fix: automatically publish npm releases after main checks

[Fafoooo]

Merging to main currently runs CI but does not create a release: the npm workflow waits for a GitHub release to already exist. This change makes a main update run the full test matrix, then calculate the version, publish the npm package, and create its Git tag and GitHub release in the same workflow.

The first release from the existing 0.x tags is 1.0.0. Subsequent changes increment patch by default, minor for feat:, and major for conventional breaking changes. Successful reruns do not create duplicate versions. The published package receives the computed version; Git tags track releases without requiring bot commits to protected main.

The workflow keeps the existing publish.yml npm Trusted Publisher identity. Release dependencies run separately on Node 24, while the CLI retains Node 18+ support. Publishing requires all Linux/macOS/Windows checks to pass and grants write/OIDC permissions only to the publishing job.

Validation: 13 release tests pass, exercising real local tags and package tarballs for 1.0.0, 1.0.1, 1.1.0, 2.0.0, and repeat runs; clean release-dependency install, actionlint, and diff checks pass. Production and release dependency audits report zero vulnerabilities.

Merging this PR enables automatic publication and is expected to publish arbella@1.0.0 once the main checks pass.

Summary by CodeRabbit

• New Features

  • Added automated semantic versioning, npm publishing, and GitHub release creation after changes land on main.
  • Added release validation tests covering version increments, tags, package metadata, and duplicate-release prevention.
  • Added a dedicated release test job using Node 24.

• Documentation

  • Updated release guidance to explain automated publishing, conventional commits, trusted publishing, and Node version requirements.

• Chores

  • CI now validates pull requests and supports reusable workflow execution with read-only repository permissions.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 32dcc485-9ba3-408e-a044-3657075cf3aa

📥 Commits

Reviewing files that changed from the base of the PR and between bba02c1 and f2197ad.

⛔ Files ignored due to path filters (1)

• .github/release/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (7)

• .github/release/analyze-commits.mjs
• .github/release/package.json
• .github/release/release.config.cjs
• .github/release/test/versioning.test.mjs
• .github/workflows/ci.yml
• .github/workflows/publish.yml
• README.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The release process now uses semantic-release. Custom analysis promotes initial 0.x releases to 1.0.0. CI runs release tests, and publishing follows successful checks on pushes to main.

Changes

Automated release pipeline

Layer / File(s)	Summary
Release versioning and validation .github/release/package.json, .github/release/analyze-commits.mjs, .github/release/release.config.cjs, .github/release/test/versioning.test.mjs	Adds release tooling, custom version analysis, semantic-release configuration, and end-to-end tests for version progression and package metadata.
CI and publishing workflow .github/workflows/ci.yml, .github/workflows/publish.yml	Runs release tests through reusable CI checks and invokes semantic-release after successful pushes to main.
Release process documentation README.md	Documents automated publishing, conventional commit versioning, trusted publishing, and release-tooling requirements.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant GitHubPush
  participant publishWorkflow
  participant ciWorkflow
  participant semantic-release
  participant npmRegistry
  participant GitHubReleases
  GitHubPush->>publishWorkflow: trigger push to main
  publishWorkflow->>ciWorkflow: run reusable checks
  ciWorkflow-->>publishWorkflow: return successful checks
  publishWorkflow->>semantic-release: calculate and publish release
  semantic-release->>npmRegistry: publish package
  semantic-release->>GitHubReleases: create tag and release

Loading

Merge Risk: ⚪ Minimal · up to f2197

The automated release pipeline is ready to merge: releases are gated on CI and use the documented versioning, npm publishing, tagging, and GitHub release flow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: automatic npm release publishing after successful checks on main.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files. (4 skipped: 4 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/automatic-npm-releases

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-12T12:12:05.669648Z	f2197ad	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.