ci: add release-please for automated releases

[nicknisi]

Summary

• Add release-please workflow to automate versioning, changelog generation, and npm publishing on merge to main
• Add release-please-config.json and .release-please-manifest.json (seeded at v0.5.0)
• Update release.yml to use workflow_call trigger (invoked by release-please) instead of release: [published]
• Mirrors the release-please setup in authkit-nextjs

How it works

1. Conventional commits pushed to main trigger release-please
2. Release-please creates/updates a release PR with version bump + CHANGELOG
3. Merging the release PR creates a GitHub release + tag
4. The publish job triggers release.yml to build and publish to npm via OIDC trusted publishing

Prerequisites

• SDK_BOT_APP_ID (var) and SDK_BOT_PRIVATE_KEY (secret) configured on the repo
• npm package configured for OIDC trusted publishing from this repo

[greptile-apps]

Greptile Summary

This PR introduces release-please automation to handle versioning, changelog generation, and npm publishing on merge to main, mirroring the setup in authkit-nextjs. The release.yml is refactored from a release: [published] trigger to workflow_call, removing pre-release (--tag next) support in favour of a single always-latest publish step.

Confidence Score: 5/5

Safe to merge — only P2 style findings remain, no correctness or security blockers.

All findings are P2: a leftover job ID (test) and unpinned third-party action tags. Neither blocks correct behaviour. The OIDC permission setup is valid for the workflow_call pattern and the config files are well-formed.

.github/workflows/release-please.yml — action SHA pinning; .github/workflows/release.yml — job ID rename

Vulnerabilities

• actions/create-github-app-token@v2 and googleapis/release-please-action@v4 are pinned to mutable version tags rather than commit SHAs. Both actions receive SDK_BOT_PRIVATE_KEY and the OIDC token respectively, making SHA pinning important for supply-chain integrity.
• No hardcoded secrets, wildcard CORS, or other policy violations found.

Important Files Changed

Filename	Overview
.github/workflows/release-please.yml	New workflow orchestrating release-please and npm publish; actions not pinned to SHA (supply-chain risk)
.github/workflows/release.yml	Updated to workflow_call trigger; job ID is still test instead of publish, pre-release distinction removed (intentional)
release-please-config.json	Standard release-please config for a Node package at the repo root; no issues
.release-please-manifest.json	Seeds the initial version at 0.5.0 for release-please tracking; no issues

Sequence Diagram

sequenceDiagram
    participant Dev as Developer
    participant GH as GitHub (main)
    participant RP as release-please-action
    participant Bot as SDK Bot App
    participant NPM as npm Registry

    Dev->>GH: Push conventional commit to main
    GH->>Bot: Generate GitHub App token
    Bot-->>GH: App token
    GH->>RP: Run release-please-action
    RP-->>GH: Create/update Release PR (version bump + CHANGELOG)
    Dev->>GH: Merge Release PR
    GH->>RP: release_created = true
    GH->>GH: Trigger release.yml (workflow_call)
    GH->>NPM: pnpm publish --tag latest --provenance

Loading

_{Reviews (2): Last reviewed commit: "Update .github/workflows/release-please...." | Re-trigger Greptile}

[greptile-apps]

No secrets: inherit for reusable workflow call

When release.yml is invoked via workflow_call, secrets from the caller are not automatically forwarded unless secrets: inherit is specified. If release.yml ever needs a secret (e.g. a fallback NODE_AUTH_TOKEN), it would silently receive an empty value. Since the current setup relies purely on OIDC this is likely fine, but adding secrets: inherit here is a low-cost safety net.

Suggested change

	uses: ./.github/workflows/release.yml
	uses: ./.github/workflows/release.yml
	secrets: inherit

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[gjtorikian]

I think it's fine; we're not using secrets here/anymore.

[gjtorikian]

I think it's fine; we're not using secrets here/anymore.

[greptile-apps]

Tip:

Greploop — Automatically fix all review issues by running /greploops in Claude Code. It iterates: fix, push, re-review, repeat until 5/5 confidence.

Use the Greptile plugin for Claude Code to query reviews, search comments, and manage custom context directly from your terminal.