[viceice]

Changes

• Replace the @semantic-release/exec commands with a local plugin tools/semantic-release-plugin.js, drop the release:prepare / release:publish scripts.
• prepare builds the cli, archives and images, publish pushes the images.
• Sign the images in success, so after the npm publish. A failed signing no longer fails the release, it logs an error and adds a ::error annotation to the run.
• Failing commands throw a one-line error without stack, their output is already in the log once.
• Run the commands with execa and inherited output instead of shelljs.
• First of three: build: replace the exec release commands with a local semantic-release plugin renovatebot/renovate#47563 and build: replace the exec release commands with a local semantic-release plugin renovatebot/base-image#3767 port it once a release here verified it.

Context

Please select one of the following:

• This closes an existing Issue, Closes: #
• This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

Please select one option and, if yes, briefly describe how AI was used (e.g., code, tests, docs) and which tool(s) you used.

• No — I did not use AI for this contribution.
• Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
• Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).
• Yes — other (please describe):

Code written with Claude Code (Claude Opus 5.5).

Use of AI in replying to PR comments

Who answers review comments:

• @viceice will read and reply directly. Name the account.
• An agent will draft replies and @username will read them before they are posted. Name the account.
• An agent will draft replies and reply autonomously. This is heavily discouraged, and we prefer that there are humans in the loop
• Nobody has explicitly committed to replying.

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified tests

🤖 Generated with Claude Code

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML; Path: .coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: d8d32a9d-5a3c-4194-9af4-9effadac20df

Commits

Reviewing files that changed from the base of the PR and between 0b6f954 and 833163b.

Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 5

• .releaserc.json
• package.json
• tools/prepare-release.js
• tools/publish-release.js
• tools/semantic-release-plugin.js

Files with no reviewable changes: 3

• package.json
• tools/prepare-release.js
• tools/publish-release.js

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

Release preparation, image publishing, and image signing now run through a local semantic-release plugin. The release configuration uses the plugin, and the previous release commands and exec-plugin dependency have been removed.

Changes: Release lifecycle

Layer / File(s)	Summary
Release setup and preparation tools/semantic-release-plugin.js, tools/prepare-release.js	The plugin sets release environment variables, builds the project, creates a versioned archive and SHA-512 checksums, and builds images for linux/amd64 and linux/arm64. The previous preparation command is removed.
Image publishing and signing tools/semantic-release-plugin.js, tools/publish-release.js	The plugin pushes images and records the image digest. When a digest is available, it signs image references with and without the ghcr.io prefix. Signing failures are logged and reported without failing the release. The previous publishing command is removed.
Semantic-release configuration .releaserc.json, package.json	The release configuration uses the local plugin. The release:prepare and release:publish scripts and the @semantic-release/exec development dependency are removed.

Priority: Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Other

Sequence Diagram(s)

sequenceDiagram
  participant SemanticRelease as semantic-release
  participant Plugin as semantic-release-plugin.js
  participant DockerBuildx as Docker Buildx
  participant Cosign
  SemanticRelease->>Plugin: call prepare
  Plugin->>DockerBuildx: build multi-platform images
  SemanticRelease->>Plugin: call publish
  Plugin->>DockerBuildx: push images and write build metadata
  DockerBuildx-->>Plugin: return image digest
  SemanticRelease->>Plugin: call success
  Plugin->>Cosign: sign image references when digest exists

Loading

Merge Risk: Minimal · up to 83316

No merge-blocking issue was identified in the release migration.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: replacing the @semantic-release/exec release commands with a local semantic-release plugin.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 5 functions across 1 files. (1 skipped: 1 unsupported.)

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🎉 This PR is included in version 14.57.1 🎉

The release is available on:

• GitHub release
• 14.57.1

Your semantic-release bot 📦🚀