fix(release): pin skills version in Makefile for traceability

[jrusz]

Summary

• Pin CS_REF to a specific skills tag (v0.6.2) in the Makefile instead of defaulting to main
• Add Renovate custom manager to auto-bump the skills version on new releases
• Remove skills_ref workflow input from the release workflow — builds use Makefile defaults

Problem

Three issues with the current release workflow (reported by @ppitonak):

1. Same commit: v0.7.1, v0.7.2, v0.7.3 all tag commit f7420fc — multiple releases are indistinguishable in git history
2. Invisible skills_ref: skills_ref is a workflow input never recorded in git — you must inspect the container image to find which skills version a release uses
3. Broken changelog: --generate-notes always diffs against v0.6.1 because all v0.7.x tags target the same commit

Solution

Make the skills version a tracked dependency — pin it in the Makefile, let Renovate bump it. Each Renovate PR creates a new commit, so releases naturally get distinct SHAs and meaningful changelogs.

The ?= pattern preserves local override for development: CS_REF_TYPE=branch CS_REF=main make oci-build.

Test plan

• YAML and JSON syntax validation
• git ls-remote resolves pinned tag to correct SHA
• CI builds PR image using pinned skills version
• After merge: trigger a test release (e.g. v0.8.0-rc1) with only the version input

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated build configuration defaults for dependencies.
  • Enhanced workflow automation for dependency version updates.

[coderabbitai]

Warning

Review limit reached

@jrusz, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 50 minutes and 58 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 678f2afd-c34f-4040-a04d-852f2e6e6c4c

📥 Commits

Reviewing files that changed from the base of the PR and between 9bbf6da and 2a743ad.

📒 Files selected for processing (3)

• .github/workflows/release.yml
• Makefile
• renovate.json

📝 Walkthrough

Walkthrough

This PR restructures Claudio Skills version management by removing input validation from the release workflow, shifting to tag-based version defaults in the Makefile, and adding Renovate automation to keep the version current.

Changes

Claudio Skills Version Management

Layer / File(s)	Summary
Release workflow validation restructure .github/workflows/release.yml	The Validate inputs step now validates only inputs.version format against the vMAJOR.MINOR.PATCH(-suffix)? pattern; skills_ref validation is removed entirely. Build environment variables continue unchanged.
Claudio Skills version defaults and Renovate automation Makefile, renovate.json	Makefile defaults shift from CS_REF_TYPE ?= branch and CS_REF ?= main to CS_REF_TYPE ?= tag and CS_REF ?= v0.6.2. A new Renovate customManagers rule detects CS_REF ?= vX.Y.Z patterns in the Makefile and automatically updates them from aipcc-cicd/claudio-skills GitHub releases.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• aipcc-cicd/claudio#151: Overlaps on release automation work, both PRs modify .github/workflows/release.yml input handling around skills_ref and update Makefile/renovate.json Claudio Skills defaults.
• aipcc-cicd/claudio#146: Both PRs update Renovate configuration to target the Makefile's CS_REF ?= vX.Y.Z pattern.
• aipcc-cicd/claudio#134: Both PRs shift Makefile defaults for Claudio Skills references from branch-based to tag-based values.

Suggested reviewers

• gnaponie
• ppitonak
• ktdreyer

Poem

🐰 A workflow once fretted about every skill,
But now trusts the defaults to bend to its will,
Renovate watches with eyes sharp and keen,
Auto-bumping the tags to the latest scene! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix(release): pin skills version in Makefile for traceability' accurately summarizes the primary change: pinning the Claudio Skills reference to a specific tag version (v0.6.2) instead of the 'main' branch in the Makefile, which directly supports the goal of release traceability.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch worktree-impl-claudio-release-traceability

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Makefile`:
- Around line 31-33: Update the comment above the CS_REF_TYPE and CS_REF
defaults to make it explicit that the Makefile defaults track the stable tag
(CS_REF_TYPE ?= tag and CS_REF ?= v0.6.2) and that developers should explicitly
override to build from the branch by passing CS_REF_TYPE=branch CS_REF=main;
reference the variables CS_REF_TYPE and CS_REF in the comment so it reads like:
"Default: build from stable tag (CS_REF_TYPE=tag, CS_REF=v0.6.2). To build from
the latest branch, override with CS_REF_TYPE=branch CS_REF=main."

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6c07c131-be75-4fc2-b34d-4d19d8889cec

📥 Commits

Reviewing files that changed from the base of the PR and between ab244b5 and 9bbf6da.

📒 Files selected for processing (3)

• .github/workflows/release.yml
• Makefile
• renovate.json

💤 Files with no reviewable changes (1)

• .github/workflows/release.yml