fix(release): create the release commit via GitHub's GraphQL API

.github/scripts/create-verified-commit.mjs

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+// Creates a commit via the GitHub GraphQL API (createCommitOnBranch) instead
+// of a local `git commit`. API-created commits are automatically shown as
+// Verified by GitHub with no signing key to manage — required because main's
+// ruleset enforces signed commits. Used by .github/workflows/release-prepare.yml.
+import { readFileSync } from 'node:fs';
+
+const [, , repo, branch, expectedHeadOid, message, ...filePaths] = process.argv;
+if (!repo || !branch || !expectedHeadOid || !message || filePaths.length === 0) {
+  console.error(
+    'Usage: create-verified-commit.mjs <owner/repo> <branch> <expectedHeadOid> <message> <file...>',
+  );
+  process.exit(1);
+}
+
+const token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN;
+if (!token) {
+  console.error('GH_TOKEN or GITHUB_TOKEN must be set.');
+  process.exit(1);
+}
+
+const additions = filePaths.map((path) => ({
+  path,
+  contents: readFileSync(path).toString('base64'),
+}));
+
+const query = `
+  mutation($input: CreateCommitOnBranchInput!) {
+    createCommitOnBranch(input: $input) {
+      commit { oid url }
+    }
+  }
+`;
+
+const variables = {
+  input: {
+    branch: { repositoryNameWithOwner: repo, branchName: branch },
+    message: { headline: message },
+    expectedHeadOid,
+    fileChanges: { additions },
+  },
+};
+
+const response = await fetch('https://api.github.com/graphql', {
+  method: 'POST',
+  headers: {
+    Authorization: `bearer ${token}`,
+    'Content-Type': 'application/json',
+  },
+  body: JSON.stringify({ query, variables }),
+});
+
+const result = await response.json();
+if (!response.ok || result.errors) {
+  console.error('GraphQL createCommitOnBranch failed:', JSON.stringify(result, null, 2));
+  process.exit(1);
+}
+
+const commit = result.data.createCommitOnBranch.commit;
+console.log(`Created verified commit ${commit.oid}: ${commit.url}`);

.github/workflows/release-prepare.yml

@@ -60,6 +60,7 @@ jobs:
           PREV_TAG="$(git describe --tags --abbrev=0 2>/dev/null || true)"
           echo "VERSION=$VERSION" >> "$GITHUB_ENV"
           echo "PREV_TAG=$PREV_TAG" >> "$GITHUB_ENV"
+          echo "BASE_SHA=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
           echo "Preparing v$VERSION (previous tag: ${PREV_TAG:-none})"
 
       - name: Generate changelog section
@@ -82,18 +83,24 @@ jobs:
           sed -i -E "s#(\.github/actions/report@v)[0-9]+\.[0-9]+\.[0-9]+#\1${VERSION}#g" \
             README.md .github/actions/report/README.md
 
-      - name: Commit release changes
+      - name: Create release branch
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh api "repos/${{ github.repository }}/git/refs" \
+            -f ref="refs/heads/release/v$VERSION" \
+            -f sha="$BASE_SHA"
+
+      - name: Commit release changes (verified, via API)
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git checkout -b "release/v$VERSION"
-          git add \
+          node .github/scripts/create-verified-commit.mjs \
+            "${{ github.repository }}" "release/v$VERSION" "$BASE_SHA" "chore(release): v$VERSION" \
             package.json package-lock.json \
             dashboard/package.json dashboard/package-lock.json \
             .github/actions/report/package.json .github/actions/report/package-lock.json \
             CHANGELOG.md README.md .github/actions/report/README.md
-          git commit -m "chore(release): v$VERSION"
-          git push origin "release/v$VERSION"
 
       - name: Open release PR
         env: