ci: auto-create GitHub Release on tag push

[scotty595]

Releases were falling out of sync — v0.13.1 / v0.13.2 / v0.14.0 / v0.14.1 all had tags + npm publish but no GitHub Release entries until I created them by hand today. Future tags should auto-publish a Release with notes pulled from the matching CHANGELOG section.

Adds a "Create GitHub Release" step at the end of publish.yml:

• Skips if a release for the tag already exists (idempotent re-run safe)
• Pulls the human-readable suffix from the CHANGELOG header line (## [VERSION] - DATE — TITLE) and uses it as the release title
• Extracts the body between this version's header and the next ## [ header — same content the CHANGELOG already maintains
• Does NOT mark 0.x as prerelease (we treat 0.x as stable for this SDK)
• Promotes permissions to contents: write (was read-only) — npm publish doesn't need it; gh release create does

The script doesn't fail the workflow when no CHANGELOG section is found — emits a ::warning:: so we notice but the npm publish has already happened by that step. We can backfill notes manually after.

Description

Checklist

• npm test passes (all 945+ tests)
• npm run build compiles clean
• No any types introduced
• All new files < 300 LOC
• Documentation updated (if public API changed)
• Tests added for new functionality

---

Note

Low Risk
Low risk CI-only change; main impact is granting contents: write to the workflow and adding a release-creation step that could fail due to changelog parsing or GitHub CLI behavior.

Overview
Automates GitHub release creation as part of the tag-based publish workflow: after successful npm publishing, the workflow now creates a GitHub Release for the tag using notes extracted from packages/governance/CHANGELOG.md, and skips creation if the release already exists.

To enable this, the workflow’s permissions are elevated from contents: read to contents: write so gh release create can run using GITHUB_TOKEN (while npm publishing remains token-authenticated).

^{Reviewed by Cursor Bugbot for commit 2c7000b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2c7000b. Configure here.}

[cursor]

Sed fallthrough produces malformed release title

Low Severity

When the CHANGELOG header exists but lacks the — TITLE suffix (e.g. ## [0.9.0] - 2026-04-14), the sed substitution pattern won't match, leaving TITLE_SUFFIX as the entire raw header line. RELEASE_TITLE then becomes something like v0.9.0 — ## [0.9.0] - 2026-04-14 — duplicated, with raw markdown formatting in the GitHub Release title.

 

^{Reviewed by Cursor Bugbot for commit 2c7000b. Configure here.}