Attests build provenance via actions/attest-build-provenance@v2 for both
release assets, addressing the Obsidian portal security recommendation.
Requires id-token:write and attestations:write permissions (added).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Prevented exit-128 crash when a fix commit pushes to master at the same
version — the workflow now checks for an existing remote tag before
attempting to push one, so the release step can still create the GitHub
release even if the tag is already there.
Also updated both workflows from node-version 20.x to lts/* ahead of the
GitHub-enforced Node 24 migration deadline (2026-06-02).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Release workflow now triggers on push to master instead of manual tag
- Reads version from manifest.json, skips if release already exists
- Creates git tag and publishes release with --generate-notes automatically
- CI restricted to branch pushes to avoid double-run on tag creation
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds CI workflow (push/PR) and release workflow (tag-triggered draft release).
Adds .claude/commands/release.md skill for the release process.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
