ci(release): stop committing release artifacts back to protected main

[asachs01]

Why

This repo's release job runs semantic-release with @semantic-release/git, which pushes a chore(release) commit back to main. main is branch-protected (PR + 1 approval), so that push is rejected:

remote: error: GH006: Protected branch update failed for refs/heads/main.

It fails in the prepare step, before npm publish, so nothing gets published. The most recent release run that got that far was run 37086082219: it computed 1.0.1 and then hit GH006. There's no v1.0.1 tag.

What

Same fix as WYRE-AI/node-datto-saas-protection#59, matching node-threatlocker's config, which releases fine under branch protection:

• .releaserc.json drops @semantic-release/changelog and @semantic-release/git. Remaining plugins: commit-analyzer, release-notes-generator, npm, github. branches is unchanged (main).
• Removes the @semantic-release/changelog and @semantic-release/git devDependencies and refreshes package-lock.json (npm 10).

Effects

• package.json on main keeps showing 1.0.0. @semantic-release/npm sets the version in the published tarball at publish time.
• The tag and GitHub Release come from semantic-release core and @semantic-release/github.
• Release notes live on the Releases page. CHANGELOG.md stays as a historical file.

Release outcome

This is a ci: commit, so on its own it isn't releasable. On merge, the commit analyzer still sees the unreleased feat/fix commits since v1.0.0 and cuts 1.0.1.

Tests

npm ci, npm run lint, npm run build and npm test pass locally on Node 22.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Chores
  • Removed automatic changelog generation and Git commit updates from the release process. npm publishing remains configured.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8a35708a-ce1c-4787-9f64-b96cbce3abd7

📥 Commits

Reviewing files that changed from the base of the PR and between d38118f and c0c4afd.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

📒 Files selected for processing (2)

• .releaserc.json
• package.json

💤 Files with no reviewable changes (2)

• package.json
• .releaserc.json

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

---

📝 Walkthrough

Walkthrough

The release configuration removes the changelog and Git plugins and retains the npm plugin. The package removes the corresponding development dependencies.

Changes

Release plugin cleanup

Layer / File(s)	Summary
Remove changelog and Git plugins .releaserc.json, package.json	The release configuration removes the changelog and Git plugins and their settings. package.json removes both plugins from its development dependencies.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to c0c4a

No actionable merge-blocking risk is identified. The release change is mergeable after normal checks.

🚥 Pre-merge checks | ✅ 5 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Changelog Entry	⚠️ Warning	The PR changes release configuration in .releaserc.json by removing @semantic-release/changelog and @semantic-release/git. This changes release behavior: semantic-release no longer updates `CHAN…	Add an entry beneath ## [Unreleased] in the Changed section. Document that the release process no longer updates CHANGELOG.md or commits release artifacts to main.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: preventing the release process from committing release artifacts to the protected main branch.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Changelog Entry

Explanation

The PR changes release configuration in .releaserc.json by removing @semantic-release/changelog and @semantic-release/git. This changes release behavior: semantic-release no longer updates CHANGELOG.md or commits release artifacts to main. The diff does not modify CHANGELOG.md, and the root file still has an ## [Unreleased] heading. This is a configuration and user-visible release-process change without a corresponding entry.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🎉 This PR is included in version 1.0.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀