From 4feb4f24b4eed6239efa4eede1e0d2096de46af4 Mon Sep 17 00:00:00 2001
From: priosshrsth <shrsthprios@hotmail.com>
Date: Tue, 18 Aug 2026 12:27:23 +0000
Subject: [PATCH] ci: stop committing the version bump back to main
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The release job pushed a bump commit to main, which the branch rulesets
rejected: PR required, verified signatures required, and code scanning
pending. A runner's `git commit` is unsigned regardless of GITHUB_TOKEN
— GitHub only signs commits made through its API or web UI — and there
are no bypass actors on either ruleset, so the push could not succeed.

The version is now applied to package.json and src/version.ts in the
runner only, so the published artifact carries the released version while
the repository stays untouched. Job permissions drop to contents: read.
---
 .claude/CLAUDE.md             | 14 +++++++++++++-
 .github/workflows/release.yml | 18 ++++--------------
 2 files changed, 17 insertions(+), 15 deletions(-)

diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index 9536b55..f0a2614 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -13,13 +13,25 @@ pnpm run build         # Build all entry points to dist/ via vp pack
 pnpm run dev           # Build in watch mode
 pnpm test              # Run tests via vp test
 pnpm run check         # Lint + format + type check via vp check
-pnpm run release       # Bump version, commit, push, tag via bumpp
 ```
 
 Pre-commit hook runs `vp check --fix` on staged files.
 
 After any significant code change, always run `vp check --fix` to ensure lint, formatting, and type checking pass before committing.
 
+## Releasing
+
+Publish a GitHub Release with a `vSEMVER` tag (`v0.0.6`, `v10.1.11`). That triggers
+`.github/workflows/release.yml`, which takes the version from the tag, writes it into
+`package.json` and `src/version.ts` **in the runner only**, builds, and publishes to npm
+via OIDC trusted publishing.
+
+Nothing is committed back — main is protected by rulesets (PR required, signed commits,
+code scanning) with no bypass actors, so the release tag is the version of record. The
+`version` in `package.json` on main is a placeholder and will lag behind npm; keep it in
+step with `src/version.ts` (pinned by `tests/version.test.ts`) and bump both in a normal
+PR whenever you want them to reflect reality.
+
 ## Documentation Rules
 
 After any significant code change, update the following:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3edacb8..fff13ad 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,7 +5,7 @@ on:
     types: [published]
 
 permissions:
-  contents: write
+  contents: read
   id-token: write
 
 jobs:
@@ -54,22 +54,12 @@ jobs:
       - name: Run tests
         run: bun run test
 
-      - name: Bump to the released version
-        env:
-          TAG: ${{ github.event.release.tag_name }}
+      # Runner-local only. main is protected by rulesets with no bypass actors,
+      # so nothing is committed back — the release tag is the version of record.
+      - name: Set version from release tag
         run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           npm version "$VERSION" --no-git-tag-version --allow-same-version
           printf '/** SDK version string sent with every API request. */\nexport const SDK_VERSION: string = "%s";\n' "$VERSION" > src/version.ts
-          if git diff --quiet; then
-            echo "Already at $VERSION"
-          else
-            git commit -am "chore: release v$VERSION"
-            git push origin HEAD:main
-          fi
-          git tag -f "$TAG"
-          git push -f origin "refs/tags/$TAG"
 
       - name: Build
         run: bun run build