ci: GitHub Actions release pipeline — build & publish .vsix on merge to main

[pajoma]

Summary

• Adds .github/workflows/release.yml triggered on push to main
• Full build + test gate (compile → compile-tests → xvfb-run npm test) before packaging
• Reads version from package.json, tags release v<version>, attaches .vsix as asset
• Uses softprops/action-gh-release pinned to SHA 3bb1273 (reviewed: floating v2 risk noted in plan)

References

• Closes ci: GitHub Actions release pipeline — build & publish .vsix on merge to main #225
• Spec: docs/specs/2026-05-19-225-release-pipeline.md
• Plan: docs/plans/2026-05-19-225-release-pipeline.md

Test plan

• Merge to main → Actions tab shows Release workflow run → GitHub Release v<version> created with .vsix attached
• Introduce compile error → workflow fails before release step → no release created
• Push to develop → Release workflow does NOT trigger (only CI triggers)

🤖 Generated with Claude Code

[pajoma]

Brooks-Lint Review

Mode: PR Review
Scope: .github/workflows/release.yml, docs/plans/*, docs/specs/*
Health Score: 98/100

The PR faithfully implements the release pipeline as per the approved plan and includes thorough documentation for upcoming decoupling tasks.

---

Findings

🟢 Suggestion

Dependency Disorder — Verification of commit SHA for softprops/action-gh-release
Symptom: The workflow uses softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65.
Source: Winters et al. — Software Engineering at Google (Ch. 21: Dependency Management)
Consequence: While pinning to a SHA is a major improvement over a floating tag, ensure this SHA corresponds to the intended v2 release to prevent accidental pinning to a non-stable commit.
Remedy: Add a comment in the YAML (as already done: # v2) to maintain the link between the human-readable version and the immutable SHA.

---

Summary

The implementation of the release pipeline is "Deep" and strategically sound. By pinning the release action to a specific SHA and maintaining a single-job gate, the PR preserves "Conceptual Integrity" while addressing the sustainability concerns raised during the plan review. The addition of specs for issue #202 shows excellent proactive planning for reducing tech debt.