Timeline

Mechanizes the multi-step release flow that today is hand-driven via: 1. tag leaf submodule, push 2. open chore/bump-leaf PR, merge 3. tag root, push (fires release.yml + bones dispatch)

scripts/release.sh detects which submodules have changes since their last <name>/v* tag, computes next versions (patch by default; --bump= minor|major), tags and pushes them, rewrites the matching require pin in root go.mod, commits straight to main as github-actions[bot], then tags the next root v* and pushes — firing release.yml.

Local invocation prompts before each push so the operator can intervene. Workflow invocation (auto-release.yml) passes --ci to suppress prompts and uses the bot identity. --dry-run reports the plan without touching anything.

Direct-to-main bot commits is the right tradeoff here: the change is deterministic robot work (one-line go.mod edit derived from the just- tagged version) and avoiding a PR round-trip lets a release ship in a single workflow run rather than coordinating across two. If branch protection blocks the github-actions bot, configure RELEASE_PUSH_TOKEN as a fine-grained PAT with contents:write.

Side observation: dry-run flags that bridge/ has unreleased changes since bridge/v0.0.2 (libfossil bump + README), so the next auto-release run will tag bridge/v0.0.3 alongside whatever else changes. check-in: 8414300b13 user: [email protected] tags: trunk

docs: Hugo+hextra docs site with Cloudflare Workers deploy check-in: d59e2dece9 user: [email protected] tags: trunk, v0.0.2