Publish releases automatically with native notes

[bomly-guy]

Summary

• switch GoReleaser releases from draft to published releases
• use GitHub-native generated release notes below the GoReleaser release header
• update release docs/checklist/architecture to treat the Auto Version tag workflow as the manual approval gate

This makes release assets public before package-manager PR validation, which avoids WinGet PR failures caused by missing public release files.

Security notes

• publishing now relies on the tag creation path as the release approval boundary
• the release workflow still runs validation before GoReleaser publishes artifacts
• package-manager updates remain separate PRs for review

Validation

• /Users/ahmed/go/bin/goreleaser check
• git diff --check
• make test
• go vet ./...
• /Users/ahmed/go/bin/goreleaser release --snapshot --clean --skip=publish

Summary by CodeRabbit

• Chores
  • Updated release configuration to publish GitHub releases automatically instead of creating drafts.
  • Transitioned to GitHub-native release notes generation.
  • Updated release documentation to reflect the streamlined publication process.

[coderabbitai]

📝 Walkthrough

Walkthrough

The GoReleaser release block is changed from draft: true with replace_existing_draft to use: github-native and draft: false, removing manual changelog filtering. Documentation in ARCHITECTURE.md, CI.md, and RELEASE_CHECKLIST.md is updated to reflect that releases are now published immediately with GitHub-native release notes.

Changes

Draft-to-published release switch

Layer / File(s)	Summary
GoReleaser release block: draft → github-native published .goreleaser.yaml	Sets use: github-native and draft: false, removes replace_existing_draft, drops sort/filters.exclude changelog configuration, and updates the release header text.
Documentation updates for published release flow docs/ARCHITECTURE.md, docs/development/CI.md, docs/development/RELEASE_CHECKLIST.md	Replaces all draft-release references with published-release wording, adds a Release workflow row to the CI overview table, revises release process steps, removes the publish-draft checklist step, and expands rollback guidance to include prerelease/delete options and replacement patch tagging.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• bomly-dev/bomly-cli#170: Updates release-triggered workflows to fire on release: published events, directly complementing this PR's switch from draft to immediately-published GitHub Releases.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Publish releases automatically with native notes' directly captures the main change: transitioning from draft to published releases with GitHub-native notes integration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/automatic-release-publishing

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Bomly Diff Summary

Compared 2d819009841cdbfd6dfa2d67884c07712e85213f to c75b4e5c4c458320194830e38101feecd5087ad7.

Overview

Status	Manifests	Dependencies	Findings	Duration
✅ Pass	+0 / ~0 / -0	+0 / ~0 / -0	0 introduced / 0 persisted / 0 resolved	68159ms

Dependency Changes

✅ No dependency changes.

Vulnerabilities

✅ No vulnerability changes.

License Changes

✅ No license changes.

Project Posture

✅ No project posture changes (or --matchers +scorecard was not selected).

Policy Findings

✅ No policy differences were identified.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/ARCHITECTURE.md`:
- Line 195: The behavior change at line 195 describing Semver tags running
GoReleaser is documented, but the design rationale for why Auto Version tag
creation serves as the manual approval gate is not captured in the decision log
section of the ARCHITECTURE.md file. Add a decision-log entry in
docs/ARCHITECTURE.md that explicitly documents this non-obvious design choice,
explaining that Auto Version tag creation is the designated manual approval gate
for the release workflow and why this design decision was made. This ensures
future developers understand the intentional release approval boundary without
having to infer it from the behavior description alone.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8fc4a4c4-cf2a-45cc-b496-b2988a82121d

📥 Commits

Reviewing files that changed from the base of the PR and between 2d81900 and 841a13a.

📒 Files selected for processing (4)

• .goreleaser.yaml
• docs/ARCHITECTURE.md
• docs/development/CI.md
• docs/development/RELEASE_CHECKLIST.md

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add a decision-log entry for the release approval boundary change.

At Line 195, the behavior change is documented, but the non-obvious design choice (“Auto Version tag creation is the manual approval gate”) is not captured in the Architecture decision log.

As per coding guidelines, "Update docs/ARCHITECTURE.md with pipeline diagram changes when the stage list changes and add decision-log entries for non-obvious design choices."

Suggested doc addition

+### Decision: Tag creation is the manual release approval gate
+
+The manual approval boundary for releases is running `Auto Version`, which creates the semver tag.
+After release-workflow validation, GoReleaser publishes the GitHub Release automatically so package-manager PRs can reference public assets and checksums immediately.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/ARCHITECTURE.md` at line 195, The behavior change at line 195 describing
Semver tags running GoReleaser is documented, but the design rationale for why
Auto Version tag creation serves as the manual approval gate is not captured in
the decision log section of the ARCHITECTURE.md file. Add a decision-log entry
in docs/ARCHITECTURE.md that explicitly documents this non-obvious design
choice, explaining that Auto Version tag creation is the designated manual
approval gate for the release workflow and why this design decision was made.
This ensures future developers understand the intentional release approval
boundary without having to infer it from the behavior description alone.

Source: Coding guidelines