fix(release): configure CI tag identity

Author: osovv

.github/workflows/publish.yml

@@ -134,6 +134,8 @@ jobs:
             fi
             echo "Tag ${TAG} already points to ${CURRENT_SHA}; skipping tag push"
           else
+            git config user.name "github-actions[bot]"
+            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
             git tag -a "${TAG}" -m "${TAG}"
             git push origin "${TAG}"
           fi

.grace/verification/main.xml

@@ -33,7 +33,7 @@
       <V-M-MODEL-ROLES><TestFiles><File>src/lib/model-roles.test.ts</File></TestFiles><Checks><Command>bun test src/lib/model-roles.test.ts</Command><Command>bun x tsc --noEmit</Command></Checks></V-M-MODEL-ROLES>
       <V-M-CONFIG-LAYERS><TestFiles><File>src/lib/config-layers.test.ts</File></TestFiles><Checks><Command>bun test src/lib/config-layers.test.ts</Command><Command>bun run typecheck</Command></Checks><Expected>Global/project/effective runtime and TUI sources honor env precedence, json/jsonc selection, and project-local write boundaries.</Expected></V-M-CONFIG-LAYERS>
       <V-M-CLI-CONFIG><TestFiles><File>src/lib/opencode.test.ts</File><File>src/lib/managed-agents.test.ts</File><File>src/commands/sync.test.ts</File></TestFiles><Checks><Command>bun test src/lib/opencode.test.ts src/commands/sync.test.ts</Command><Command>bun run lint</Command><Command>bun run fmt:check</Command></Checks><Expected>Dedicated tui.json(c) mutation writes the pinned base package, migrates legacy subpath specs, preserves comments, unrelated entries, and tuple options; host compatibility, install/sync idempotence, parse state, and registration state are deterministic.</Expected></V-M-CLI-CONFIG>
-      <V-M-RELEASE-AUTOMATION><TestFiles><File>bunfig.toml</File><File>scripts/tui-local.test.ts</File><File>scripts/release-bump.test.ts</File><File>scripts/release-check.test.ts</File><File>scripts/release-summary.test.ts</File></TestFiles><Checks><Command>bun test scripts/tui-local.test.ts scripts/release-bump.test.ts scripts/release-check.test.ts scripts/release-summary.test.ts</Command><Command>bun test src/tui/context/view.test.ts</Command><Command>bun run scripts/check-exports.ts</Command><Command>bun run release:check</Command><Command>bun run typecheck</Command><Command>bun run fmt:check</Command><Command>bun run pack:check</Command></Checks><Expected>The Bun test runner preloads @opentui/solid/preload before test module discovery; local release preparation pushes only the branch and dispatches exact version/SHA inputs; publish.yml is explicit-dispatch-only and orders tests before npm publication and npm publication before remote tag creation.</Expected></V-M-RELEASE-AUTOMATION>
+      <V-M-RELEASE-AUTOMATION><TestFiles><File>bunfig.toml</File><File>scripts/tui-local.test.ts</File><File>scripts/release-bump.test.ts</File><File>scripts/release-check.test.ts</File><File>scripts/release-summary.test.ts</File></TestFiles><Checks><Command>bun test scripts/tui-local.test.ts scripts/release-bump.test.ts scripts/release-check.test.ts scripts/release-summary.test.ts</Command><Command>bun test src/tui/context/view.test.ts</Command><Command>bun run scripts/check-exports.ts</Command><Command>bun run release:check</Command><Command>bun run typecheck</Command><Command>bun run fmt:check</Command><Command>bun run pack:check</Command></Checks><Expected>The Bun test runner preloads @opentui/solid/preload before test module discovery; local release preparation pushes only the branch and dispatches exact version/SHA inputs; publish.yml is explicit-dispatch-only, orders tests before npm publication and npm publication before remote tag creation, and configures a repository-local GitHub Actions bot identity before creating an annotated tag.</Expected></V-M-RELEASE-AUTOMATION>
       <V-M-CLI-MANAGED-AGENTS><TestFiles><File>src/lib/managed-agents.test.ts</File></TestFiles><Checks><Command>bun test src/lib/managed-agents.test.ts</Command><Command>bun x tsc --noEmit</Command></Checks></V-M-CLI-MANAGED-AGENTS>
       <V-M-CLI-MANAGED-SKILLS><TestFiles><File>src/lib/opencode.test.ts</File><File>src/lib/managed-skills.test.ts</File></TestFiles><Checks><Command>bun test src/lib/opencode.test.ts</Command><Command>bun test src/lib/managed-skills.test.ts</Command><Command>bun x tsc --noEmit</Command><Command>bun run lint</Command><Command>bun run fmt:check</Command></Checks></V-M-CLI-MANAGED-SKILLS>
       <V-M-CLI-AGENT-MODELS><TestFiles><File>src/lib/agent-models.test.ts</File></TestFiles><Checks><Command>bun x tsc --noEmit</Command><Command>bun run lint</Command><Command>bun run fmt:check</Command><Command>bun run build</Command></Checks></V-M-CLI-AGENT-MODELS>

scripts/release-bump.test.ts

@@ -15,6 +15,7 @@
 // END_MODULE_MAP
 //
 // START_CHANGE_SUMMARY
+//   LAST_CHANGE: [DIRECT-FIX - Required a repository-local GitHub Actions bot identity before annotated tag creation.]
 //   LAST_CHANGE: [DIRECT-FIX - Added regression coverage preventing pre-verification tag pushes and tag-triggered publishing.]
 // END_CHANGE_SUMMARY
 
@@ -96,9 +97,13 @@ describe("publish workflow ordering", () => {
     const testStep = workflow.indexOf("- name: Test");
     const publishStep = workflow.indexOf("- name: Publish to npm");
     const tagStep = workflow.indexOf("- name: Create and push release tag");
+    const tagIdentity = workflow.indexOf('git config user.name "github-actions[bot]"');
+    const annotatedTag = workflow.indexOf('git tag -a "${TAG}" -m "${TAG}"');
 
     expect(testStep).toBeGreaterThan(-1);
     expect(publishStep).toBeGreaterThan(testStep);
     expect(tagStep).toBeGreaterThan(publishStep);
+    expect(tagIdentity).toBeGreaterThan(tagStep);
+    expect(annotatedTag).toBeGreaterThan(tagIdentity);
   });
 });