ci: move the release cut into a GitHub Actions workflow

[claude]

Requested by boris · Slack thread

Before: cutting a release means boris runs ./release.sh on his laptop — it bumps package.json, runs the checks, commits, tags, and pushes; the tag push then triggers the existing release.yml publish pipeline.

After: a Cut Release workflow in the Actions tab does the same thing. Pick "Cut Release" → Run workflow → enter the version (e.g. 0.3.0). Everything downstream (release.yml: npm publish, GitHub release, Homebrew bump) is unchanged and still triggers off the v* tag.

How

The workflow (.github/workflows/cut-release.yml) runs release.sh itself rather than duplicating its logic in YAML — one source of truth. The script got two minimal, backwards-compatible edits (it still works locally exactly as before):

• CI mode (when CI is set): no interactive prompts — the version argument is required and the branch must be main, otherwise it dies.
• RELEASE_DRY_RUN=1: runs the version bump and the full gate, then reverts the bump and exits before committing/tagging/pushing.

The order of operations is preserved: typecheck (codegen against the live prod OpenAPI spec — the hard gate that protects fresh installs from polylane.com), lint, test, and build all run before anything is committed, tagged, or pushed. If any check fails, no tag is created and release.yml never fires.

One non-obvious detail: the workflow pushes the version-bump commit and tag using a short-lived coreplane-bot GitHub App token, minted at run time from App credentials loaded out of the 1Password CI vault (the org-standard pattern used by our other repos) — not the default GITHUB_TOKEN. Tags pushed with GITHUB_TOKEN deliberately do not trigger other workflows, so release.yml would silently never run. Dry runs skip the 1Password/App-token steps entirely and check out with the default read-only token, since they never push.

Secrets to add

Before the first CI release, add this in repo Settings → Secrets and variables → Actions → New repository secret:

Secret	Purpose
OP_SERVICE_ACCOUNT_TOKEN	The org-standard 1Password service-account token — the same one the other repos (nominal, polylanedotcom, leaderboards, cloudevals, polylane-k8s) already use. It lets the workflow read the coreplane-bot App credentials from the 1Password CI vault and mint a short-lived App token with Contents: Read and write, which pushes the version-bump commit and v* tag so the push triggers release.yml.

The workflow also reads POLYLANE_API_DOMAIN, POLYLANE_OAUTH_CLIENT_ID, and POLYLANE_OAUTH_CLIENT_SECRET for the build gate — these already exist (used by checks.yml / release.yml), nothing new to add there.

Dry run

Run the workflow with dry_run checked: it bumps, runs the full gate (including the live-prod-spec typecheck), then reverts and stops — no commit, no tag, no publish. Dry runs skip the 1Password/App-token steps, so this works even before OP_SERVICE_ACCOUNT_TOKEN is configured — a good first smoke test of this PR.

Validation done here

• bash -n release.sh and actionlint on all workflows: clean.
• npm ci && npm run typecheck && npm run lint && npm run test && npm run build against the live prod spec: all pass.
• Full CI-mode dry run exercised locally (CI=1 RELEASE_DRY_RUN=1 ./release.sh 9.9.9): bump → all checks → revert, exit 0; the no-version and wrong-branch CI guards both die as intended.
• Not validated: an actual workflow_dispatch run on GitHub (needs the secret and a merge).

---

Generated by Claude Code