[codex] add release-plz automation

[ScriptedAlchemy]

Summary

Adds a working stable release pipeline for TraceDecay.

What this does

• Release-plz runs on pushes to master.
• It opens/updates the actual release PR with the next crate version and changelog.
• When that release PR is merged, release-plz publishes the tracedecay crate and creates the vX.Y.Z GitHub Release.
• The existing Release workflow runs from the published GitHub Release and builds/uploads binaries.
• Windows artifacts are unsigned zip files; SignPath is intentionally not required.
• Release assets use GitHub artifact attestations on real releases.
• Homebrew and Scoop update jobs target ScriptedAlchemy/homebrew-tap and ScriptedAlchemy/scoop-bucket.
• server.json update behavior is kept.
• npm is only used to build dashboard assets; there is no npm package publish in this repo.

Setup Done

• Repository Actions workflow permissions are set to write.
• Actions PR creation/approval is enabled.
• RELEASE_PLZ_TOKEN secret is set.
• CARGO_REGISTRY_TOKEN secret is set as the bootstrap crates.io publish fallback.
• TAP_GITHUB_TOKEN secret is set.
• ScriptedAlchemy/homebrew-tap exists and is initialized.
• ScriptedAlchemy/scoop-bucket exists and is initialized.
• GitHub environment crates-io exists.

Follow-up After Merge

• Configure crates.io Trusted Publishing for GitHub Actions: ScriptedAlchemy/tracedecay, workflow release-plz.yml, environment crates-io.
• After Trusted Publishing is active, remove CARGO_REGISTRY_TOKEN from release-plz.yml and delete the repo secret.

No Longer Required

• SIGNPATH_API_TOKEN
• SIGNPATH_ORGANIZATION_ID
• SignPath project/policy setup
• npm publishing/provenance setup

Validation

• Parsed release-plz.yml and release.yml as YAML.
• Parsed release-plz.toml as TOML.
• Ran git diff --check.
• Ran actionlint on release.yml and release-plz.yml.
• Ran gitleaks on this PR diff: no leaks found.
• Ran cd dashboard && npm ci && npm run build.
• Ran cargo publish --dry-run --allow-dirty: packaged tracedecay v0.0.2 successfully and stopped before upload because it was a dry run.
• Ran release-plz release --dry-run; it correctly returned no releases for this automation PR because this PR is not the generated release PR.
• Manual Release workflow dry run is in progress on this branch.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 468ca1b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 468ca1b950

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Make dashboard-only edits open release PRs

When a change only touches tracked dashboard UI sources under dashboard/*/src/**, this release-pr job will not bump a version because release-plz opens PRs from changed packaged crate files; this crate’s whitelist ships generated dashboard/*/dist/** assets instead, and those files are gitignored/not committed. The release job later builds those assets before publishing, so dashboard-only fixes do affect the published crate but can be stranded with no release PR until some Rust/package file changes.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Don’t document dispatch as a recovery path

If the follow-up release event is missed, manually dispatching Release against the tag will not repair it: .github/workflows/release.yml treats workflow_dispatch as a dry run (dry-run-${GITHUB_SHA::7}) and all upload/update jobs are still gated on github.event_name == 'release', so this instruction only rebuilds local dry-run archives and leaves the GitHub release assets and package-manager manifests unchanged.

Useful? React with 👍 / 👎.