ci(release): make every version tag-driven and fix the dev channel

.github/release.yml

@@ -0,0 +1,108 @@
+# GitHub's auto-generated release notes — the body of every GitHub Release.
+#
+# GoReleaser hands the body to GitHub (`changelog.use: github-native` in
+# .goreleaser.yaml), and GitHub builds it from the PRs merged since the previous
+# tag. main is squash-merged, so one PR is one line, titled with its
+# Conventional Commit subject. This file is the only knob on that output — the
+# `changelog.filters` in .goreleaser.yaml do not apply.
+#
+# Categories are matched by PR LABEL, top to bottom, first match wins; `*` is a
+# catch-all for whatever the categories ABOVE it did not take. So a category is
+# only as good as its labels: `github_actions` / `documentation` / `go` /
+# `dependencies` are applied automatically by actions/labeler (path-based, see
+# labeler.yml), while `breaking-change`, `security`, `bug`, and `enhancement`
+# are applied by hand during triage — label the PR, or it lands in "Other
+# changes".
+#
+# THE INVARIANT: every category keyed on a label that a DEPENDABOT PR CAN CARRY
+# must have the Dependabot author exclude. Dependabot is separated by author
+# rather than by label, and the final `*` category is what collects it — so any
+# earlier category matching one of those labels intercepts bumps before they
+# get there. Two sources feed that set, and checking only the first is not
+# enough: labeler's path labels (`documentation`, `github_actions`, `go`,
+# `dependencies`, `area/*`) AND the ecosystem labels Dependabot applies itself
+# (`dependencies`, `javascript`, `go`, `github_actions` — `javascript` is not
+# in labeler.yml at all). Two labels are load-bearing today, and both bit:
+#
+#   github_actions  labeler maps .github/workflows/** and .github/actions/**,
+#                   so it marks our own CI PRs, not just Dependabot's action
+#                   bumps (#446 is a hand-written CI PR carrying it). Excluding
+#                   the LABEL from the catch-all filed all our CI work under
+#                   Dependencies; dropping it instead empties that category,
+#                   because Dependabot's action bumps carry `github_actions`
+#                   and NOT `dependencies` (#480, #412, #341).
+#   documentation   labeler maps docs/**, and the npm Dependabot config points
+#                   at the workspace root, so every npm bump touches
+#                   docs/package.json and gets labelled. Count only MERGED PRs
+#                   here — an open or superseded bump never reaches a release
+#                   body, and npm group bumps are routinely superseded before
+#                   merge: 3 of the 23 Dependabot PRs merged to date carry it
+#                   (#439, #416, #342). A bump or two per release rather than a
+#                   flood, but the exclude costs nothing and the ratio grows
+#                   with the npm surface.
+#
+# `security` deliberately has NO author exclude: a Dependabot bump that a
+# maintainer hand-labels `security` is a security fix and belongs at the top,
+# not buried under Dependencies.
+#
+# This routing cannot be linted locally, but it CAN be dry-run against real
+# history — including from a branch, before this file reaches main, because
+# `configuration_file_path` resolves relative to `target_commitish`:
+#   gh api -X POST repos/Wave-RF/WaveHouse/releases/generate-notes \
+#     -f tag_name=vX.Y.Z -f target_commitish=<branch-or-main> \
+#     -f configuration_file_path=.github/release.yml --jq .body
+# Do this after editing the categories below. Last run on this config: all 23
+# merged Dependabot PRs landed in Dependencies, none leaked into CI & build
+# (41) or Documentation (54).
+changelog:
+  exclude:
+    labels:
+      - duplicate
+      - invalid
+      - wontfix
+  categories:
+    # Ordered by what a reader upgrading needs to see first. `!` in the PR title
+    # marks the breaking change per Conventional Commits; the label is what puts
+    # it at the top of the notes.
+    - title: ⚠️ Breaking changes
+      labels: [breaking-change]
+    - title: 🔒 Security
+      labels: [security]
+    - title: ✨ Features
+      labels: [enhancement]
+    - title: 🐛 Bug fixes
+      labels: [bug]
+    # ABOVE Documentation deliberately. First match wins, and our CI PRs carry
+    # BOTH labels — AGENTS.md requires a doc update with every change, so a CI
+    # PR almost always touches docs/** or README.md too. Of the last 12 human
+    # PRs carrying `github_actions`, 10 also carry `documentation` (only #446
+    # and #283 do not), so with Documentation first this category is dead on
+    # arrival and Documentation fills with `ci:` PRs.
+    #
+    # It is a trade, not a free win, and the cost side is real: a docs PR that
+    # also edits a workflow now files here. In that same window #290
+    # (`feat(docs): live-demo hero panel`) and #277 (`feat(docs): prod-faithful
+    # dev loop`) both would, as would #187 and #193 further back. Counting only
+    # PRs that reach these two categories: ~7 genuine CI PRs rescued from
+    # Documentation against ~2-4 docs PRs misfiled as CI. Worth it because the
+    # CI population is the one that grows, but re-check the balance before
+    # copying this decision forward.
+    - title: 🔧 CI & build
+      labels: [github_actions]
+      exclude:
+        authors: [dependabot, "dependabot[bot]"]
+    - title: 📚 Documentation
+      labels: [documentation]
+      exclude:
+        authors: [dependabot, "dependabot[bot]"]
+    - title: 🧹 Other changes
+      labels: ["*"]
+      exclude:
+        authors: [dependabot, "dependabot[bot]"]
+    # Last, so a long Dependabot run never buries the changes people actually
+    # care about. `*` rather than a label list: everything reaching this point
+    # has already been excluded from the categories above by author, so this is
+    # exactly the Dependabot set — and a bump that somehow carried none of the
+    # dependency labels still gets listed instead of dropped.
+    - title: 📦 Dependencies
+      labels: ["*"]

.github/workflows/goreleaser-validate.yml

@@ -37,6 +37,8 @@ jobs:
           # goreleaser uses `git describe` to derive the snapshot
           # version; needs full tag history.
           fetch-depth: 0
+          # Runs on PR-authored code; nothing here needs authenticated git.
+          persist-credentials: false
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:

.github/workflows/publish-dev.yml

@@ -11,9 +11,11 @@ name: Publish dev image
 # Release.
 #
 # Real tagged releases (`v*`) flow through release.yml against the
-# same .goreleaser.yaml without WAVEHOUSE_DEV set, producing
-# `:vX.Y.Z` + `:latest`. Cleanup of old dev-<sha> tags is handled
-# by cleanup-ghcr.yml.
+# same .goreleaser.yaml without WAVEHOUSE_DEV set, producing `:vX.Y.Z`
+# plus a moving channel pointer — `:latest` for a stable tag, but
+# `:alpha`/`:beta`/`:rc`/`:next` for a prerelease, which therefore never
+# touches `:latest`. Cleanup of old dev-<sha> tags is handled by
+# cleanup-ghcr.yml.
 #
 # The TypeScript SDK publishes separately — see publish-npm.yml.
 on:
@@ -46,6 +48,9 @@ jobs:
           # goreleaser reads full git history for changelog + commit
           # info. Matches release.yml.
           fetch-depth: 0
+          # Same reasoning as release.yml: a third-party action and a
+          # cross-compile run here, and nothing needs authenticated git.
+          persist-credentials: false
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with: