ci(release): stop committing release artifacts back to protected main

[asachs01]

Why

This repo's release job runs semantic-release with @semantic-release/git, which pushes a chore(release) commit back to main. main is branch-protected (PR + 1 approval), so that push is rejected:

remote: error: GH006: Protected branch update failed for refs/heads/main.

It fails in the prepare step, before npm publish, so nothing gets published. The most recent release run that got that far was run 37086135476: it computed 1.0.4 and then hit GH006. There's no v1.0.4 tag.

What

Same fix as WYRE-AI/node-datto-saas-protection#59, matching node-threatlocker's config, which releases fine under branch protection:

• .releaserc.json drops @semantic-release/changelog and @semantic-release/git. Remaining plugins: commit-analyzer, release-notes-generator, npm, github. branches is unchanged (main).
• Removes the @semantic-release/changelog and @semantic-release/git devDependencies and refreshes package-lock.json (npm 10).

Effects

• package.json on main keeps showing 1.0.3. @semantic-release/npm sets the version in the published tarball at publish time.
• The tag and GitHub Release come from semantic-release core and @semantic-release/github.
• Release notes live on the Releases page. CHANGELOG.md stays as a historical file.

Release outcome

This is a ci: commit, so on its own it isn't releasable. On merge, the commit analyzer still sees the unreleased feat/fix commits since v1.0.3 and cuts 1.0.4.

Tests

npm ci, npm run lint, npm run typecheck, npm run build and npm test pass locally on Node 22.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Chores
  • Release publishing remains enabled, but releases no longer automatically generate a changelog or commit release-related files to the repository. This affects release maintenance only; there are no changes to application features or user-facing behavior. Published package distribution continues through the release workflow, with no change to how the application works for end users.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: f7393002-a0a1-428b-976e-09f80763927e

📥 Commits

Reviewing files that changed from the base of the PR and between c293d19 and 2ac773f.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

📒 Files selected for processing (2)

• .releaserc.json
• package.json

💤 Files with no reviewable changes (2)

• package.json
• .releaserc.json

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

---

📝 Walkthrough

Walkthrough

The release configuration retains npm publishing and removes the changelog and git plugins. Their development dependencies are also removed.

Changes

Release configuration

Layer / File(s)	Summary
Remove changelog and git plugins .releaserc.json, package.json	The release configuration retains npm publishing and removes the changelog and git plugins. The matching development dependencies are removed.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 2ac77

The release configuration no longer attempts to commit artifacts to protected main. No actionable issue identified here prevents merging after normal checks.

🚥 Pre-merge checks | ✅ 5 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Changelog Entry	⚠️ Warning	The PR changes release configuration by removing @semantic-release/changelog and @semantic-release/git from .releaserc.json. This changes release behavior: semantic-release no longer updates `CH…	Add a corresponding entry beneath ## [Unreleased] in the Changed section of CHANGELOG.md.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: preventing the release process from committing release artifacts to protected main.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Changelog Entry

Explanation

The PR changes release configuration by removing @semantic-release/changelog and @semantic-release/git from .releaserc.json. This changes release behavior: semantic-release no longer updates CHANGELOG.md or commits release artifacts. The PR does not modify CHANGELOG.md or add an entry under ## [Unreleased].

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🎉 This PR is included in version 1.0.4 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀