chore: rework release workflows for releasekit

[goosewobbler]

Replacing package-versioner and all the custom release logic with releasekit

[greptile-apps]

Greptile Summary

This PR replaces the bespoke multi-phase release system (four reusable orchestration workflows plus custom TypeScript and shell scripts) with releasekit, consolidating the entire release pipeline into a single reusable workflow and releasekit.config.json. All issues flagged in the previous review round appear addressed: ssh_key moved to secrets, Rust toolchain now runs before Build packages, uses: ./ replaced with the versioned releasekit action, scope prefix stripping handles both manual and auto label forms, release-preview.yml has a checkout step, and target_branch is now a user-overridable workflow_dispatch input.

Confidence Score: 5/5

Safe to merge — all previously flagged issues are resolved and no new P0/P1 issues found.

Every P0 and P1 finding from the prior review round has been addressed in the current implementation. The only open question (potential interaction between setup-node registry-url and releasekit OIDC auth) is speculative and does not constitute a present defect, keeping all remaining concerns at P2 or lower.

No files require special attention.

Vulnerabilities

No security concerns identified. The deploy key is correctly placed under workflow_call.secrets (not inputs). NPM publishing uses OIDC with provenance. Crates.io publishing uses a runtime secret. The cargo.noVerify option in the config skips pre-publish checks, which is a minor trade-off but not a vulnerability.

Important Files Changed

Filename	Overview
.github/workflows/_release.reusable.yml	New consolidated reusable release workflow; all previously flagged issues (ssh_key in secrets, Rust-before-build ordering, replace() expression, uses:./) resolved in the current version.
.github/workflows/release.yml	Reworked release trigger workflow using releasekit gate mode; GraphQL query removed, label matching delegated to releasekit, scope/target_branch inputs now present for manual runs.
.github/workflows/release-preview.yml	Simplified preview workflow; checkout step is now present before the releasekit action.
releasekit.config.json	New releasekit configuration; git.branch hardcoding removed, scopeLabels align with documented labels, Ollama baseURL confirmed as cloud API endpoint by author.
package.json	Adds @releasekit/release devDependency; no other functional changes.
.github/workflows/README.md	Updated to document the new scope/bump/release label system and simplified workflow structure.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Push to main / workflow_dispatch] --> B{Event type?}
    B -- workflow_run CI completed --> C[gate job\nreleasekit mode:gate]
    C --> D{should_release?}
    D -- false --> E[Skip release]
    D -- true --> F[release-auto\ncalls _release.reusable.yml]
    B -- workflow_dispatch --> G[release-manual\ncalls _release.reusable.yml]
    F --> H[_release.reusable.yml]
    G --> H
    H --> I[Checkout via SSH]
    H --> J[Setup Node / pnpm install]
    H --> K{scope contains tauri?}
    K -- yes --> L[Setup Rust + GTK]
    K -- no --> M[Build packages by scope]
    L --> M
    M --> N[Configure Git]
    N --> O[releasekit mode:release\nversioning + publish + GitHub Release]

    PR[Pull Request opened/labeled] --> P[release-preview.yml\nreleasekit mode:preview]
    P --> Q[PR comment with version preview]

Loading

_{Reviews (23): Last reviewed commit: "docs: update README to reflect changes i..." | Re-trigger Greptile}