ci: migrate from semantic-release to release-please

.github/workflows/pr-title.yml

@@ -0,0 +1,38 @@
+name: PR Title
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  pull-requests: read
+
+jobs:
+  lint:
+    name: Validate PR title
+    runs-on: ubuntu-latest
+    steps:
+      # Ensures the PR title is a valid Conventional Commit, since squash-merging
+      # uses it as the commit message that release-please parses.
+      - uses: amannn/action-semantic-pull-request@v5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          types: |
+            feat
+            fix
+            perf
+            refactor
+            docs
+            style
+            test
+            build
+            ci
+            chore
+            revert
+          scopes: |
+            cli
+            aws
+            ci
+            deps
+          requireScope: false

.github/workflows/release.yml

@@ -1,47 +1,50 @@
 name: Release
 
 on:
-  workflow_run:
-    workflows: [CI]
-    types: [completed]
+  push:
     branches: [main]
 
 permissions:
   contents: write
-  issues: write
   pull-requests: write
 
 jobs:
-  release:
-    name: Semantic Release
+  release-please:
+    name: Release Please
     runs-on: ubuntu-latest
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
-
     steps:
+      - name: Run release-please
+        id: release
+        uses: googleapis/release-please-action@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      # The steps below run only when a Release PR was just merged.
       - name: Checkout
+        if: ${{ steps.release.outputs.release_created }}
         uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          persist-credentials: false
 
       - name: Setup Node
+        if: ${{ steps.release.outputs.release_created }}
         uses: actions/setup-node@v4
         with:
           node-version: 22
+          registry-url: "https://registry.npmjs.org"
 
       - name: Setup Bun
+        if: ${{ steps.release.outputs.release_created }}
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.3.14
 
       - name: Install dependencies
+        if: ${{ steps.release.outputs.release_created }}
         run: bun install
         env:
           HUSKY: "0"
 
-      - name: Run semantic-release
-        run: npx semantic-release
+      - name: Publish to npm
+        if: ${{ steps.release.outputs.release_created }}
+        run: npm publish
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          HUSKY: "0"
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.3.0"
+}

CLAUDE.md

@@ -24,7 +24,7 @@ ssomatic/
 ├── dist/                      # Build output
 │   └── cli.js                 # Node CLI bundle (npm bin)
 ├── docs/screenshots/          # Demo GIFs for README
-├── .releaserc.json            # semantic-release config
+├── release-please-config.json # release-please config
 ├── package.json
 └── tsconfig.json              # TypeScript config
 ```
@@ -38,7 +38,7 @@ ssomatic/
 | React | Component framework |
 | Ink | React renderer for CLI |
 | ESLint | Linting (flat config) |
-| semantic-release | Automated versioning & releases |
+| release-please | Automated versioning & releases |
 
 ## Commands
 
@@ -65,14 +65,17 @@ bun test              # Run unit tests
 ```bash
 feat(cli): add profile filtering      # New feature → minor bump
 fix(aws): handle empty clipboard       # Bug fix → patch bump
+feat!: drop legacy config format       # Breaking change → major bump
 docs: update README                    # No release
 build(deps): upgrade aws-sdk           # No release
 ```
 
-**Allowed scopes:** `cli`, `aws`, `deps`, `ci`
+**Allowed scopes:** `cli`, `aws`, `deps`, `ci`. PR titles are linted too (PRs are squash-merged, so the title becomes the release-driving commit).
 
 ### Releases
 
-Fully automated via **semantic-release**. Push to `main` with conventional commits → CI passes → version bumped, CHANGELOG.md updated, GitHub release created, and the package published to npm. No manual steps.
+Automated via **release-please**. Conventional commits on `main` → release-please maintains a **Release PR** (version bump in `package.json` + `CHANGELOG.md` + pending notes). Merging that Release PR tags the release, creates the GitHub release, and publishes to **npm**.
 
-**Requires:** `RELEASE_TOKEN` secret in GitHub repo settings (PAT with `contents: write` scope) and an `NPM_TOKEN` secret (npm automation token with publish scope).
+- Config: `release-please-config.json` (release-type `node`); current version tracked in `.release-please-manifest.json`.
+- **Requires:** `NPM_TOKEN` secret (npm automation token with publish scope). Uses the built-in `GITHUB_TOKEN` otherwise — no PAT.
+- Repo setting: **Allow GitHub Actions to create and approve pull requests** must be enabled (Settings → Actions → General).

CONTRIBUTING.md

@@ -51,11 +51,13 @@ type(scope): description
 
 **Scopes:** `cli`, `aws`, `deps`, `ci`
 
-Commits are validated by [commitlint](https://commitlint.js.org/) via a Git hook.
+A breaking change is marked with `!` after the type/scope (e.g. `feat!:`) or a `BREAKING CHANGE:` footer — this bumps the major version.
+
+Commits are validated by [commitlint](https://commitlint.js.org/) via a Git hook. Pull request titles are also validated, because **PRs are squash-merged** and the PR title becomes the commit message that drives the release. Keep your PR title a valid Conventional Commit.
 
 ## Releases
 
-Releases are fully automated via [semantic-release](https://semantic-release.gitbook.io/). When commits land on `main`, the CI pipeline determines the version bump from commit types (`feat` → minor, `fix` → patch), creates a GitHub release, and publishes the package to npm. No manual steps needed.
+Releases are automated via [release-please](https://github.com/googleapis/release-please). When conventional commits land on `main`, release-please opens (and keeps updating) a **Release PR** that bumps the version in `package.json`, updates `CHANGELOG.md`, and shows the pending release notes. Merging that Release PR tags the release, creates the GitHub release, and publishes the package to **npm**. No manual version edits needed.
 
 ## Pull Request Process
 

README.md

@@ -3,7 +3,6 @@
 Interactive AWS SSO credential manager for your terminal.
 
 [![npm version](https://img.shields.io/npm/v/ssomatic)](https://www.npmjs.com/package/ssomatic)
-[![npm downloads](https://img.shields.io/npm/dm/ssomatic)](https://www.npmjs.com/package/ssomatic)
 [![CI](https://github.com/tux86/ssomatic/actions/workflows/ci.yml/badge.svg)](https://github.com/tux86/ssomatic/actions/workflows/ci.yml)
 [![Release](https://github.com/tux86/ssomatic/actions/workflows/release.yml/badge.svg)](https://github.com/tux86/ssomatic/actions/workflows/release.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
@@ -107,7 +106,7 @@ ssomatic/
 - [Code of Conduct](CODE_OF_CONDUCT.md)
 - [Security Policy](SECURITY.md)
 
-Uses [Conventional Commits](https://www.conventionalcommits.org/) and [semantic-release](https://semantic-release.gitbook.io/).
+Uses [Conventional Commits](https://www.conventionalcommits.org/) and [release-please](https://github.com/googleapis/release-please).
 
 ## License