ci(release): harden the package release flow

[sthanikan2000]

Stacked on #104 (staging releases on npm). The base branch is ci/npm-staged-publishing, so the diff below is only the hardening. After #104 merges (it is squash-merged), retarget this PR to main and rebase: git rebase --onto origin/main bf75ae5 chore/release-flow.

Summary

Packages here release independently, but the release notes didn't: GitHub's generated notes list every merged PR, there were no package or type labels, and the step from a merged bump to a release was manual. This makes the notes per package and tightens the bump and publish workflows.

It follows the OpenNSW/nsw-srilanka release procedure where that fits (label-driven notes, auto-labelling plus a label check, a drafting skill) and changes what a monorepo needs: per-package tags, and PRs scoped to a package by Package/<dir> label or by changed files.

Type of change

• Bug fix
• New feature
• Improvement to an existing feature
• Breaking change (consumers must change their code)
• Docs, tests, refactor or CI only

Changes made

PR checks

• pr-title.yml: require a Conventional Commit PR title. main is squash-only, so the title is the commit subject.
• pr-labels.yml: add Package/<dir> from the changed files, and Type/New Feature, Type/Bug or breaking change from the title (bots and chore(release) bumps get skip-changelog). The "Release notes label" check fails until the PR is classified.
• PR template with a consumer-facing Release notes section, and a .github/release.yml fallback for GitHub's "Generate release notes" button.

Release steps

• release-package skill (.claude/skills/release-package/): after the bump PR merges, collects only the PRs that belong to the package since its previous tag, drafts the notes in the existing format, and creates a draft GitHub Release pinned to the bump commit. It never tags, pushes or publishes.
• version-bump.yml: inputs go through env instead of being interpolated into shell, the new version must be strictly higher, it fails early if the branch or tag already exists, labels the PR, and its PR body points at the skill.
• release.yml: refuses a tagged commit that isn't on main; skips a version that's already on npm (so re-running an approved release is safe); stages pre-releases under the next dist-tag (npm 11 requires an explicit tag for them).

Docs

• CONTRIBUTING.md: PR titles, labels, and the release procedure with the skill; adding a package. Fixes the root README's "Releasing" section, which linked a workflow file that doesn't exist.

Testing

• actionlint, shellcheck and prettier --check are clean
• collect.sh reproduces the existing jsonforms-renderers-v0.11.0 notes (same PRs, same three new contributors); for auth it returns only feat(auth): add @opennsw/auth shared OIDC helpers #92 from the root commit and nothing after auth-v0.1.0
• resolve.sh guards: refuses an already-released version, a missing bump commit, a bad package name
• pr-labels.yml script run against 10 mocked scenarios (package labels, bot bump, no package, breaking across two packages, skip + breaking rejected, title edit swaps the type label)
• The workflows themselves haven't run. pull_request_target workflows run from main, so pr-labels.yml can't be exercised on this PR. After merge I'll open a throwaway PR touching packages/auth/ to check it.

Release notes

N/A. No package changes (skip-changelog).

Notes

• Conventional Commit Title and Release notes label are advisory: the branch ruleset has no required status checks, and changing it needs an admin.
• Already done on GitHub, not part of this diff: the new labels are created, the 21 PRs from the open, post-v0.11.0 and v0.11.0-window sets are labelled, and auth-v0.1.0 is tagged at d0bf312 as auth's baseline for its first notes.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: a7663f59-6492-413b-824a-9fdef3cd55d5

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[ginaxu1]

Lgtm