ci: cut a stable release every month on a schedule

[mikey923]

Draft for now, want to check this is wanted before I polish it.

Why

latest on npm is 5.6.0 from 2026-04-06. Master is 159 commits ahead of that tag, 153 of them Dependabot bumps that already passed the pipeline and got auto-merged. None of it is on latest.

Over the last year the longest latest sat without an update was 139 days. Prereleases keep moving on next, so the gap is only in promoting something to stable.

What this does

Adds a schedule trigger to Create bump version PR, plus a step that works out what a scheduled run should cut.

Manual dispatch is unchanged. If version is set, the step passes it and preid through untouched, so the prerelease flow works exactly as before.

A scheduled run has no inputs. It looks at what landed since the last stable tag and cuts a stable version: minor if there is a feat: commit or a major dependency bump, patch otherwise. If nothing new landed it does nothing.

When it holds off

If the newest tag is a prerelease less than 7 days old, the run stops. Cutting a prerelease means "not stable yet" and I did not want a cron job overruling that a day later.

Major dependency bumps get the same 7 day wait, and never go out as a patch. 5.0.0 came out of a Maplibre-Native update, so that is the path breaking changes actually take here.

There is also a check for !: subjects and BREAKING CHANGE footers. Neither appears anywhere in this repo's history, so realistically it will never fire. I left it in as insurance if commitlint ever gets enforced.

Publishing is untouched. The scheduled run just opens the pull request someone would have opened by hand, and Build, Test, Release still runs the full amd64 and arm64 matrix on master before anything ships.

Backtest

I replayed the logic against real history at the last 12 month boundaries. It fires on 7 of them, and the worst latest gap drops from 139 days to 63.

All 5 skips are months where a prerelease had been cut 0 to 4 days earlier. You shipped stable within days in January and April anyway, so those were months worth staying out of.

First run

Newest thing needing a wait since v5.6.0 is the commander 14 to 15 bump from 2026-06-09, so the window has long passed. It is a major dependency bump, so minor. npm version minor on a 5.7.0 prerelease drops the prerelease instead of incrementing, giving 5.7.0, which is what is already staged as 5.7.0-pre.0.

Known limitation

Most non-Dependabot commits here do not use conventional prefixes, so something like Add POST requests for static maps gets sized as a patch. It under-sizes rather than over-sizes, and you can see the version on the release PR before merging. Fixing it properly means enforcing commitlint in CI, which is configured but not wired up.

A better version I did not build

Skipping a whole month is a crude answer to "something recent is in here". What you would really want is a train that always fires but cuts at the last commit that has settled, leaving newer work for next month.

Against the same 12 months that fires every time, ships everything in 7 of them, and holds back 25 commits in the worst case.

I did not do it because it needs releases published from a branch or tag, and release.yml publishes master HEAD. A release branch cut at an older commit still drags the newer commits in when it merges, so the freeze does not survive. Doing it properly means moving the publish trigger, making the changelog script range aware, and living with tags that are not on master.

That is a lot of surgery on the part of your setup that matters most, and it felt like too much for a first PR from someone you do not know. Glad to write it if you want it.

Changelog

A Dependabot-only month ends up with a nearly empty changelog section, since the existing script skips Dependabot PRs when collecting entries. Left alone because it is existing behaviour and I do not know what you would want it to say. Easy to add a line about dependency updates if that helps.

Questions

Is 7 days the right wait, and is 04:00 UTC on the 1st a sensible slot?

Want the scheduled PR labelled, or auto-merged once the pipeline goes green? I left it as a normal PR so you still make the call.