ci: migrate to semantic-pr-release-drafter and auto-publish on push to main

[aaronsteers]

Overview

👉 TL;DR: Every merge to main now publishes a GitHub release automatically instead of leaving a draft waiting for a human click. The floating v<major> tag is no longer maintained; consumers should pin an exact version. Specifically, this sets publish: true on aaronsteers/semantic-pr-release-drafter@v2.4.4, gated only by a dry-run workflow_dispatch input, and migrates from the label-based release-drafter to semantic-pr-release-drafter.

Requested by AJ Steers as part of enabling auto-publish across the GitHub Actions repos.

Changes

• Replace release-drafter/release-drafter@v6.0.0 with aaronsteers/semantic-pr-release-drafter@v2.4.4 (semantic PR titles drive versioning; no label config needed)
• Delete the now-unused label-based .github/release-drafter.yml
• Add a workflow_dispatch trigger so the draft can be refreshed manually
• Drop the top-level permissions: contents: read and disable-autolabeler; the job-level contents: write / pull-requests: write matches the other Actions repos
• Pass publish: true so every run publishes; a dry-run workflow_dispatch input (default false) computes the next version without creating or publishing a release when checked
• Delete update-major-tags.yml — floating v<major> tags are intentionally dropped in favor of pinning exact vX.Y.Z versions (or SHAs)
• Job renamed to Create Release

Review Spotlight

Reviewers with limited time, please review first:

• release-drafter.yml#L29: the publish input

Risks

• Every push to main produces a published release (at least a patch bump), same policy as semantic-pr-release-drafter's own repo. Manual workflow_dispatch runs publish too unless dry-run is checked.
• Existing v<major> tags stay where they are and will go stale; README usage examples referencing @v1 need updating (follow-up).

Test plan

• actionlint .github/workflows/release-drafter.yml — clean
• YAML parsed with PyYAML
• Not exercised end to end; the first merge to main after this lands is the live test (expect a published release).

Link to Devin session: https://app.devin.ai/sessions/d2281166d33f4ed3acae6e7f4ac0f0bc
Open in Devin Desktop: https://app.devin.ai/desktop/session/d2281166d33f4ed3acae6e7f4ac0f0bc?variant=devin
Requested by: @aaronsteers

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

Running poe test-success...

Link to job logs.

🟦 Poe command test-success completed successfully.

[github-actions]

Running poe test...

Link to job logs.

❌ Poe command test failed. Please inspect the logs.

[github-actions]

Running poe test-fail-with-summary...

Link to job logs.

❌ Poe command test-fail-with-summary failed. Please inspect the logs.

✴️ Show/Hide Summary Output

Test Results

This is a test of the GITHUB_STEP_SUMMARY feature.

• ✅ Item 1: Success
• ✅ Item 2: Success
• 😵 Item 3: Failure!!

ERROR: Something bad happened ☠️

[github-actions]

Running poe test-success-with-summary...

Link to job logs.

🟦 Poe command test-success-with-summary completed successfully.

✳️ Show/Hide Summary Output

Test Results

This is a test of the GITHUB_STEP_SUMMARY feature.

• ✅ Item 1: Success
• ✅ Item 2: Success
• ✅ Item 3: Success

Status: All tests passed! 🎉

[devin-ai-integration]

Devin Review found 1 potential issue.

1 flag not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)

[devin-ai-integration]

🟨 Unnecessary PR write permission

The release job grants pull-requests: write to an action that only reads PR metadata. Compromised action code can modify repository pull requests.

---

Was this helpful? React with 👍 or 👎 to provide feedback.