ci: stop committing releases back to main

The Actions app cannot be granted a ruleset bypass, so
@semantic-release/git could never push past the two-stage rule without a
personal token. Dropping it leaves the tag, the npm publish and the
GitHub Release, all of which the built-in token can do.

Author: vilenarios

.github/workflows/release.yml

@@ -27,13 +27,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          # @semantic-release/git pushes the `chore(release)` commit straight to
-          # main, which the `two-stage` ruleset otherwise requires a PR for.
-          # The GitHub Actions app (id 15368) is a bypass actor on that ruleset,
-          # so the built-in token is sufficient — matching turbo-sdk, which runs
-          # the same release with the plain GITHUB_TOKEN. No PAT to expire.
-          # A push made with this token does not re-trigger workflows, and the
-          # release commit carries [skip ci] regardless.
+          # semantic-release pushes only the version tag, and the `two-stage`
+          # ruleset covers refs/heads/main, not refs/tags — so the built-in
+          # token is enough and no personal credential is involved. Nothing
+          # here writes to main: @semantic-release/git was removed precisely
+          # because the Actions app cannot be granted a ruleset bypass
+          # ("must be part of the ruleset source or owner organization").
           token: ${{ github.token }}
           fetch-depth: 0
           fetch-tags: true

.releaserc.json

@@ -10,15 +10,7 @@
   "plugins": [
     "@semantic-release/commit-analyzer",
     "@semantic-release/release-notes-generator",
-    "@semantic-release/changelog",
     "@semantic-release/npm",
-    "@semantic-release/github",
-    [
-      "@semantic-release/git",
-      {
-        "assets": ["package.json", "CHANGELOG.md"],
-        "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
-      }
-    ]
+    "@semantic-release/github"
   ]
 }

CHANGELOG.md

@@ -1,3 +1,10 @@
+# Changelog
+
+Release notes for 1.0.2 onward are published on the
+[Releases page](https://github.com/ar-io/ar-io-deploy/releases), generated from
+the same Conventional Commits that drive the version bump. The entries below are
+the historical record through 1.0.1, when the changelog was committed in-repo.
+
 ## [1.0.1](https://github.com/ar-io/ar-io-deploy/compare/v1.0.0...v1.0.1) (2026-07-20)
 
 

package.json

@@ -62,8 +62,6 @@
     "@commitlint/config-conventional": "^19.6.0",
     "@oclif/prettier-config": "^0.2.1",
     "@oclif/test": "^4.1.14",
-    "@semantic-release/changelog": "^6.0.3",
-    "@semantic-release/git": "^10.0.1",
     "@semantic-release/npm": "^13.1.1",
     "@types/mime-types": "^2.1.4",
     "@types/node": "^22.10.2",