ci: address CodeRabbit pre-existing review findings

- claude.yml: scope pull-requests: write to a dedicated coderabbit_review
  job; claude job now has pull-requests: read only
- release-tags.yml: replace brittle startsWith(head_commit.message) +
  HEAD~1 with github.event.before via env var; no-op on initial push
- goreleaser.yaml: add skip_push: auto to alias manifests (Major.Minor,
  Major, latest) so prereleases don't update floating tags
- sync-chart-appversion.sh: add explicit argument guard with usage message

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: michaelmcnees

.github/scripts/sync-chart-appversion.sh

@@ -4,6 +4,11 @@ set -euo pipefail
 # Usage: sync-chart-appversion.sh <engine-version>
 # Example: sync-chart-appversion.sh 0.4.1
 
+if [[ -z "${1-}" ]]; then
+  echo "Usage: sync-chart-appversion.sh <engine_version>" >&2
+  exit 1
+fi
+
 ENGINE_VERSION="$1"
 CHART_FILE="packages/helm-chart/Chart.yaml"
 

.github/workflows/claude.yml

@@ -25,7 +25,7 @@ jobs:
     timeout-minutes: 30
     permissions:
       contents: read
-      pull-requests: write
+      pull-requests: read
       issues: read
       id-token: write
       actions: read
@@ -43,20 +43,23 @@ jobs:
           additional_permissions: |
             actions: read
 
-      - name: Request CodeRabbit re-review
-        if: >-
-          steps.claude.outcome == 'success' && (
-            github.event.issue.pull_request ||
-            github.event_name == 'pull_request_review_comment' ||
-            github.event_name == 'pull_request_review'
-          )
+  coderabbit_review:
+    name: Request CodeRabbit Re-review
+    needs: claude
+    if: >-
+      needs.claude.result == 'success' && (
+        github.event.issue.pull_request != null ||
+        github.event_name == 'pull_request_review_comment' ||
+        github.event_name == 'pull_request_review'
+      )
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Post CodeRabbit review request
         env:
           GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: >-
-            ${{
-              github.event.issue.number ||
-              github.event.pull_request.number
-            }}
+          PR_NUMBER: ${{ github.event.issue.number || github.event.pull_request.number }}
         run: |
           gh pr comment "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" \
             --body "@coderabbitai review"

.github/workflows/release-tags.yml

@@ -15,38 +15,51 @@ jobs:
   tag:
     name: Create Package Tags
     runs-on: ubuntu-latest
-    # Only run on Version PR merges
-    if: "startsWith(github.event.head_commit.message, 'ci: version packages')"
     steps:
       - uses: actions/checkout@v4
         with:
-          fetch-depth: 2
+          fetch-depth: 0
 
       - name: Detect version bumps
         id: bumps
+        env:
+          BASE_SHA: ${{ github.event.before }}
+          HEAD_SHA: ${{ github.sha }}
         run: |
           ENGINE_BUMPED=false
           HELM_BUMPED=false
           SITE_BUMPED=false
 
+          # No-op on initial push or when base equals HEAD (no changes to compare)
+          if [[ "$BASE_SHA" == "0000000000000000000000000000000000000000" || "$BASE_SHA" == "$HEAD_SHA" ]]; then
+            echo "No base commit to compare against; skipping version detection"
+            echo "engine_bumped=false" >> "$GITHUB_OUTPUT"
+            echo "engine_version=$(jq -r '.version' packages/engine/package.json)" >> "$GITHUB_OUTPUT"
+            echo "helm_bumped=false" >> "$GITHUB_OUTPUT"
+            echo "helm_version=$(jq -r '.version' packages/helm-chart/package.json)" >> "$GITHUB_OUTPUT"
+            echo "site_bumped=false" >> "$GITHUB_OUTPUT"
+            echo "site_version=$(jq -r '.version' packages/site/package.json)" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
           # Check engine version bump
-          ENGINE_OLD=$(git show HEAD~1:packages/engine/package.json 2>/dev/null | jq -r '.version' 2>/dev/null || echo "")
+          ENGINE_OLD=$(git show "${BASE_SHA}:packages/engine/package.json" 2>/dev/null | jq -r '.version' 2>/dev/null || echo "")
           ENGINE_NEW=$(jq -r '.version' packages/engine/package.json)
           if [[ -n "$ENGINE_OLD" && "$ENGINE_OLD" != "$ENGINE_NEW" ]]; then
             echo "Engine version bumped: $ENGINE_OLD -> $ENGINE_NEW"
             ENGINE_BUMPED=true
           fi
 
           # Check helm-chart version bump
-          HELM_OLD=$(git show HEAD~1:packages/helm-chart/package.json 2>/dev/null | jq -r '.version' 2>/dev/null || echo "")
+          HELM_OLD=$(git show "${BASE_SHA}:packages/helm-chart/package.json" 2>/dev/null | jq -r '.version' 2>/dev/null || echo "")
           HELM_NEW=$(jq -r '.version' packages/helm-chart/package.json)
           if [[ -n "$HELM_OLD" && "$HELM_OLD" != "$HELM_NEW" ]]; then
             echo "Helm chart version bumped: $HELM_OLD -> $HELM_NEW"
             HELM_BUMPED=true
           fi
 
           # Check site version bump
-          SITE_OLD=$(git show HEAD~1:packages/site/package.json 2>/dev/null | jq -r '.version' 2>/dev/null || echo "")
+          SITE_OLD=$(git show "${BASE_SHA}:packages/site/package.json" 2>/dev/null | jq -r '.version' 2>/dev/null || echo "")
           SITE_NEW=$(jq -r '.version' packages/site/package.json)
           if [[ -n "$SITE_OLD" && "$SITE_OLD" != "$SITE_NEW" ]]; then
             echo "Site version bumped: $SITE_OLD -> $SITE_NEW"

packages/engine/.goreleaser.yaml

@@ -68,14 +68,17 @@ docker_manifests:
     image_templates:
       - "ghcr.io/dvflw/mantle:{{ .Version }}-amd64"
       - "ghcr.io/dvflw/mantle:{{ .Version }}-arm64"
+    skip_push: auto
   - name_template: "ghcr.io/dvflw/mantle:{{ .Major }}"
     image_templates:
       - "ghcr.io/dvflw/mantle:{{ .Version }}-amd64"
       - "ghcr.io/dvflw/mantle:{{ .Version }}-arm64"
+    skip_push: auto
   - name_template: "ghcr.io/dvflw/mantle:latest"
     image_templates:
       - "ghcr.io/dvflw/mantle:{{ .Version }}-amd64"
       - "ghcr.io/dvflw/mantle:{{ .Version }}-arm64"
+    skip_push: auto
 
 release:
   github: