[guitavano]

What is this Contribution About?

main is about to require a pull request (repository ruleset, 0 approvals). The determine-tag job pushes the version bump (Update version to X.Y.Z) straight to main with GITHUB_TOKEN, and a ruleset cannot list GitHub Actions as a bypass actor, so that push would be rejected and releases would stop.

This lands the bump through a pull request instead, still with GITHUB_TOKEN:

• commit the bump on release/X.Y.Z, open a PR to main, and squash-merge it right away (retries while GitHub computes mergeability);
• tag the bump PR's merge commit instead of the local HEAD;
• skip PRs titled Update version to … when looking for the PR that triggered the push, so a bump PR is never mistaken for the one carrying the tagging reaction.

Nothing else changes: the reaction on the "Tagging Options" comment still picks the version, and the release/publish dispatches are the same. PRs opened and merged with GITHUB_TOKEN don't trigger workflows, so there's no new run and no loop, same as the direct push today. Each release now leaves a merged Update version to X.Y.Z (#N) PR in the history.

The next prerelease job is untouched (next is not protected).

Rollout

1. Merge this.
2. Turn on the main: require pull request ruleset (same as deco-cx/admin).
3. Watch the next release: bump PR merged, tag on its merge commit, release + publish dispatched.

Verification

• YAML parses; the new run script passes bash -n.
• Repo allows GitHub Actions to create PRs (can_approve_pull_request_reviews: true), and the workflow already has contents: write + pull-requests: write.
• Not run end to end: it only runs on a push to main.

🤖 Generated with Claude Code

---

Summary by cubic

main is about to require pull requests, and the release workflow was pushing the version bump straight to main with GITHUB_TOKEN, which a ruleset can't bypass. The bump now lands through a squash-merged PR, and the tag is created on the PR's merge commit instead of the local HEAD.

• Commits the bump on release/X.Y.Z, opens a PR to main, and squash-merges it with retries while GitHub computes mergeability.
• Filters out Update version to … PRs when finding the PR that triggered the tagging reaction, so the bump PR is never mistaken for it.
• PRs opened and merged with GITHUB_TOKEN don't trigger workflows, so there's no new run or loop.
• Each release leaves a merged Update version to X.Y.Z (#N) PR in history.

Rollout

• Merge this PR, then enable the main: require pull request ruleset before the next release.

^{Written for commit c702274. Summary will update on new commits.}

[github-actions]

Tagging Options

Should a new tag be published when this PR is merged?

• 👍 for Patch 0.165.5 update
• 🎉 for Minor 0.166.0 update
• 🚀 for Major 1.0.0 update

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3328bda9-d368-49f2-b0a9-b71ff3a50e66

📥 Commits

Reviewing files that changed from the base of the PR and between 9d00a2d and c702274.

📒 Files selected for processing: 1

• .github/workflows/releaser.yaml

+----------------------------------------------------------------------------------+
| Controlling complexity is the essence of computer programming. - Brian Kernighan |
+----------------------------------------------------------------------------------+
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}