ci: auto-bump version and release from Conventional Commits

[ohernandezdev]

Summary

• Adds .github/workflows/version-bump.yml: on every push to main, scans commit subjects since the last v* tag for Conventional Commit types (fix: → patch, feat: → minor, !/BREAKING CHANGE: → major, anything else → no bump), writes the resulting version into the same 4 files the manual convention already touched (package.json, package-lock.json, src-tauri/Cargo.toml, src-tauri/Cargo.lock, src-tauri/tauri.conf.json), commits as chore: bump version to X.Y.Z, tags vX.Y.Z, and dispatches release.yml.
• Adds workflow_dispatch: to release.yml's triggers — required because a GITHUB_TOKEN-authored tag push does not fire its existing push: tags: trigger, so version-bump.yml calls gh workflow run release.yml --ref vX.Y.Z explicitly instead.
• Adds a project CLAUDE.md documenting the Conventional Commits requirement and its consequence: a fix:/feat: commit on main now becomes a real, signed, public release (installers + winget PR) with no human confirmation step in between.

Important: this was the "full automation" option, chosen explicitly

This turns every fix:/feat: merge to main into an unattended public release — signed/notarized installers published to GitHub Releases, plus a winget-pkgs manifest PR. There is no manual gate between merge and release once this is on main. Confirmed as the intended scope before implementing (the alternative — bump-and-commit only, tag/release left as a manual step — was the lower-blast-radius option).

Things to verify/configure before merging

• Branch protection on main must allow the Actions bot (GITHUB_TOKEN) to push directly (the bump commit + tag) — if "restrict who can push" or required status checks would block this, the push step will fail.
• The default GITHUB_TOKEN permissions for this repo must allow contents: write and actions: write (set explicitly in the workflow, but repo/org settings can still cap it below that).
• Test on a real merge with a fix:-typed commit before relying on it — I validated the shell logic (bump-level detection, version arithmetic, the Cargo.toml/tauri.conf.json version substitutions) locally against sample data and real repo files, and confirmed the YAML structure by hand, but the workflow itself hasn't run in GitHub Actions yet.

Test plan

• Bump-level detection tested against fix-only / feat+fix / breaking-bang / breaking-footer / chore-only / empty commit sets — correct in all 6 cases
• Version arithmetic (patch/minor/major) tested against sample versions — correct
• Cargo.toml and tauri.conf.json version substitution tested against copies of the real files — correct, only the intended field changes
• npm version tested against copies of the real package.json/package-lock.json — correct
• End-to-end run in GitHub Actions on a real fix:/feat: merge to main

🤖 Generated with Claude Code

https://claude.ai/code/session_01PioEvgnoP4fpxDrSAYTBdF