[ducdetronquito]

Note

Medium Risk
Changes production release automation (force-pushed tags and overwritten release assets); mis-tagged releases are skipped, but a bad tag pattern could still publish wrong binaries to mutable channels.

Overview
Adds mutable GitHub releases so installs can track the latest patch within a major or minor line (swcli-X and swcli-X.Y) instead of only pinning swcli-X.Y.Z.

On each non-prerelease swcli-X.Y.Z release, a new mutable-releases job downloads the built assets, force-moves the major/minor tags to the release commit, creates those releases if missing, and re-uploads binaries with --clobber. The release workflow also bumps several Actions (checkout v7, cache v6, mise-action v5, action-gh-release v3); PR checks get the same cache/mise bumps.

The README gains an Install section with curl examples for full, minor, and major mutable download URLs.

^{Reviewed by Cursor Bugbot for commit a078333. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit a078333. Configure here.}

[cursor]

Mutable tags fail on workflow changes

High Severity

Force-pushing mutable tags with the default GITHUB_TOKEN is rejected when the release commit changes files under .github/workflows/. The job only grants contents: write, so swcli-X and swcli-X.Y are not updated and consumers stay on stale binaries.

Additional Locations (1)

• .github/workflows/build-release.yml#L81-L84

 

^{Reviewed by Cursor Bugbot for commit a078333. Configure here.}