Cut v0.7.0 #150

Why this issue exists

Nerva's latest release is still v0.6.0 (2026-05-15). origin/main is at 57b39a9 with 36 commits since that tag, CI green (the 10/5 run passed 12/12 after the Actions incident re-run). Visitors see a stale release while ten features and two fixes sit unreleased. This issue collects everything needed to cut v0.7.0; the cut itself happens only on Paul's explicit go.

What the dry run says (2026-10-07)

Run in a throwaway worktree of origin/main with pnpm install --frozen-lockfile and pnpm release:dry (commit-and-tag-version 13.1.2, the version currently locked):

• Auto-detection proposes 0.6.1, not 0.7.0. The package is still below 1.0, and under conventional-commits pre-major rules a feat commit bumps the patch number. To get 0.7.0 the bump has to be explicit: pnpm release:minor (which is commit-and-tag-version --release-as minor). A workflow dispatch with release_type: auto would tag v0.6.1.
• Hidden types stay out of the changelog as expected: the six docs: guides, the chore(deps) and ci(deps) bumps, the stale-workflow removal and the labeler bump are not listed. The two docs guides and the five deployment-target features are the headline items for the plain-language summary later.

Generated changelog section (only the heading changes with --release-as minor):

0.6.1 (2026-10-07)

Features

• add all-contributors recognition system (#115) (b18f0c2), closes #58
• add AWS Lambda deployment target (#116) (c05990b)
• add blog API Node.js/Docker example (#121) (35702f8), closes #19
• add Fly.io deployment target (#30) (#118) (ab3b3c5)
• add multi-tenant SaaS template (--multi-tenant) (#133) (a068b72)
• add Railway deployment target (#117) (f8b549d)
• adopt cross-repo tooling (migration safety, hooks, config schema, verify-all) (#141) (3265a5d)
• scripts: add Postman collection generation to project setup (#112) (cf8e8a5), closes #59
• soft-delete: implement soft delete query filter, helper, and route pattern (#103) (04fac4d)
• tdd-from-schema: generate response schema snapshot tests (#98) (b7c8436), closes #47
• templates: add faker-backed test fixture factories to generated projects (#143) (3cdc90b), closes #26

Bug Fixes

• opt generated projects into @types globals per target (TS 6) (#120) (88f24f8), closes #119
• soft-delete: make softDelete() callable with a typed db client (#104) (18e894f), references #53 #103

Dependabot state after the 10/5 sweep

• Merged: ci(deps): bump actions/setup-node from 6 to 7 #144 actions/setup-node 6 to 7 (57b39a9, the current main).
• Open, both green on 2026-10-05 and today: chore(deps): bump the minor-and-patch group across 1 directory with 3 updates #147 (minor-and-patch group: @commitlint/cli and config-conventional 21.2.3, commit-and-tag-version 13.1.2 to 13.2.1) and chore(deps): bump vitest from 4.1.11 to 5.0.3 #145 (vitest 4.1.11 to 5.0.0). Both are tracked in chore(deps): land the two open Dependabot npm PRs (#147 minor-and-patch, #145 vitest 5) and settle Node 20 in release.yml #149 for this repo's coding agent. Both branches carry a manual merge commit, so @dependabot rebase is refused; use @dependabot recreate or merge as is.
• Order matters for the changelog: commit-and-tag-version 13.2.1 "brings back the blank line between release notes sections", so merging chore(deps): bump the minor-and-patch group across 1 directory with 3 updates #147 before the cut means the v0.7.0 section is rendered by the version used from then on. If chore(deps): bump the minor-and-patch group across 1 directory with 3 updates #147 lands first, re-run the dry run; the content above does not change, only the spacing.
• .github/workflows/release.yml still runs on Node 20 while commit-and-tag-version 13.x declares engines.node >=22 (chore(deps): land the two open Dependabot npm PRs (#147 minor-and-patch, #145 vitest 5) and settle Node 20 in release.yml #149 has the details). pnpm only warns, but the Node line should move to 22 in whichever workflow is used for the cut.

Do not dispatch the current release.yml

The workflow is single-stage: it runs pnpm release on the runner, then git push --follow-tags origin main with GITHUB_TOKEN. Nerva's main carries the PR-only ruleset (17364122, bypass actor PAMulligan only), so the push is rejected after the tag ref has already been created, exactly the failure Aurelius hit in PMDevSolutions/Aurelius#121. Dispatching it would leave a stray tag and no release.

Two ways to cut it (Paul picks one)

Option A: port the two-stage workflow first, then dispatch. PMDevSolutions/Aurelius#129 (merged 2026-09-13) replaced the same single-stage file with a two-stage flow: workflow_dispatch runs prepare, which bumps package.json and CHANGELOG.md on a release/vX.Y.Z branch and opens a PR titled chore(release): vX.Y.Z; merging that PR to main runs publish, which tags the merge commit and creates the GitHub Release from the CHANGELOG section. It also fixed the pnpm release -- --release-as flag mangling by calling pnpm exec commit-and-tag-version directly, added scripts/extract-release-notes.js --version, regression tests, and a dry_run input. Porting it to Nerva means copying release.yml, the extract script and its tests, setting Node 22, and adding a RELEASE_TOKEN fine-grained PAT secret (Contents and Pull requests write) so the release PR triggers CI; without the secret the PR has to be closed and reopened once. Then dispatch prepare with release_type: minor, review the release PR, merge, and publish runs by itself. This is the durable fix and makes every later release a two-click affair.

Option B: manual cut with the bypass. On a clean main checkout (not the feature branch in ~/Repos/Nerva): git pull --ff-only, pnpm install --frozen-lockfile, pnpm release:minor, check the diff, git push --follow-tags origin main (the ruleset bypass covers it), then gh release create v0.7.0 --title v0.7.0 --notes-file <the 0.7.0 section of CHANGELOG.md>. Fastest path today; the workflow stays broken for next time.

Either way the release notes get no em dashes, and after the cut a plain-language summary of what changed goes to the Roman Engineering issue on 10/13, the LinkedIn slot the same day, and the 10/23 Patreon post.

🤖 Generated with Claude Code