Add semi-automated release flow, scope docker latest tag to releases

[panteLx]

Summary

• npm run release <patch|minor|major> bumps package.json/package-lock.json, commits, tags, pushes, and publishes a GitHub release with auto-generated notes (scripts/release.mjs)
• Container workflow now only applies the latest Docker tag on release tag pushes (v*.*.*); pushes to main only produce the main image tag
• README documents the new release command and updated tagging behavior

Test plan

• Verified npm version <bump> bumps both package.json and package-lock.json, commits, and tags in a scratch repo
• Validated container.yml YAML syntax
• Run npm run release patch on a real release to confirm end-to-end (tag push → latest/vX.Y.Z image; plain main push → only main image, no latest)

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Added a release command that validates repository status, updates the package version, creates a tag, publishes changes, and creates a GitHub release with generated notes.
  • Added release documentation covering patch, minor, and major releases, Docker image publishing, and required setup.
  • Docker images now receive the latest tag only for tagged releases.

[coderabbitai]

Warning

Review limit reached

@panteLx, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 50 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: aa18c84e-49ff-4361-8108-40308bdfe256

📥 Commits

Reviewing files that changed from the base of the PR and between b8a760b and 9f6f2a9.

📒 Files selected for processing (4)

• .github/FUNDING.yml
• .github/ISSUE_TEMPLATE/bug_report.yml
• .github/ISSUE_TEMPLATE/config.yml
• .github/ISSUE_TEMPLATE/feature_request.yml

📝 Walkthrough

Walkthrough

The PR adds a validated npm run release command, documents release steps, creates GitHub releases, and changes Docker tagging so latest is added only for tag refs.

Changes

Release automation

Layer / File(s)	Summary
Release command and prerequisite validation package.json, scripts/release.mjs	The new npm script invokes the release command. The script validates the bump type, main branch, clean working tree, GitHub CLI authentication, and branch synchronization.
Version publication and release documentation scripts/release.mjs, README.md, .github/workflows/container.yml	The command bumps and tags the package, pushes Git references, creates a GitHub release, and reports workflow URLs. The README documents release commands and prerequisites. Docker metadata adds latest only for tag refs.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Developer
  participant release.mjs
  participant Git
  participant GitHubCLI
  participant ContainerWorkflow
  Developer->>release.mjs: Run release command with bump type
  release.mjs->>Git: Validate repository state
  release.mjs->>GitHubCLI: Validate authentication
  release.mjs->>Git: Bump version, tag, and push refs
  release.mjs->>GitHubCLI: Create GitHub release
  GitHubCLI->>ContainerWorkflow: Trigger tag workflow
  ContainerWorkflow->>ContainerWorkflow: Add latest tag

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes both main changes: the semi-automated release flow and release-only Docker latest tagging.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release-automation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/release.mjs`:
- Around line 61-69: Update the release flow around the version bump, branch/tag
pushes, and gh release create so reruns can resume an incomplete publication
instead of invoking npm version again. Add a dedicated resume path that detects
and reuses an existing release tag, and make the branch and tag publication
atomic where supported; when release creation fails, print an exact command that
invokes this resume path.
- Around line 19-24: Update run and capture in scripts/release.mjs to use
execFileSync with separate executable and argument arrays instead of shell
command strings, and refactor their callers accordingly. Tighten explicit X.Y.Z
validation to reject trailing or injected content before invoking npm version,
then pass the validated tag as an argument to Git and GitHub CLI commands rather
than interpolating it into shell strings.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 61cbce2c-4692-49dc-846a-5f38677cc396

📥 Commits

Reviewing files that changed from the base of the PR and between 42fc298 and b8a760b.

📒 Files selected for processing (4)

• .github/workflows/container.yml
• README.md
• package.json
• scripts/release.mjs