release

# Release `.github/workflows/release.yml` owns version allocation and artifact mutation. The workflow validates every push to `main` or `master` first, then reserves the `v<version>` tag for the version root `package.json` names, publishes GHCR and the CLI (or confirms the CLI version already exists), and finally publishes the GitHub Release. Do not pre-create a release tag, draft, or `release/<version>` branch. Root `package.json` holds the version. No other file records it. A release is a deliberate bump: an unchanged version gives a clean, green no-op run. ## 1. Resolve the canonical destination ```bash if git remote get-url upstream >/dev/null 2>&1; then REMOTE=upstream else REMOTE=origin fi REPO=$(gh repo view "$(git remote get-url "$REMOTE")" --json nameWithOwner -q .nameWithOwner) if git ls-remote --exit-code --heads "$REMOTE" main >/dev/null 2>&1; then TARGET=main elif git ls-remote --exit-code --heads "$REMOTE" master >/dev/null 2>&1; then TARGET=master else echo "No main or master release branch exists on $REMOTE" >&2 exit 1 fi SOURCE=$(git branch --show-current) printf 'Repo: %s · source: %s · release branch: %s\n' "$REPO" "$SOURCE" "$TARGET" ``` ## 2. Pre-flight Require all of the following before a release push: - The working tree is clean. - The source commit is pushed to the canonical remote. - CI for the source commit is green. - Root `package.json` names the version to publish, and no `v<version>` tag exists yet. An unbumped push is a gr...