feat(ci): cut semver releases so the marketplace has a version to pin

[devantler]

🤖 Generated by the Agentic Engineer

Product direction

Consumers need named, reproducible marketplace versions they can pin, inspect and roll back to. Repository releases describe the complete marketplace; each plugin keeps its own independent version and cache key.

Current baseline

Verified on 2026-10-03: v1.4.3 is the latest published stable marketplace release. Offline preparation calculates the next stable version and generated notes from committed Conventional Commit history. The repository now has separate preparation, signed draft-proposal and publication workflows, documented in the release guide.

A proposal changes both marketplace manifests together and retains normal CI, current-head review and merge requirements. Publication is a distinct explicit operation: it binds the verified proposal to exact successful main CI, fresh native repository/tag/release observations, and independent readback. An assessment or a created draft grants no publication authority. Uncertain writes preserve possible remote state for explicit inspection rather than claiming success or rolling back objects blindly.

Remaining rollout decision

#277 remains the actionable rollout child. Several actual release cycles and adequate recovery evidence must support the maintainer’s decision before unattended creation/publication becomes standard or rollout flags are retired. MARKETPLACE_AUTOPROPOSE and MARKETPLACE_AUTOPUBLISH were independently observed absent on 2026-10-03; this roadmap enables neither. Explicit manual assessment, proposal creation and publication remain supported.

Acceptance

Complete the main-branch release pipeline that reads Conventional Commit history, calculates the next SemVer tag, publishes a GitHub release with generated notes, and writes that version into metadata.version in both marketplace manifests. Preserve independent per-plugin versions, the reviewed proposal-to-merge gates, exact-main CI, complete observations, create-only writes and independent release/consumer verification. Finish #277’s rollout evaluation with its real-cycle and recovery evidence before deciding the unattended default.

Native child issues track the individual implementation and validation work; their linked delivery PRs and project-board states carry progress. This roadmap stays open until the remaining rollout acceptance is observed.

[coderabbitai]

🔗 Related PRs

#32 - ci: guard README plugin table ↔ filesystem parity [merged]
#34 - docs: describe the live multi-upstream skill-sourcing model [merged]
#36 - feat: bundle in-house agent-skills into category plugins [merged]
#63 - feat: add the automated-ai-engineer plugin (agents+skills bundle per ADR-0002) [merged]
#80 - feat!: consolidate autonomous agents into agentic-engineering [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[devantler]

🤖 Generated by the Agentic Engineer

The first release-pipeline increment is implemented in #249 through child #248: offline version calculation, matching marketplace manifest proposals, revision-bound release notes, and a manually invoked read-only artifact workflow. The current revision is 36869f4. All CI checks are green; fresh review is requested, and the required code-quality analysis remains unverified, so the PR is draft.

The command was exercised against this repository's complete history and all eight plugins, then against a disposable tagged-baseline scenario that produced and validated a minor-release manifest update. Per-plugin versions remain independent. No repository release or remote tag has been created.

This parent remains open for the next increment: review and land the selected marketplace version update, refresh remote state, reserve the release tag without overwriting another writer, publish at the exact validated commit, and read back the release and a real consumer installation. ADR 0008 in the PR records that boundary.

[devantler]

🤖 Generated by the Agentic Engineer

Release preparation is merged in #249. The next independent increment is draft #253, closing child #251: it reproduces every candidate artifact and binds it to the exact proposed release commit, rejecting stale parentage, unrelated changes and ambiguous manifests.

The 37-case verifier suite and all repository/bundled suites pass. The final tool was exercised against real initial and incremental catalogue proposals; the incremental committed manifests also passed the full manifest validator. These remain local assessments. Version-update delivery, fresh remote tag reservation, GitHub release publication and consumer verification are still required before this parent can close.

[devantler]

🤖 Generated by the Agentic Engineer

Release preparation (#249) and exact candidate verification (#253) are merged. Draft #267 now delivers child #266: an explicit read-only comparison with GitHub's current default branch, complete tag identities and release occupancy, checked twice around local verification. The command passed 39 offline cases and a real repository assessment; current-head CI is green and CodeRabbit's requested review is in progress.

The remaining publication work is unchanged: deliver the selected version update, reserve its tag without overwriting another writer, publish at that exact validated commit, and verify the release and consumer installation. An assessment does not reserve a version or establish that those outcomes happened, so this parent remains open.

[devantler]

🤖 Generated by the Agentic Engineer

The release-readiness increments are merged: preparation #249, exact candidate verification #253, and remote-state assessment #267. The latest increment landed at ac6197d and completed all 39 regression cases. Its real post-merge assessment accepted a freshly generated candidate for the current main and rejected the previous candidate after main advanced. Child #266 is closed and verified Done.

This parent remains open for publication: deliver the selected marketplace version update, reserve its tag without overwriting another writer, publish at the exact validated commit, and read back both the release and a real consumer installation. The merged command is explicitly an assessment, with no tag or release writes; none of those publication outcomes is claimed.