* feat: 3-tier release strategy with hotfix, release, and CI workflows
Supersedes PRs #1208 and #1210 with a consolidated approach:
- VERSIONING.md: Strategy document with 3 release tiers (patch/minor/major)
- hotfix.yml: Emergency patch releases to latest
- release.yml: Standard release cycle with RC/beta pre-releases to next
- auto-branch.yml: Create branches from issue labels
- branch-naming.yml: Convention validation (advisory)
- pr-gate.yml: PR size analysis and labeling
- stale.yml: Weekly cleanup of inactive issues/PRs
- dependabot.yml: Automated dependency updates
npm dist-tags: latest (stable) and next (pre-release) only,
following Angular/Next.js convention.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: address PR review findings for release workflow security and correctness
- Move all ${{ }} expression interpolation from run: blocks into env: mappings
in both hotfix.yml (~12 instances) and release.yml (~16 instances) to prevent
potential command injection via GitHub Actions expression evaluation
- Reorder rc job in release.yml to run npm ci and test:coverage before pushing
the git tag, preventing broken tagged commits when tests fail
- Update VERSIONING.md to accurately describe the implementation: major releases
use beta pre-releases only, minor releases use rc pre-releases only (no
beta-then-rc progression)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* security: harden release workflows — SHA pinning, provenance, dry-run guards
Addresses deep adversarial review + best practices research:
HIGH:
- Fix release.yml rc/finalize: dry_run now gates tag+push (not just npm publish)
- Fix hotfix.yml finalize: reorder tag-before-publish (was publish-before-tag)
MEDIUM — Security hardening:
- Pin ALL actions to SHA hashes (actions/checkout@11bd7190,
actions/setup-node@39370e39, actions/github-script@60a0d830)
- Add --provenance --access public to all npm publish commands
- Add id-token: write permission for npm provenance OIDC
- Add concurrency groups (cancel-in-progress: false) on both workflows
- Add branch-naming.yml permissions: {} (deny-all default)
- Scope permissions per-job instead of workflow-level where possible
MEDIUM — Reliability:
- Add post-publish verification (npm view + dist-tag check) after every publish
- Add npm publish --dry-run validation step before actual publish
- Add branch existence pre-flight check in create jobs
LOW:
- Fix VERSIONING.md Semver Rules: MINOR = "enhancements" not "new features"
(aligns with Release Tiers table)
Tests: 1166/1166 pass
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* security: pin actions/stale to SHA hash
Last remaining action using a mutable version tag. Now all actions
across all workflow files are pinned to immutable SHA hashes.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: address all Copilot review findings on release strategy workflows
- Configure git identity in all committing jobs (hotfix + release)
- Base hotfix on latest patch tag instead of vX.Y.0
- Add issues: write permission for PR size labeling
- Remove stale size labels before adding new one
- Make tagging and PR creation idempotent for reruns
- Run dry-run publish validation unconditionally
- Paginate listFiles for large PRs
- Fix VERSIONING.md table formatting and docs accuracy
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: clean up next dist-tag after finalize in release and hotfix workflows
After finalizing a release, the next dist-tag was left pointing at the
last RC pre-release. Anyone running npm install @next would get a stale
version older than @latest. Now both workflows point next to the stable
release after finalize, matching Angular/Next.js convention.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(ci): address blocking issues in 3-tier release workflows
- Move back-merge PR creation before npm publish in hotfix/release finalize
- Move version bump commit after test step in rc workflow
- Gate hotfix create branch push behind dry_run check
- Add confirmed-bug and confirmed to stale.yml exempt labels
- Fix auto-branch priority: critical prefix collision with hotfix/ naming
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
