feat(release): automate version + tag via release-please

.github/workflows/release-please.yaml

@@ -0,0 +1,24 @@
+name: release-please
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      # If RELEASE_PLEASE_TOKEN is set (a PAT with `contents: write` on this
+      # repo), tags pushed by release-please will trigger release.yaml. With
+      # only the default GITHUB_TOKEN, the tag is created but downstream
+      # workflows do NOT fire (GitHub policy), so the release would need to
+      # be re-kicked manually. Set the PAT to wire the chain end-to-end.
+      - uses: googleapis/release-please-action@v4
+        with:
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.0.0"
+}

CHANGELOG.md

@@ -4,26 +4,4 @@ All notable changes to refuse-cli are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html) once it reaches 1.0.
 
-## [Unreleased]
-
-### Added
-- Community + governance: `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, `SECURITY.md`, `CODEOWNERS`, issue + PR templates, `.editorconfig`, `ARCHITECTURE.md`, `ROADMAP.md`.
-- `.golangci.yaml` and a `lint` workflow.
-- Dependabot, CodeQL.
-- Release signing (cosign) and SLSA provenance attestations.
-
-### Changed
-- README: hero, badges, ecosystem matrix, cross-links to `refuse` and `refuse.dev`.
-
-## [0.0.1] — initial
-
-- Multicall binary: invoking the binary as `npm` / `pip` / `yarn` / `cargo` / etc. routes to the shim, invoking it as `refuse` opens the CLI.
-- `refuse gate` decision engine: parses an install command, queries the server, and exits 0 (allow) or 2 (block).
-- Argv parsers: npm, pnpm, yarn (classic + Berry), pip, pip3, cargo, gem, bun, go.
-- Claude Code PreToolUse hook integration.
-- Goreleaser-based releases for darwin/linux/windows × amd64/arm64.
-- Homebrew tap (`refusehq/tap/refuse`).
-- `scripts/install.sh` with sha256 checksum verification.
-
-[Unreleased]: https://github.com/RefuseHQ/refuse-cli/compare/v0.0.1...HEAD
-[0.0.1]: https://github.com/RefuseHQ/refuse-cli/releases/tag/v0.0.1
+<!-- versions below this line are managed by release-please -->

release-please-config.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "release-type": "go",
+  "include-component-in-tag": false,
+  "include-v-in-tag": true,
+  "bump-minor-pre-major": true,
+  "bump-patch-for-minor-pre-major": true,
+  "draft": false,
+  "prerelease": false,
+  "packages": {
+    ".": {
+      "package-name": "refuse-cli",
+      "changelog-path": "CHANGELOG.md"
+    }
+  }
+}