[asachs01]

Why

This repo's release job runs semantic-release with @semantic-release/git, which pushes a chore(release) commit back to main. main is branch-protected (PR + 1 approval), so that push is rejected:

remote: error: GH006: Protected branch update failed for refs/heads/main.

It fails in the prepare step, before npm publish, so nothing gets published. The most recent release run that got that far was run 37347591022: it computed 1.0.5 and then hit GH006. There's no v1.0.5 tag.

What

Same fix as WYRE-AI/node-datto-saas-protection#59, matching node-threatlocker's config, which releases fine under branch protection:

• .releaserc.json drops @semantic-release/changelog and @semantic-release/git. Remaining plugins: commit-analyzer, release-notes-generator, npm, github. branches is unchanged (main).
• Removes the @semantic-release/changelog and @semantic-release/git devDependencies and refreshes package-lock.json (npm 10).

Effects

• package.json on main keeps showing 1.0.4. @semantic-release/npm sets the version in the published tarball at publish time.
• The tag and GitHub Release come from semantic-release core and @semantic-release/github.
• Release notes live on the Releases page. CHANGELOG.md stays as a historical file.

Release outcome

This is a ci: commit, so on its own it isn't releasable. On merge, the commit analyzer still sees the unreleased feat/fix commits since v1.0.4 and cuts 1.0.5.

Tests

npm ci, npm run typecheck, npm run build and npm test pass locally on Node 22.
npm run lint fails the same way on main because the repo has no eslint.config.* for ESLint 10. It's a separate, pre-existing problem, and no workflow runs lint here.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Chores
  • npm package publishing remains enabled.
  • Automated changelog generation and release commits that update package metadata and the changelog have been removed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3fb2305c-1ad4-4e5f-80d7-3a12c96fb5b8

📥 Commits

Reviewing files that changed from the base of the PR and between 6d5fba5 and b3eb843.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

📒 Files selected for processing (2)

• .releaserc.json
• package.json

💤 Files with no reviewable changes (2)

• .releaserc.json
• package.json

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

---

📝 Walkthrough

Walkthrough

The release configuration retains npm publishing and removes changelog generation and release commits. The changelog and git plugins are also removed from development dependencies.

Changes

Release configuration

Layer / File(s)	Summary
Configure release plugins .releaserc.json, package.json	The configuration retains npm publishing and removes the changelog and git plugins. Their development dependencies are removed.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to b3eb8

No actionable release-artifact issue was found; the change is mergeable after normal checks.

🚥 Pre-merge checks | ✅ 5 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Changelog Entry	⚠️ Warning	The PR changes release configuration in .releaserc.json: it removes @semantic-release/changelog and @semantic-release/git, so semantic-release no longer generates or commits release artifacts. T…	Add an entry beneath ## [Unreleased] in the Changed section describing the release configuration change.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: preventing release automation from committing artifacts to protected main.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Changelog Entry

Explanation

The PR changes release configuration in .releaserc.json: it removes @semantic-release/changelog and @semantic-release/git, so semantic-release no longer generates or commits release artifacts. The PR also removes these release plugins from package.json. This is a configuration change that alters release behavior. The diff does not modify CHANGELOG.md, although the root file has a ## [Unreleased] section.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🎉 This PR is included in version 1.0.5 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀