[asachs01]

Why

This repo's release job runs semantic-release with @semantic-release/git, which pushes a chore(release) commit back to main. main is branch-protected (PR + 1 approval), so that push is rejected:

remote: error: GH006: Protected branch update failed for refs/heads/main.

It fails in the prepare step, before npm publish, so nothing gets published. The most recent release run that got that far was run 37086096059: it computed 1.0.2 and then hit GH006. There's no v1.0.2 tag.

What

Same fix as WYRE-AI/node-datto-saas-protection#59, matching node-threatlocker's config, which releases fine under branch protection:

• .releaserc.json drops @semantic-release/changelog and @semantic-release/git. Remaining plugins: commit-analyzer, release-notes-generator, npm, github. branches is unchanged (main).
• Removes the @semantic-release/changelog and @semantic-release/git devDependencies and refreshes package-lock.json (npm 10).

Effects

• package.json on main keeps showing 1.0.1. @semantic-release/npm sets the version in the published tarball at publish time.
• The tag and GitHub Release come from semantic-release core and @semantic-release/github.
• Release notes live on the Releases page. CHANGELOG.md stays as a historical file.

Release outcome

This is a ci: commit, so on its own it isn't releasable. On merge, the commit analyzer still sees the unreleased feat/fix commits since v1.0.1 and cuts 1.0.2.

Tests

npm ci, npm run lint, npm run build and npm test pass locally on Node 22.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Chores
  • Updated the release process: releases continue to publish through npm and GitHub, but no longer automatically generate or update a changelog or commit release files to the repository. These changes affect release management rather than the app’s user-facing features or behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 06095c8f-b8ab-48ad-a7d6-1590e9ce3f1b

📥 Commits

Reviewing files that changed from the base of the PR and between 09113ac and 07c7a27.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

📒 Files selected for processing (2)

• .releaserc.json
• package.json

💤 Files with no reviewable changes (2)

• package.json
• .releaserc.json

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

---

📝 Walkthrough

Walkthrough

The release configuration no longer uses the changelog or git plugins. Their development dependencies were also removed.

Changes

Release configuration

Layer / File(s)	Summary
Remove changelog and git plugins .releaserc.json, package.json	The release configuration removes the changelog and git plugins and their settings. package.json removes both plugins from devDependencies. The npm and GitHub plugins remain configured.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 07c7a

No actionable merge-blocking risk is identified from the supplied changes; the release workflow can proceed through normal checks.

🚥 Pre-merge checks | ✅ 5 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Changelog Entry	⚠️ Warning	The PR changes release configuration. It removes @semantic-release/changelog and @semantic-release/git, so releases no longer update or commit release artifacts through those plugins. `CHANGELOG.m…	Add a corresponding entry beneath ## [Unreleased] in the Removed section. Document the removal of the automatic changelog and release-commit plugins.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the primary change: preventing semantic-release from committing release artifacts to protected main.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Changelog Entry

Explanation

The PR changes release configuration. It removes @semantic-release/changelog and @semantic-release/git, so releases no longer update or commit release artifacts through those plugins. CHANGELOG.md exists with ## [Unreleased], but the PR does not modify it.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🎉 This PR is included in version 1.0.2 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀