From d3c8ce71f69f53fbb5bb1fb2505a1045f6de555c Mon Sep 17 00:00:00 2001
From: Wikid82 <jhatfield82@gmail.com>
Date: Mon, 7 Sep 2026 15:17:52 -0400
Subject: [PATCH] ci: release on dependency bumps via deps: prefix

release-please only bumps versions for feat/fix/breaking by default, so
the recent run of chore(deps) dependency bumps landed on main without
cutting a release.

- release-please-config.json: add changelog-sections. feat/fix/perf/
  deps/revert are visible and release-triggering; chore/ci/build/docs/
  style/refactor/test are explicitly hidden and non-releasing. A type
  listed here without "hidden": true is treated as release-triggering
  by release-please, so deps: now bumps a patch.
- .github/renovate.json: semanticCommitType "deps" (scope dropped) so
  dependency PRs merge as "deps: ...", landing in a dedicated
  Dependencies changelog section and cutting a patch release. The
  github-actions manager is carved out to chore: since action digest
  pins don't change the bundled extension.
- CLAUDE.md: document the commit-prefix conventions.
---
 .github/renovate.json      |  7 +++++++
 CLAUDE.md                  | 18 ++++++++++++++++++
 release-please-config.json | 14 ++++++++++++++
 3 files changed, 39 insertions(+)

diff --git a/.github/renovate.json b/.github/renovate.json
index 5e918d5..6cd5e29 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -7,6 +7,8 @@
     "helpers:pinGitHubActionDigests"
   ],
   "baseBranchPatterns": ["development"],
+  "semanticCommitType": "deps",
+  "semanticCommitScope": null,
   "postUpdateOptions": ["npmDedupe"],
   "skipInstalls": false,
   "timezone": "America/New_York",
@@ -35,6 +37,11 @@
       "groupName": "github-actions-non-major",
       "groupSlug": "github-actions-non-major"
     },
+    {
+      "description": "GitHub Actions bumps are CI-only — they don't change the bundled extension, so keep them as chore: (non-releasable) rather than deps: (cuts a release).",
+      "matchManagers": ["github-actions"],
+      "semanticCommitType": "chore"
+    },
     {
       "description": "Group npm non-major updates into one PR",
       "matchManagers": ["npm"],
diff --git a/CLAUDE.md b/CLAUDE.md
index a6d37fc..95a90ee 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -16,6 +16,24 @@ the `propagate-main-to-development` workflow. `promote-dev-to-main` opens a
 weekly PR the other direction once `development`'s CI is green. release-please
 drives versioning and publishing off Conventional Commit prefixes on `main`.
 
+Commit-prefix conventions (applies to PR titles, and to local commits so a
+bundled promotion still parses):
+
+- `deps:` for any dependency bump — Renovate emits this automatically
+  (`.github/renovate.json` → `semanticCommitType: deps`). It cuts a patch
+  release and lands in the changelog's "Dependencies" section, which is the
+  point: a vuln fix in a bundled dependency should ship a new version.
+- `chore:` for dependency bumps that don't affect the bundled extension —
+  GitHub Actions digest pins, CI-only tooling. Non-releasable by design.
+- `ci:` for `.github/workflows/*`, `build:` for build-tooling changes that
+  aren't dep bumps, `docs:` for docs-only. All non-releasable.
+- `feat:` / `fix:` for actual product changes, as normal.
+- Only `feat:`, `fix:`, `perf:`, `deps:`, and breaking changes (`!` /
+  `BREAKING CHANGE:`) trigger a release — `release-please-config.json` →
+  `changelog-sections` defines the set (a type listed there without
+  `"hidden": true` is release-triggering; that's why `deps` bumps a version
+  and `chore`/`ci` don't).
+
 ## Definition of Done
 
 Every change is expected to clear this bar before it's mergeable:
diff --git a/release-please-config.json b/release-please-config.json
index 4ee8443..fa0e128 100644
--- a/release-please-config.json
+++ b/release-please-config.json
@@ -3,6 +3,20 @@
   "release-type": "node",
   "pull-request-header": "Here's what's new in Workspace File Bookmarks",
   "pull-request-footer": "Merge this PR to cut the release.",
+  "changelog-sections": [
+    { "type": "feat", "section": "Features" },
+    { "type": "fix", "section": "Bug Fixes" },
+    { "type": "perf", "section": "Performance Improvements" },
+    { "type": "deps", "section": "Dependencies" },
+    { "type": "revert", "section": "Reverts" },
+    { "type": "docs", "section": "Documentation", "hidden": true },
+    { "type": "style", "section": "Styles", "hidden": true },
+    { "type": "chore", "section": "Miscellaneous", "hidden": true },
+    { "type": "refactor", "section": "Code Refactoring", "hidden": true },
+    { "type": "test", "section": "Tests", "hidden": true },
+    { "type": "build", "section": "Build System", "hidden": true },
+    { "type": "ci", "section": "Continuous Integration", "hidden": true }
+  ],
   "packages": {
     ".": {
       "draft": true,