chore: migrate release process from semantic-release to release-please (#255)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: chrisleekr

.github/workflows/ci.yml

@@ -2,9 +2,11 @@
 #
 # Triggers:
 #   - pull_request: fast feedback on every PR
-#   - push to main: post-merge sanity (catches squash-regressions; release is manual)
-#   - workflow_call: invoked by dev-release.yml and release.yml so an image
-#     is never published without these checks passing.
+#   - push to main: post-merge sanity (catches squash-regressions). Releases
+#     are cut by merging the release-please Release PR, which these same PR
+#     checks gate.
+#   - workflow_call: retained for reuse; release-please.yml relies on the PR
+#     checks above rather than calling this workflow.
 name: CI
 
 on:
@@ -64,9 +66,8 @@ jobs:
       - name: Checkout source code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
-          # Full history kept for parity with dev-release/release workflows
-          # and to give semantic-release accurate diff context when this
-          # workflow is invoked via workflow_call. Secret scanning lives
+          # Full history kept so release-please can walk tags/commits for
+          # accurate version + changelog inference. Secret scanning lives
           # in .github/workflows/secrets-scan.yml now.
           fetch-depth: 0
 

.github/workflows/dev-release.yml

@@ -1,5 +1,5 @@
 # Reusable image builder. No checks, no release: orchestrators invoke this
-# via workflow_call after gating on ci.yml + semantic-release.
+# via workflow_call after release-please cuts a tag (release-please.yml).
 #
 # Ships TWO images per release:
 #   - chrisleekr/github-app:<tag>-orchestrator  (lean, webhook server)
@@ -39,6 +39,15 @@ on:
         required: false
         type: boolean
         default: false
+    secrets:
+      # Only the Docker Hub push credentials are needed. Declared explicitly so
+      # callers pass least-privilege secrets instead of `secrets: inherit`
+      # (which would forward the RELEASE_TOKEN PAT and every other repo secret
+      # into this build graph). GITHUB_TOKEN is provided implicitly.
+      DOCKER_USERNAME:
+        required: true
+      DOCKER_PASSWORD:
+        required: true
   workflow_dispatch:
     inputs:
       tag-name:
@@ -111,11 +120,13 @@ jobs:
         env:
           TAG_NAME: ${{ inputs.tag-name }}
         run: |
-          # Prod release: v1.2.3
-          # Dev pre-release: v1.2.3-<sanitized-branch>.N: branch name is
-          # alphanumerics+hyphens (release.config.mjs strips slashes), and N
-          # is the prerelease counter semantic-release auto-increments.
-          if ! [[ "$TAG_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z][a-zA-Z0-9-]*\.[0-9]+)?$ ]]; then
+          # Stable release: v1.2.3
+          # Beta prerelease from release-please: the prerelease strategy sets
+          # the suffix to the prerelease type (v1.2.3-beta) and appends/bumps a
+          # zero-padded counter only once one exists (v1.2.3-beta01). Matched
+          # permissively: a hyphen, a leading letter, then alphanumerics / dots
+          # / hyphens.
+          if ! [[ "$TAG_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z][a-zA-Z0-9.-]*)?$ ]]; then
             echo "ERROR: tag-name input does not match the expected format." >&2
             exit 1
           fi

.github/workflows/docker-build.yml

@@ -0,0 +1,79 @@
+# Release pipeline (replaces the retired semantic-release release.yml + dev-release.yml).
+#
+# Model: release-please maintains a Release PR per branch. Merging that PR is the
+# release gate.
+#   - main : stable channel. Merging the Release PR cuts v<x.y.z>, updates
+#            CHANGELOG.md + package.json, creates a GitHub release, then builds
+#            and pushes the prod image (with :latest).
+#   - beta : prerelease channel. Merging the Release PR cuts v<x.y.z>-beta.<n>
+#            (prerelease config) and builds a beta image (no :latest).
+#
+# Branch selection: one workflow file lives on both branches. target-branch is
+# the pushed ref; config-file / manifest-file switch to the .beta variants on
+# the beta branch so main and beta never share release-please state.
+#
+# CI is NOT called here: it runs on the Release PR (branch protection is the
+# merge gate). docker-build runs post-merge, gated on release_created.
+name: Release Please
+
+on:
+  push:
+    branches:
+      - main
+      - beta
+
+# RELEASE_TOKEN (a PAT) is required, not the default GITHUB_TOKEN: releases and
+# PRs opened by GITHUB_TOKEN do not trigger downstream workflows, so CI would
+# never run on the Release PR.
+concurrency:
+  group: release-please-${{ github.ref_name }}
+  cancel-in-progress: false
+
+# No workflow-level grant: each job requests only what it needs (least
+# privilege). The docker job in particular must NOT inherit the release-please
+# job's write scopes.
+permissions: {}
+
+jobs:
+  release-please:
+    name: Release Please (${{ github.ref_name }})
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      contents: write # release commit, tag, GitHub release
+      pull-requests: write # maintain the Release PR
+      issues: write # release-please label management
+    outputs:
+      release_created: ${{ steps.rp.outputs.release_created }}
+      tag_name: ${{ steps.rp.outputs.tag_name }}
+    steps:
+      - name: Run release-please
+        id: rp
+        uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
+        with:
+          token: ${{ secrets.RELEASE_TOKEN }}
+          target-branch: ${{ github.ref_name }}
+          config-file: ${{ github.ref_name == 'beta' && 'release-please-config.beta.json' || 'release-please-config.json' }}
+          manifest-file: ${{ github.ref_name == 'beta' && '.release-please-manifest.beta.json' || '.release-please-manifest.json' }}
+
+  docker:
+    name: Docker
+    needs: release-please
+    if: needs.release-please.outputs.release_created == 'true'
+    # Ceiling for the reusable docker-build.yml: it needs security-events:write
+    # (Trivy SARIF upload) and id-token:write (Sigstore/attestations). Matches
+    # the grant the retired release.yml gave this path; the release-please job's
+    # PR/issues write scopes are deliberately NOT granted here.
+    permissions:
+      contents: read
+      security-events: write
+      id-token: write
+    uses: ./.github/workflows/docker-build.yml
+    with:
+      tag-name: ${{ needs.release-please.outputs.tag_name }}
+      is-dev-release: ${{ github.ref_name == 'beta' }}
+    # Pass only the Docker Hub credentials, not `secrets: inherit`, so the
+    # RELEASE_TOKEN PAT is not forwarded into the image build graph.
+    secrets:
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}