic-release-github-commit@1.0.1 to commit package.json during prepare.
  • Create the tag from the signed App commit before npm publish and GitHub Release.
  • Remove post-publication staging/commit steps from the workflow.
  • Docs: fix release App variable to UINAF_RELEASE_APP_CLIENT_ID and clarify rulesets (App can create release tags; no default-branch bypass).
  • Workflow: pin semantic-release core to 25.0.3 for consistent behavior.

^{Written for commit 4320100. Summary will update on new commits.}

Summary by CodeRabbit

• Release Process

  • Release version updates are now committed with GitHub’s signed commit service before tagging.
  • Releases now follow a clearer sequence: update version, create the tag, then publish to npm and GitHub Releases.
  • Removed redundant post-release verification and version staging steps.

• Documentation

  • Updated release and versioning guidance to reflect the revised signed-commit workflow.

[coderabbitai]

📝 Walkthrough

Walkthrough

Semantic-release now uses GitHub’s signed App API to commit the released package.json before creating the tag and publishing npm and GitHub releases. The workflow adds the commit plugin and removes post-release version synchronization steps.

Changes

Signed release flow

Layer / File(s)	Summary
GitHub release commit integration .releaserc.json, .github/workflows/release.yml	The release configuration adds the GitHub commit plugin. The plugin updates package.json and creates a skip-CI version commit. Workflow comments document GitHub signing the commit.
Release process documentation docs/releasing.md	The documentation places the signed commit and tag creation before npm and GitHub publication. The Versioning section reflects the updated sequence.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• uinaf/workspace-kit#18: Both PRs modify semantic-release version-bump commits, release configuration, and documentation.

Poem

A rabbit checks the release gate,
A signed commit marks the version state.
The tag hops next, then packages fly,
To npm and GitHub in the sky.
“Skip CI!” the bunny sings,
While trusted releases spread their wings.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: signing semantic-release version commits.
Description check	✅ Passed	The description includes every required section and provides clear details about changes, risks, verification, and complexity.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR updates the release pipeline so the package.json version bump is committed via a GitHub-signed App commit during semantic-release prepare, with the intent that the vX.Y.Z tag points at that signed version commit.

Changes:

• Adds @jno21/semantic-release-github-commit@1.0.1 to semantic-release configuration and workflow plugin installation.
• Removes the separate post-publication npm pkg set version=... + GitHub API commit steps from the release workflow.
• Updates release documentation to reflect the new ordering and responsibilities.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
docs/releasing.md	Updates documentation for the new version-commit/tag/publish ordering.
.releaserc.json	Adds the GitHub-API commit plugin to perform signed package.json release commits in prepare.
.github/workflows/release.yml	Installs the new semantic-release plugin and removes the old post-release version writeback steps.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Around line 7-8: Replace the consumer-specific “uinaf-releaser” reference in
the release workflow comment with the synthetic fixture name
“fixture-release-app” or the generic term “release App,” preserving the
comment’s meaning about the short-lived installation token and App-authored
commit.

In @.releaserc.json:
- Around line 8-14: Prevent ref drift in the semantic-release prepare/publish
path configured with `@jno21/semantic-release-github-commit` by pinning the action
to a trusted commit SHA and ensuring release writes cannot race with publishing,
or failing when main changes after verification. Add a regression test that
simulates a push between verification/semantic-release analysis and prepare,
confirming the release does not publish against an unverified commit.

In `@docs/releasing.md`:
- Around line 26-28: Use a single canonical GitHub App variable name for the
release flow: update the release environment documentation and the
actions/create-github-app-token input in the release workflow to consistently
use UINAF_RELEASE_APP_ID, removing references to UINAF_RELEASE_APP_CLIENT_ID.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e97f2a15-1835-475f-afab-89f7a76cdf02

📥 Commits

Reviewing files that changed from the base of the PR and between c705fa9 and ea8b77c.

📒 Files selected for processing (3)

• .github/workflows/release.yml
• .releaserc.json
• docs/releasing.md