ci(release): make every version tag-driven and fix the dev channel

.github/actions/setup-env/action.yml

@@ -196,7 +196,7 @@ runs:
 
     # pnpm must install before its cache step so the store path can be
     # resolved from pnpm itself.
-    - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+    - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       if: ${{ inputs.node == 'true' }}
       with:
         version: "11.1.3"
@@ -247,7 +247,7 @@ runs:
         restore-keys: |
           astro-${{ runner.os }}-
 
-    - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       if: ${{ inputs.node == 'true' }}
       with:
         node-version-file: ".nvmrc"

.github/dependabot.yml

@@ -13,6 +13,16 @@ updates:
       prefix: "deps"
 
   # GitHub Actions
+  #
+  # TWO entries, because `directory: /` does NOT mean "the whole repo" for
+  # this ecosystem: it means `.github/workflows/` plus an `action.yml` in the
+  # repo ROOT. Composite actions in subdirectories are invisible to it. Ours
+  # lives at `.github/actions/setup-env/action.yml`, so its pins silently
+  # rotted while the workflow pins advanced around them — by the time this was
+  # noticed it was two versions behind on `pnpm/action-setup` and a major
+  # behind on `actions/setup-node` versus the identical actions in
+  # `publish-npm.yml`. Adding a composite action under `.github/actions/`
+  # means adding an entry here; nothing else will catch the drift.
   - package-ecosystem: github-actions
     directory: /
     schedule:
@@ -27,6 +37,17 @@ updates:
     commit-message:
       prefix: "ci"
 
+  - package-ecosystem: github-actions
+    directory: /.github/actions/setup-env
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      actions-deps:
+        patterns: ["*"]
+    commit-message:
+      prefix: "ci"
+
   # TypeScript packages (npm via pnpm workspace).
   #
   # ONE entry at the workspace ROOT — deliberately NOT one per member

.github/release.yml

@@ -0,0 +1,103 @@
+# GitHub's auto-generated release notes — the body of every GitHub Release.
+#
+# GoReleaser hands the body to GitHub (`changelog.use: github-native` in
+# .goreleaser.yaml), and GitHub builds it from the PRs merged since the previous
+# tag. main is squash-merged, so one PR is one line, titled with its
+# Conventional Commit subject. This file is the only knob on that output — the
+# `changelog.filters` in .goreleaser.yaml do not apply.
+#
+# Categories are matched by PR LABEL, top to bottom, first match wins; `*` is a
+# catch-all for whatever the categories ABOVE it did not take. So a category is
+# only as good as its labels: `github_actions` / `documentation` / `go` /
+# `dependencies` are applied automatically by actions/labeler (path-based, see
+# labeler.yml), while `breaking-change`, `security`, `bug`, and `enhancement`
+# are applied by hand during triage — label the PR, or it lands in "Other
+# changes".
+#
+# THE INVARIANT: every category keyed on a label that a DEPENDABOT PR CAN CARRY
+# must have the Dependabot author exclude. Dependabot is separated by author
+# rather than by label, and the final `*` category is what collects it — so any
+# earlier category matching one of those labels intercepts bumps before they
+# get there. Two sources feed that set, and checking only the first is not
+# enough: labeler's path labels (`documentation`, `github_actions`, `go`,
+# `dependencies`, `area/*`) AND the ecosystem labels Dependabot applies itself
+# (`dependencies`, `javascript`, `go`, `github_actions` — `javascript` is not
+# in labeler.yml at all). Two labels are load-bearing today, and both bit:
+#
+#   github_actions  labeler maps .github/workflows/** and .github/actions/**,
+#                   so it marks our own CI PRs, not just Dependabot's action
+#                   bumps (#446 is a hand-written CI PR carrying it). Excluding
+#                   the LABEL from the catch-all filed all our CI work under
+#                   Dependencies; dropping it instead empties that category,
+#                   because Dependabot's action bumps carry `github_actions`
+#                   and NOT `dependencies` (#480, #412, #341).
+#   documentation   labeler maps docs/**, and the npm Dependabot config points
+#                   at the workspace root, so every npm bump touches
+#                   docs/package.json and gets labelled. Count only MERGED PRs
+#                   here — an open or superseded bump never reaches a release
+#                   body, and npm group bumps are routinely superseded before
+#                   merge: 3 of the 23 Dependabot PRs merged to date carry it
+#                   (#439, #416, #342). A bump or two per release rather than a
+#                   flood, but the exclude costs nothing and the ratio grows
+#                   with the npm surface.
+#
+# `security` deliberately has NO author exclude: a Dependabot bump that a
+# maintainer hand-labels `security` is a security fix and belongs at the top,
+# not buried under Dependencies.
+#
+# This routing cannot be linted locally. Dry-run it against real history before
+# cutting a release:
+#   gh api -X POST repos/Wave-RF/WaveHouse/releases/generate-notes \
+#     -f tag_name=vX.Y.Z -f target_commitish=main --jq .body
+changelog:
+  exclude:
+    labels:
+      - duplicate
+      - invalid
+      - wontfix
+  categories:
+    # Ordered by what a reader upgrading needs to see first. `!` in the PR title
+    # marks the breaking change per Conventional Commits; the label is what puts
+    # it at the top of the notes.
+    - title: ⚠️ Breaking changes
+      labels: [breaking-change]
+    - title: 🔒 Security
+      labels: [security]
+    - title: ✨ Features
+      labels: [enhancement]
+    - title: 🐛 Bug fixes
+      labels: [bug]
+    # ABOVE Documentation deliberately. First match wins, and our CI PRs carry
+    # BOTH labels — AGENTS.md requires a doc update with every change, so a CI
+    # PR almost always touches docs/** or README.md too. Of the last 12 human
+    # PRs carrying `github_actions`, 10 also carry `documentation` (only #446
+    # and #283 do not), so with Documentation first this category is dead on
+    # arrival and Documentation fills with `ci:` PRs.
+    #
+    # It is a trade, not a free win, and the cost side is real: a docs PR that
+    # also edits a workflow now files here. In that same window #290
+    # (`feat(docs): live-demo hero panel`) and #277 (`feat(docs): prod-faithful
+    # dev loop`) both would, as would #187 and #193 further back. Counting only
+    # PRs that reach these two categories: ~7 genuine CI PRs rescued from
+    # Documentation against ~2-4 docs PRs misfiled as CI. Worth it because the
+    # CI population is the one that grows, but re-check the balance before
+    # copying this decision forward.
+    - title: 🔧 CI & build
+      labels: [github_actions]
+      exclude:
+        authors: [dependabot, "dependabot[bot]"]
+    - title: 📚 Documentation
+      labels: [documentation]
+      exclude:
+        authors: [dependabot, "dependabot[bot]"]
+    - title: 🧹 Other changes
+      labels: ["*"]
+      exclude:
+        authors: [dependabot, "dependabot[bot]"]
+    # Last, so a long Dependabot run never buries the changes people actually
+    # care about. `*` rather than a label list: everything reaching this point
+    # has already been excluded from the categories above by author, so this is
+    # exactly the Dependabot set — and a bump that somehow carried none of the
+    # dependency labels still gets listed instead of dropped.
+    - title: 📦 Dependencies
+      labels: ["*"]

.github/workflows/publish-dev.yml

@@ -11,9 +11,11 @@ name: Publish dev image
 # Release.
 #
 # Real tagged releases (`v*`) flow through release.yml against the
-# same .goreleaser.yaml without WAVEHOUSE_DEV set, producing
-# `:vX.Y.Z` + `:latest`. Cleanup of old dev-<sha> tags is handled
-# by cleanup-ghcr.yml.
+# same .goreleaser.yaml without WAVEHOUSE_DEV set, producing `:vX.Y.Z`
+# plus a moving channel pointer — `:latest` for a stable tag, but
+# `:alpha`/`:beta`/`:rc`/`:next` for a prerelease, which therefore never
+# touches `:latest`. Cleanup of old dev-<sha> tags is handled by
+# cleanup-ghcr.yml.
 #
 # The TypeScript SDK publishes separately — see publish-npm.yml.
 on: