fix(release): harden next workflow and resumable releases

.github/workflows/ci.yml

@@ -1,49 +1,43 @@
-name: CI
-
+name: Continuous Integration
 on:
-  push:
-    branches: [master, main]
   pull_request:
-    branches: [master, main]
-
+    branches: [next]
+  push:
+    branches: [next]
+permissions:
+  contents: read
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 jobs:
-  build:
+  verify:
+    name: Verify (Node ${{ matrix.node }})
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node: [22, 24, 26]
     steps:
       - uses: actions/checkout@v4
-
       - uses: pnpm/action-setup@v4
         with:
-          version: 9
-
+          version: 10.26.2
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: ${{ matrix.node }}
           cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install
-
-      - name: Build
-        run: pnpm build
-
-      - name: Check dist is up to date
-        run: |
-          if [ -n "$(git status dist --porcelain)" ]; then
-            echo "dist/ is out of date. Run 'pnpm build' and commit."
-            exit 1
-          fi
-
-  # test:
-  #   runs-on: ubuntu-latest
-  #   steps:
-  #     - uses: actions/checkout@v4
-  #     - uses: pnpm/action-setup@v4
-  #       with:
-  #         version: 9
-  #     - uses: actions/setup-node@v4
-  #       with:
-  #         node-version: 20
-  #         cache: pnpm
-  #     - run: pnpm install
-  #     - run: pnpm test
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm typecheck
+      - run: pnpm test
+      - run: pnpm build
+      - name: Verify committed bundle
+        run: git diff --exit-code -- dist
+  ci:
+    name: CI
+    if: always()
+    needs: [verify]
+    runs-on: ubuntu-latest
+    steps:
+      - env:
+          RESULT: ${{ needs.verify.result }}
+        run: test "$RESULT" = success

.github/workflows/pr-title.yml

@@ -0,0 +1,32 @@
+name: Pull request title
+on:
+  pull_request:
+    branches: [next]
+    types: [opened, edited, synchronize, reopened, ready_for_review]
+permissions:
+  pull-requests: read
+jobs:
+  title:
+    name: PR title
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@v6
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        with:
+          types: |
+            feat
+            fix
+            docs
+            style
+            refactor
+            perf
+            test
+            build
+            ci
+            chore
+            revert
+          scopes: |
+            [a-zA-Z0-9._/-]+
+          requireScope: false
+          subjectPattern: '^\S[^\r\n]*$'

AGENTS.md

@@ -0,0 +1,9 @@
+# Repository workflow
+
+- Start branches from `origin/next` and open PRs targeting `next` with Conventional Commit titles.
+- Use Node 22 or newer and pnpm 10.26.2. Run `pnpm typecheck`, `pnpm test`, and `pnpm build`; commit the rebuilt `dist/` with source changes.
+- Require review and passing CI; never bypass the ruleset or push directly to `next`.
+- Keep workflow automation in GitHub Actions; do not add a `scripts/` folder for workflow helpers. Manage rulesets directly in GitHub, not checked-in JSON copies.
+- Always ask Omer before creating, moving, or pushing version tags, publishing a GitHub Release or package, changing distribution tags, or dispatching any workflow that performs these actions. Code fixes and PRs are not release approval.
+- Use existing version tags in documentation, not commit SHAs or nonexistent stable aliases. The latest numbered development tag is `v0.1.0-dev.14`.
+- Keep `patches/@contractual__changesets@0.1.0-dev.5.patch` until an approved dependency upgrade contains the YAML fix. No npm publication is needed to build this patch into the Action.

CONTRIBUTING.md

@@ -0,0 +1,22 @@
+# Contributing
+
+Create a branch from `origin/next`, then open a PR to `next`. Use a Conventional Commit title, for example `fix(release): resume incomplete releases`. One approving review, resolved conversations, up-to-date branches, and passing `CI` and `PR title` checks are required. Squash merges use the PR title.
+
+Use Node 22 or newer and pnpm 10.26.2:
+
+```sh
+pnpm install --frozen-lockfile
+pnpm typecheck
+pnpm test
+pnpm build
+```
+
+Commit `dist/` with source changes. CI rebuilds the bundle and checks for drift on Node 22, 24, and 26. The Action runs on GitHub's Node 24 runtime; self-hosted runners must support that runtime.
+
+## Release approval
+
+Ask Omer before creating or moving version tags, publishing anything, or changing release aliases. Existing tags are left intact. Documentation uses `@v0.1.0-dev.14`, the highest existing tag; it does not yet include the changes in this PR. A new version and an optional major alias require a separate approval after review and validation.
+
+## Dependency patch
+
+The checked-in pnpm patch backports the core repository's malformed-YAML version-sync fix to `@contractual/changesets@0.1.0-dev.5`. This keeps installations reproducible without publishing a new package. Remove the patch only after upgrading to an approved published dependency that includes the fix and passing the regression test.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (C) 2025 Omer Morad
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -4,8 +4,10 @@ Schema contract lifecycle management for GitHub — lint, detect breaking change
 
 ## Usage
 
+Requires Node 22+ for development and a GitHub runner supporting the Action's Node 24 runtime. Licensed under MIT. The example uses an existing development tag; stable release tags require a separate approval. See [CONTRIBUTING.md](CONTRIBUTING.md).
+
 ```yaml
-- uses: contractual-dev/action@v1
+- uses: codotech/contractual-action@v0.1.0-dev.14
   with:
     mode: pr-check
     github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -39,7 +41,7 @@ jobs:
           fetch-depth: 0
           ref: ${{ github.head_ref }}
 
-      - uses: contractual-dev/action@v1
+      - uses: codotech/contractual-action@v0.1.0-dev.14
         with:
           mode: pr-check
           github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -70,7 +72,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: contractual-dev/action@v1
+      - uses: codotech/contractual-action@v0.1.0-dev.14
         with:
           mode: release
           github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -84,9 +86,9 @@ jobs:
 | `github-token` | No | `${{ github.token }}` | Token for PR comments and commits |
 | `fail-on-breaking` | No | `true` | Fail if breaking changes detected |
 | `auto-changeset` | No | `true` | Auto-generate changeset if missing |
-| `version-pr-title` | No | `Version Contracts` | Title of the Version PR |
+| `version-pr-title` | No | `chore: version contracts` | Title of the Version PR |
 | `version-pr-branch` | No | `contractual/version-contracts` | Branch for the Version PR |
-| `anthropic-api-key` | No | — | Anthropic API key for AI features |
+| `anthropic-api-key` | No | — | Reserved; AI features are not implemented |
 
 ## Outputs
 

action.yml

@@ -27,7 +27,7 @@ inputs:
   version-pr-title:
     description: 'Title for the Version Contracts PR'
     required: false
-    default: 'Version Contracts'
+    default: 'chore: version contracts'
   version-pr-branch:
     description: 'Branch name for Version Contracts PR'
     required: false
@@ -72,5 +72,5 @@ outputs:
     description: 'JSON array of created git tags (post-merge)'
 
 runs:
-  using: 'node20'
+  using: 'node24'
   main: 'dist/index.js'