[cris005]

Ported from noppu-labs/opencode-permission-reviewer#117.

What changes

Every push to main now runs release.yml:

1. pending (read-only, no checkout) reads the package.json version through the API, rejects anything that isn't semver, and stops if v<version> already exists. Pushes that don't bump the version release nothing.
2. If the version is untagged, quality and build run against the merge commit as a pre-check. Their tag gate is replaced on this event by: HEAD is GITHUB_SHA, HEAD descends from origin/main, the tag doesn't exist yet, and it equals v + the package.json version.
3. tag (contents: write, actions: write, no checkout) creates the annotated tag through the REST API and runs gh workflow run release.yml --ref v<version> -f tag=v<version>.
4. That dispatched run is the existing tag path, unchanged, and it publishes. A GITHUB_TOKEN dispatch starts a new run (a GITHUB_TOKEN tag push wouldn't). Because the run's ref is the tag, npm provenance and attestations still record refs/tags/v<version>.

publish never runs on the push to main. If the pre-check fails, no tag is created: fix it in another PR and merge again with the same version. Hand-pushed v* tags and dispatch retries work as before.

Also included:

• tests/release-workflow.test.ts: structural checks on triggers, permissions and gating, plus a guard that no job with write permissions installs dependencies. The push-to-main path itself can only be exercised in real CI.
• Docs: the release.yml header, a rewritten "Releases" section in docs/CONTRIBUTING.md (flow, retries, recovery, rulesets), SECURITY.md, and the release rule in CLAUDE.md.

Differences from permission-reviewer#117

• No develop branch here: the docs describe a version-bump PR straight into main.
• No prerelease handling: -rc versions publish to npm latest, same as before.
• No CHANGELOG.md or docs/SUPPLY-CHAIN.md here; the matching docs are docs/CONTRIBUTING.md and SECURITY.md.
• quality now checks out the tag on manual retries (previously it tested whatever ref the dispatch ran from; build already checked out the tag).
• Ruleset: the release tags ruleset here cannot list the GitHub Actions app as a bypass actor (GitHub only allows that on org-level rulesets), so instead of a creation rule with a bypass, creation stays open and update, deletion and non-fast-forward are blocked. A release tag can never move or disappear; a hand-made tag still has to point at a commit on main and match the package.json version, or build stops it before anything is published. That ruleset change is already applied on the repo.

After merging

• package.json still carries 0.6.1, and v0.6.1 is already tagged, so merging this PR triggers the workflow but pending stops it green without dispatching. Nothing is released.
• The next PR that bumps the version is the first automatic release. Expect the push run to end with "Dispatched release.yml at v" and a second run at the tag that publishes.

Verification

• bun run fmt:check, bun run lint, bun run typecheck: clean
• bun test: 939 pass (7 new in tests/release-workflow.test.ts)
• actionlint .github/workflows/release.yml: only the pre-existing SC2035 info on the untouched checksums step

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud