ci: remove semantic-release and replace with explicit versioned workflow steps

[nickolas-dimitrakas]

Background

• semantic-release was doing version determination, changelog generation, package bumping, npm publishing, GitHub release creation, and git commits/tagging — all hidden inside a single npx semantic-release call.
• Phase 1 of this effort (earlier commits) removed scripts/release.sh from the prepareCmd hook and exposed the dist/ build and kit version-bump as named workflow steps.
• This PR completes the decoupling by removing semantic-release entirely and replacing every responsibility with explicit, readable workflow steps.
• Part of the broader effort to separate release work from deploy work and move toward a transparent, operator-friendly release process (follow-up to feat: update release process #1210).

What Changed

• release.config.js: deleted
• Both staging-step-1.yml and release.yml:
  • Added bump_type input (patch / minor / major) to workflow_dispatch — this is now how the release version is determined
  • Replaced npx semantic-release --dry-run with a Calculate next version step that runs npm version $bump_type --no-git-tag-version and exposes the result to all downstream steps
  • Replaced npx semantic-release with four explicit named steps:
    1. Commit package.json version bump — stages and commits package.json + package-lock.json
    2. Create release tag — git tag vX.Y.Z
    3. Publish SDK to npm — npm publish (OIDC unchanged)
    4. Create GitHub release — gh release create with the same dist assets as before
  • Push step extended to also push the git tag
  • Removed the semantic-release-only job-level env block (GITHUB_TOKEN, GIT_AUTHOR_*, GIT_COMMITTER_*); git identity is set by the Import GPG Key step
• release.yml permissions updated from contents: read to contents: write (required to push the tag)

Checklist

• I have performed a self-review of my own code.
• I have made corresponding changes to the documentation.
• I have added tests that prove my fix is effective or that my feature works.
• I have tested this locally.

Additional Notes

• CHANGELOG.md auto-generation (previously @semantic-release/changelog) is deferred — updates will be manual until a replacement script is introduced.
• steps.get-version.outputs.version is preserved as the step ID and output name, so the release-kits job in staging-step-1.yml continues to work without changes.

Reference Issue (For employees only. Ignore if you are an outside contributor)

• Closes NO JIRA
• Follow-up to feat: update release process #1210

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

[cursor]

Build runs before version bump, embedding stale sdkVersion

High Severity

The npm run build step now runs before npx semantic-release, but the build reads version from package.json (via src/constants.ts line 1: import { version } from '../package.json') and embeds it as sdkVersion. Previously, release.sh ran inside semantic-release's prepareCmd, which executes after @semantic-release/npm bumps package.json. Now the build uses the old, pre-bump version, so every release ships dist files reporting the previous release's sdkVersion in all API requests (batch uploads, identity calls).

Additional Locations (1)

• release.config.js#L43-L45

 

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud