chore(release): prepare v0.1.3 + auto-sync the bundle version pin in CI (#5)

The skill launcher (bin/sonar) reads SONAR_BUNDLE_VERSION from
plugin/skills/sonar-predictor/config.env to decide which
sonar-predictor-dist-<version>.zip to fetch from Maven Central on first
invocation. If that pin lags behind the release tag, every installed
plugin pulls the wrong bundle. Two changes here:

1. Bump SONAR_BUNDLE_VERSION 0.1.1 -> 0.1.3 in config.env so the v0.1.3
   release artifact ships the correct pin.

2. Add a publish.yml step that sed-bumps that pin to match the derived
   release version before the build, so future releases never hit this
   trap again — the committed value becomes informational and the CI
   step is the source of truth at deploy time.

Author: aksOps

.github/workflows/publish.yml

@@ -92,6 +92,18 @@ jobs:
             -DnewVersion="${{ steps.version.outputs.version }}" \
             -DgenerateBackupPoms=false
 
+      - name: Sync skill bundle version pin to the release version
+        # The skill launcher reads SONAR_BUNDLE_VERSION from config.env to
+        # decide which sonar-predictor-dist-<version>.zip to fetch from
+        # Maven Central on first invocation. If config.env is stale, an
+        # installed plugin downloads the wrong bundle. Forcing the pin to
+        # match the tag here removes that trap from every future release.
+        run: |
+          set -euo pipefail
+          CONFIG=plugin/skills/sonar-predictor/config.env
+          sed -i "s|^SONAR_BUNDLE_VERSION=.*|SONAR_BUNDLE_VERSION=${{ steps.version.outputs.version }}|" "${CONFIG}"
+          grep '^SONAR_BUNDLE_VERSION' "${CONFIG}"
+
       - name: Build the source bundle (whole-repo git archive of HEAD)
         # Built BEFORE the deploy: the release profile's build-helper plugin
         # attaches this zip (from the repo root) to the Maven Central upload,

plugin/skills/sonar-predictor/config.env

@@ -20,7 +20,7 @@ SONAR_MAVEN_REPO_URL=https://repo1.maven.org/maven2
 
 # Bundle version. Bumped in lockstep with each plugin release. A fork can pin
 # to a vendored / mirrored version without touching the launcher.
-SONAR_BUNDLE_VERSION=0.1.1
+SONAR_BUNDLE_VERSION=0.1.3
 
 # --- Java runtime --------------------------------------------------------------