fix(ci): route manual-release through PR + auto-merge

[itsmiso-ai]

Problem

The in-repo Manual Release workflow has been silently broken since main became protected. The Commit version bump step did git push origin HEAD:main directly, which GitHub now rejects:

GH006: Protected branch update failed for refs/heads/main.

• Changes must be made through a pull request.
• 6 of 6 required status checks are expected.

This means triggering the workflow produces a version-bump commit that never reaches main, and the rest of the job (tag + release) hangs on a stale local checkout.

Fix

Replace the direct-to-main push with the same path the team has been using manually for past releases (e.g. #548, #594):

1. Push the version-bump commit to a release branch (chore/release-v<version>).
2. Open a PR against main.
3. Enable squash auto-merge via gh pr merge --auto --squash --delete-branch.
4. Poll until the PR is MERGED.
5. Fetch main, create the tag, create the GitHub release — same as before.

Added pull-requests: write to job permissions so gh pr create / gh pr merge work with the bot app token.

Notes

• The release artifact (tag, release notes, package.json + package-lock.json bump) is unchanged.
• The PR title matches the past pattern (chore: release v<version>).
• Timeout is 10 minutes for the auto-merge wait; if it doesn't merge in time, the workflow fails loudly with the branch name so the release can be retried or finished manually.
• The follow-up failures on the last 0.1.17 and 0.1.18 release runs were this same bug — releases were done manually via PR (fix: local sent messages show timestamp before refresh #177, fix: add backend URL menu + connection test (#214) #231) until this lands.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — escalated (fast_low_confidence)

PR Review: fix(ci): route manual-release through PR + auto-merge

Summary

This PR fixes a broken Manual Release workflow that was attempting to push directly to the protected main branch. The change routes version bumps through a PR with auto-merge, matching the documented manual release process in AGENTS.md.

Change-by-Change Findings

1. Added pull-requests: write permission — Required for gh pr create and gh pr merge to work with the bot app token. Appropriate scope for the job's purpose.

2. Replaced direct-to-main push with branch-based flow — The "Commit version bump to release branch" step now pushes to chore/release-v<version> instead of HEAD:main, respecting branch protection.

3. Added "Open version-bump PR and enable auto-merge" step — Creates a PR with --delete-branch and enables squash auto-merge via gh pr merge --auto --squash --delete-branch. The PR title "chore: release v${VERSION}" matches the pattern seen in past release PRs (PR 594, PR 548).

4. Added "Wait for version-bump PR to merge" step — Polls every 5 seconds for up to 10 minutes (120 iterations). Properly fails with an informative error if the PR doesn't merge in time, allowing manual retry or completion.

5. Conditional execution — Both new steps use if: steps.bump.outputs.branch != '', correctly skipping when no version changes exist.

Standards Compliance

The implementation aligns with the documented release process in AGENTS.md:

• Branch naming convention: chore/release-v<version> ✓
• PR title format: chore: release v<version> ✓
• Squash merge strategy ✓
• GitHub App bot token for operations ✓
• Tag and release creation preserved in subsequent steps ✓

Test Failure Note

The test check shows failure, but the failing file (tests/reaction-events.test.js) is completely unrelated to this workflow-only change. The diff only modifies .github/workflows/manual-release.yml. The test failure is a pre-existing issue, not introduced by this PR — lint passed, confirming no syntax issues.

Unknowns / Needs Verification

• None identified. The workflow logic is self-consistent, uses correct GitHub CLI commands, and follows repository conventions.

Linked Issue Fit

No linked issue was provided, so no fit comparison is applicable.

Recommendation

Approve. The fix resolves the root cause (direct push to protected branch), follows established repository conventions, adds appropriate error handling for the merge wait, and the release artifact output is unchanged.