[ci-gap][release] Fix autorelease (version-vs-tag guard) + PR-title conventional-commit lint

[claude]

Current score → target

Docs & release hygiene: coverage 4/5, enforcement 4/5 → 5/5.

Defect class prevented

Release pipeline rot: no releases, stale changelog, version drift between composer.json and git tags.

Evidence — the single most broken thing in this CI

• autorelease.yml ("Generate Changelog and Create Release"): 30 of 30 most recent runs failed (2026-05-09 → 2026-06-14; 67 runs total). Zero releases are being produced from main.
• Root cause per PR fix(ci): repair core service workflows #217: expression bug + attempting to re-create the existing tag v0.10.0 (composer.json version out of sync with tags). fix(ci): repair core service workflows #217's fix did not cure it — failures continue after 2026-06-07.
• Versioning depends on conventional commits, but nothing in CI enforces them (ramsey/conventional-commits sits unused in require-dev; no hooks exist — root package.json is {}).

Proposed fix

1. Repair the release job: derive the next version from tags (or assert composer.json version > latest v* tag as a pre-flight, failing with a clear message).
2. Add that version-vs-tag consistency assert as a PR check on release-relevant files (composer.json, autorelease.yml) — the regression guard.
3. PR-title-only conventional lint (amannn/action-semantic-pull-request@<sha> or equivalent): titles feed squash merges and the changelog. Commit-level linting is deliberately excluded — it false-positives on merge commits and this repo's own bot commits.

Effort

M

Acceptance criteria

• Next push to main produces a green autorelease run and an actual GitHub release
• Version-vs-tag pre-flight exists and blocks; PR-title lint blocks non-conventional titles
• Proven: a test PR titled "wip lol" fails the title lint; a seeded composer.json version equal to an existing tag fails the pre-flight

Cross-references: #290, #328, #304, #243.

---

Filed by an automated CI/CD verification-coverage audit (OpenSSF Scorecard baseline: aggregate 6.0/10, local mode — SAST 0, Fuzzing 0, Token-Permissions 0, Pinned-Dependencies 5, Vulnerabilities 4). Audit method: inventory → gap analysis → git-history evidence mining → 3-iteration adversarial critique loop.

---

Generated by Claude Code

[coderabbitai]

🔗 Related PRs

#108 - ci: parallelize K6 smoke load tests [merged]
#133 - chore(deps-dev): bump the all-deps group across 1 directory with 9 updates [merged]
#136 - feat(deps): bump the all-deps group across 1 directory with 14 updates [merged]
#190 - ci: run configuration validation in make ci [merged]
#217 - fix(ci): repair core service workflows [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!