ci: let release tags actually trigger a release

[huyplb]

Tagging a release has been a no-op since v0.2.73. v0.2.111 and v0.2.220 were both tagged and pushed; neither fired Release Gate, npm Publish or Web Release. Zero workflow runs, and no error anywhere to notice — today's release only went out because I dispatched each workflow by hand.

Cause

A release tag lands on the version-bump commit, and that commit's message ends in [skip ci]. GitHub honours that marker for every push event touching the commit — a tag push included — so it suppressed the release along with the branch build it was meant to skip.

Tag	Tagged commit	Fired?
v0.2.220	chore: bump version to 0.2.220 **[skip ci]**	✗
v0.2.111	chore: bump version to 0.2.111 **[skip ci]**	✗
v0.2.73	fix(web): list all providers… (0.2.73)	✓

The marker was not preventing the loop

The bump job already refuses to bump its own commit:

if: !startsWith(github.event.head_commit.message, 'chore: bump version') && …

[skip ci] only saved CI on a commit that changes four version fields and nothing else. So the saving moves somewhere it cannot take releases down with it: each push-triggered workflow now skips bump commits by message.

if: >-
  github.event_name != 'push'
  || !startsWith(github.event.head_commit.message, 'chore: bump version')

• github.event_name != 'push' keeps pull_request runs untouched — without it this would disable PR checks on any branch whose head commit happened to be a bump.
• Applied only to the five branches: [main] workflows. The three tag workflows are deliberately left unguarded — that is the whole point.

Verification, and its limit

This PR's own checks verify half of it: they run on pull_request, so a green run proves the guard does not skip PR builds.

The other half is not provable here. Nothing in CI can push a tag, so "a tag now fires a release" is only confirmed by the next real tag. Worth knowing before treating a green tick as proof — that assumption is exactly what let this sit broken across two releases.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes release and CI gating behavior; wrong if: logic could skip PR checks or re-run heavy jobs on bump commits, but tag releases should work again.

Overview
Fixes silent release failures caused by [skip ci] on version-bump commits. GitHub applies that marker to every push for the commit, including tag pushes, so Release Gate, npm Publish, and Web Release never ran for tags like v0.2.111 and v0.2.220.

version-bump.yml now commits with chore: bump version to $V only (no [skip ci]), with comments documenting why.

Push-to-main workflows (build-gate, CodeQL, dependency security, deps backdoor scan, secret scan) gain a shared job if: so branch pushes whose head message starts with chore: bump version skip CI, while pull_request runs are never skipped. Tag-triggered release workflows stay unguarded so tags on bump commits can run releases again.

^{Reviewed by Cursor Bugbot for commit 7052c4c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_d86567a1-818b-49d3-9606-bd508b377773)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_c9d25f86-b270-4c12-9daf-97b31bf023de)