feat: trigger release for OIDC, security updates, and CI pipeline fixes

.pi/agent/AGENTS.md

@@ -11,11 +11,26 @@ guidelines:
   - "Hardware Integrity: Any changes to src/core/bridge.swift require a re-compile and re-sign of vault-bridge."
   - "Testing & TDD: Strictly adhere to TDD (Red-Green-Refactor). No production code without a failing test. Maintain >80% coverage across all metrics (Lines, Branches, Functions, Statements)."
   - "Workflow Gate: Run `npx vitest run --coverage` before any hand-off or PR. The test suite is the final authority on code quality."
-  - "Versioning & Commits: Follow Conventional Commits (`feat:`, `fix:`, `chore:`, `ci:`, etc.) strictly. `semantic-release` automates version bumps and NPM publishing."
+  - "Versioning & Commits: YOU MUST follow Angular Conventional Commits EXACTLY. Use lowercase types and a colon (e.g., `feat: `, `fix: `). Never use uppercase/slashes like `Feat/OIDC`. PR titles must use this format so Squash & Merge triggers `semantic-release`."
   - "Biometrics Compilation: The Swift bridge (`vault-bridge`) is automatically compiled on the user's machine during the `vault eb` (`biometrics`) command using local ad-hoc signing. Maintain this auto-compile flow for NPM distribution."
   - "Bridge & Entitlements: `src/core/bridge.swift` and `vault.entitlements` must be included in the `files` array of `package.json` to ensure they are shipped in the NPM package for local compilation."
   - "CI/CD & Publishing: NPM publishing uses OIDC provenance via the `npm-publish` GitHub environment. Main branch is protected; always use Pull Requests."
   - "Native ESM: Always use .js extensions in imports."
 ---
 # Vault Project Guidelines
 This file ensures that any agent or contributor adheres to the cryptographic and architectural standards of the Vault CLI.
+
+## Versioning & Commits (Critical for Releases)
+The release pipeline is fully automated using `semantic-release`, which strictly parses commit headers to determine the next version bump. **If commits do not match the Angular Conventional Commits specification, no release will be generated.**
+
+### Strict Formatting Rules:
+1. **Format:** `<type>(<optional scope>): <description>`
+2. **Lowercase only:** `feat:`, `fix:`, `docs:`, `chore:`. DO NOT use uppercase (`Feat`, `Fix`, `FEAT`).
+3. **Punctuation:** Always use a colon `:` and a single space after the type. DO NOT use slashes (e.g., `feat/` or `Fix/`).
+4. **Pull Requests:** When submitting a PR, the **PR Title** must follow this format (e.g., `feat: implement OIDC authentication`). GitHub's "Squash and Merge" feature uses the PR Title as the final commit header. If the PR Title is `Feat/OIDC`, `semantic-release` will completely ignore the merged PR.
+
+### Triggers:
+* `feat: ...` -> MINOR release (v1.x.0)
+* `fix: ...` -> PATCH release (v1.0.x)
+* `perf: ...` -> PATCH release (v1.0.x)
+* Commits starting with `chore:`, `docs:`, `test:`, or `refactor:` will NOT trigger a release on their own.

.releaserc.json

@@ -3,7 +3,24 @@
   "plugins": [
     "@semantic-release/commit-analyzer",
     "@semantic-release/release-notes-generator",
-    "@semantic-release/npm",
-    "@semantic-release/github"
+    [
+      "@semantic-release/npm",
+      {
+        "tarballDir": "release"
+      }
+    ],
+    [
+      "@semantic-release/git",
+      {
+        "assets": ["package.json", "package-lock.json"],
+        "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
+      }
+    ],
+    [
+      "@semantic-release/github",
+      {
+        "assets": "release/*.tgz"
+      }
+    ]
   ]
 }

package.json

@@ -9,11 +9,14 @@
   "files": [
     "dist",
     "src/core/bridge.swift",
+    "scripts/setup.sh",
     "vault.entitlements"
   ],
   "scripts": {
     "test": "vitest run",
     "build": "tsc",
+    "prepare": "npm run build",
+    "postinstall": "node -e \"if (process.platform === 'darwin') console.log('\\x1b[35m◈ Run \\'npm run setup\\' to enable biometric authentication for Vault CLI\\x1b[0m')\"",
     "setup": "bash scripts/setup.sh"
   },
   "repository": {
@@ -23,6 +26,9 @@
   "keywords": [],
   "author": "Lutfi Garzon",
   "license": "Apache-2.0",
+  "publishConfig": {
+    "access": "public"
+  },
   "type": "module",
   "bugs": {
     "url": "https://github.com/LutfiGarzon/vault/issues"
@@ -38,6 +44,7 @@
     "libsodium-wrappers-sumo": "^0.8.3"
   },
   "devDependencies": {
+    "@semantic-release/git": "^10.0.1",
     "@types/libsodium-wrappers": "npm:@types/libsodium-wrappers-sumo@^0.7.8",
     "@types/node": "^25.6.0",
     "@vitest/coverage-v8": "^4.1.4",