[TomOnTime]

Implements the release-automation design from #4829. Draft — needs review, the one-time repo settings below, and a live dry-run before it goes live.

Model

• Contributor PRs squash-merge into develop with Conventional-Commit titles (enforced).
• A human opens + merges develop → main as a merge commit to cut a release (this is the only manual step).
• The push to main triggers full automation: svu computes the next semver → tag → GoReleaser publishes.

What's here

• pr_conventional_title.yml — enforces Conventional-Commit PR titles on PRs into develop (amannn/action-semantic-pull-request@v6). Types that release: feat→minor, fix→patch, !/BREAKING→major. chore/ci/docs/…→no release.
• release_gate.yml — runs the full longtest suite as a required check on develop → main PRs; a skip-longtest label is an auditable emergency bypass (single always-running release-gate check so branch protection never sticks on a skipped job).
• release_on_merge.yml — on push to main: svu → tag → GoReleaser. Skips entirely if nothing releasable landed. Gated behind the AUTO_RELEASE_ENABLED repo variable so this PR can merge dormant.
• .goreleaser.yml — draft: false (auto-publish), and the hand-maintained provider-name regexp is replaced by a permanent p/<name> scope rule (fix(p/route53): …) → no per-provider list to maintain ever again.
• release-engineering.md — rewritten around the new flow; manual dispatch/tag escape hatch and all Tips preserved.

Provider changelog: how the giant regexp went away

Provider changes use the p/<name> scope. The changelog group is now a permanent one-liner. Because the type stays feat/fix, svu and the title-linter need zero special knowledge. I verified GoReleaser's routing end-to-end (matching is by list order, display by order):

### Breaking changes:        fix(p/route53)!, feat!
### New features:            feat, feat(core)
### Provider-specific:       feat(p/route53), fix(p/bind), perf(p/bind)
### Bug fixes:               fix, fix(spf)
### Documentation:           docs, docs(p/route53)
### CI/CD:                    build, ci
### Dependencies:            chore(deps)
### Deprecation warnings:    chore: deprecate ...
### Other:                    refactor, chore

Validation done

• svu bump semantics probed on a scratch repo (chore/ci/docs → no bump; fix→patch; feat→minor; !→major).
• GoReleaser changelog routing tested end-to-end on a scratch repo (table above).
• goreleaser check passes on the real .goreleaser.yml; all workflows pass actionlint.

⚠️ Not yet validated / needs a live dry-run

The workflows only run in GHA. Before enabling: cut a throwaway -rc (or run on a fork) to confirm release_on_merge tags + GoReleaser publishes correctly.

One-time rollout (settings + order)

1. Create develop from main; point contributions at it.
2. Repo settings: squash-merge uses PR title; enable merge commits (for develop→main) and squash (for feature PRs); create the skip-longtest label.
3. Branch protection: require release-gate on main; require PR: Conventional title on develop.
4. Merge this PR (lands dormant — AUTO_RELEASE_ENABLED unset).
5. When ready, set repo variable AUTO_RELEASE_ENABLED=true and do a controlled first develop→main release.

Note: the existing release_draft.yml (dispatch / tag push) stays as the manual escape hatch. There's some GoReleaser-step overlap between it and release_on_merge.yml; happy to DRY it into a workflow_call reusable in a follow-up once this is proven.

🤖 Generated with Claude Code

---

Update: one-command releases + auto-merge

• bin/auto_release.sh opens/reuses the develop → main PR and enables GitHub auto-merge (as a merge commit, never squash). Once the release-gate passes, GitHub merges automatically and the release publishes — the only human action is running the script. Flags: -y, -w (watch), --skip-longtest (emergency).
• No Release vX.Y.Z commit is needed: the version is computed by svu and lives only in the tag; the merge commit is filtered out of the changelog.
• Extra one-time setting: enable "Allow auto-merge"; for zero clicks, main protection should require release-gate but not a review approval.

[cafferata]

@TomOnTime FYI: #4899 updates the contributor docs for the Conventional Commits titles (CONTRIBUTING.md, the pull request template, the requested provider guide and the GitHub Actions overview). I left documentation/release/release-engineering.md out because this pull request rewrites it. Together they cover the list in #4266.

One thing I noticed: this pull request adds .github/workflows/pr_conventional_title.yml, while .github/workflows/pr_commitlint.yml from #4873 already lints the pull request title against commitlint.config.js. Is the plan to replace pr_commitlint.yml, or to run both? If it replaces it, I'll update the check name in documentation/developer-info/github-actions.md and CONTRIBUTING.md (#4899 now refers to PR: Commitlint).

[TomOnTime]

FYI: I've decided that the develop -> main split adds complexity without much benefit. See #4829 (comment)

As far as .github/workflows/pr_conventional_title.yml, we only need to check the title once. Remove pr_commitlint.yml

I'm not sure what release process I want at this time.

[cafferata]

@TomOnTime agreed, one title check is enough. Before removing pr_commitlint.yml, note that the two checks aren't interchangeable yet:

• pr_conventional_title.yml in this pull request only runs when the base branch is develop (if: github.base_ref == 'develop'), so without develop it wouldn't check pull requests to main at all.
• It only checks the type. The p/PROVIDER scope rule and the lowercase subject from commitlint.config.js aren't covered, and the type list differs (revert instead of style and BREAKING CHANGE).
• The contributor docs from docs: describe the conventional commits pull request titles #4899 describe the PR: Commitlint check and npx commitlint for local checks, and package.json has the commitlint dev dependencies (chore(deps): update commitlint to v21 #4900).

Which one would you like to keep? If it's pr_commitlint.yml, this pull request can drop pr_conventional_title.yml. If it's pr_conventional_title.yml, I'll update the docs and package.json once it runs on main.

[TomOnTime]

Closing this PR. Until I know what I want, it doesn't make sense to leave this open.