Replace semantic-release with developer-controlled version bump workflow

[swethasukumarr]

No description provided.

[Copilot]

Pull request overview

This PR replaces the repository’s semantic-release-based automation with a manually triggered GitHub Actions workflow that computes a version bump, tags the repository, builds a release archive, and publishes a GitHub Release.

Changes:

• Adds a workflow_dispatch input to select patch|minor|major and computes the next version from git tags.
• Enforces allowed release branches via an explicit validation step instead of a job-level if.
• Creates/pushes a tag, builds a tarball + checksum, and creates/updates a GitHub Release via gh.

Suppressed comments (3)

.github/workflows/release.yml:55

• The "latest" tag is selected as the highest version across the whole repository (git tag --sort=-v:refname). On maintenance branches (e.g. *.x-maintenance) this can pick a tag from a different release line and compute an invalid next version. Also, the parsing assumes tags are exactly vMAJOR.MINOR.PATCH; tags with suffixes (e.g. pre-releases) will break the arithmetic.

          latest="$(git tag --list 'v*' --sort=-v:refname | head -n1)"

          if [ -z "$latest" ]; then
            latest="v0.0.0"
          fi

.github/workflows/release.yml:105

• If the tag already exists on origin, the workflow exits the tagging step but continues building and uploading assets from the current HEAD. Re-running the workflow from a different commit could overwrite the existing release assets for that tag, producing a tag/release that no longer matches its artifacts.

          if git ls-remote --exit-code --tags origin "refs/tags/${TAG}" >/dev/null 2>&1; then
            echo "Tag ${TAG} already exists on origin; continuing."
            exit 0
          fi

.github/workflows/release.yml:85

• The previous release automation enforced that CHANGELOG.md was updated before publishing. This workflow no longer performs that check, which makes it easy to cut a release without updating the changelog.

      - name: Validate release has changes
        env:
          LATEST: ${{ steps.version.outputs.latest }}
        shell: bash

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Suppressed comments (3)

Previously missed (1) — in code that hasn't changed since the last review.

.github/workflows/release.yml:20

• Add a workflow/job-level concurrency group to prevent two manual release runs from racing (both could compute the same next tag and/or publish conflicting assets). The repo already uses workflow concurrency elsewhere (e.g., .github/workflows/ci.yml:428-430).

  release:
    runs-on: ubuntu-latest

.github/workflows/release.yml:52

• This multi-command bash block does not enable strict mode, so failures (e.g., arithmetic errors while bumping, failed fetch, etc.) can be missed and still write outputs. Other workflows in this repo typically start run blocks with set -euo pipefail (see .github/workflows/ci.yml:444,471,495).

        run: |
          git fetch --tags --force origin

          latest="$(git tag --list 'v*' --sort=-v:refname | head -n1)"

.github/workflows/release.yml:105

• If the computed tag already exists on origin, this step exits successfully and the workflow continues building/uploading artifacts from the current HEAD. That can publish artifacts that don't correspond to the existing tag (e.g., due to a race or a previous tag already pointing at a different commit). Verify the existing tag points to HEAD and fail otherwise.

        run: |
          if git ls-remote --exit-code --tags origin "refs/tags/${TAG}" >/dev/null 2>&1; then
            echo "Tag ${TAG} already exists on origin; continuing."
            exit 0
          fi

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

Suppressed comments (2)

Previously missed (1) — in code that hasn't changed since the last review.

.github/workflows/release.yml:18

• This workflow can be manually dispatched multiple times concurrently for the same branch, which can race on tag creation and release asset uploads (TOCTOU between ls-remote and git push, and gh release create/upload). Adding a concurrency group prevents overlapping release runs per ref.

permissions:
  contents: write

jobs:

.github/workflows/release.yml:38

• The error message describes a ".rc" branch, but the intended RC naming (and the updated glob) is "-rc". Keeping this message consistent helps avoid confusion when the workflow blocks a release.

              echo "Release blocked: branch '$branch' is not allowed. Use 'main', a '*.rc' branch, or a '*.*.x-maintenance' branch."