ci: let release tags actually trigger a release

.github/workflows/build-gate.yml

@@ -23,6 +23,13 @@ concurrency:
 
 jobs:
   typecheck:
+    # A version-bump commit changes four package.json version fields and
+    # nothing else, so there is nothing here for it to check. It used to carry
+    # `[skip ci]` for this, but that marker also suppresses the *tag* push that
+    # rides on the same commit, which silently disabled every release — see
+    # version-bump.yml. Skipping by message keeps the saving without that cost.
+    # Guarded on event_name so pull_request runs are never skipped.
+    if: "${{ github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore: bump version') }}"
     name: Typecheck
     runs-on: ubuntu-latest
     steps:
@@ -44,6 +51,13 @@ jobs:
       - run: npm run typecheck
 
   unit-tests:
+    # A version-bump commit changes four package.json version fields and
+    # nothing else, so there is nothing here for it to check. It used to carry
+    # `[skip ci]` for this, but that marker also suppresses the *tag* push that
+    # rides on the same commit, which silently disabled every release — see
+    # version-bump.yml. Skipping by message keeps the saving without that cost.
+    # Guarded on event_name so pull_request runs are never skipped.
+    if: "${{ github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore: bump version') }}"
     name: Unit tests
     runs-on: ubuntu-latest
     steps:
@@ -63,6 +77,13 @@ jobs:
       - run: npx vitest run
 
   frontend-build:
+    # A version-bump commit changes four package.json version fields and
+    # nothing else, so there is nothing here for it to check. It used to carry
+    # `[skip ci]` for this, but that marker also suppresses the *tag* push that
+    # rides on the same commit, which silently disabled every release — see
+    # version-bump.yml. Skipping by message keeps the saving without that cost.
+    # Guarded on event_name so pull_request runs are never skipped.
+    if: "${{ github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore: bump version') }}"
     name: Frontend build
     runs-on: ubuntu-latest
     steps:
@@ -86,6 +107,13 @@ jobs:
       - run: npm run build -w @foxschema/web
 
   lint:
+    # A version-bump commit changes four package.json version fields and
+    # nothing else, so there is nothing here for it to check. It used to carry
+    # `[skip ci]` for this, but that marker also suppresses the *tag* push that
+    # rides on the same commit, which silently disabled every release — see
+    # version-bump.yml. Skipping by message keeps the saving without that cost.
+    # Guarded on event_name so pull_request runs are never skipped.
+    if: "${{ github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore: bump version') }}"
     name: ESLint
     runs-on: ubuntu-latest
     steps:

.github/workflows/codeql.yml

@@ -19,6 +19,13 @@ permissions:
 
 jobs:
   analyze:
+    # A version-bump commit changes four package.json version fields and
+    # nothing else, so there is nothing here for it to check. It used to carry
+    # `[skip ci]` for this, but that marker also suppresses the *tag* push that
+    # rides on the same commit, which silently disabled every release — see
+    # version-bump.yml. Skipping by message keeps the saving without that cost.
+    # Guarded on event_name so pull_request runs are never skipped.
+    if: "${{ github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore: bump version') }}"
     name: CodeQL — JavaScript / TypeScript
     runs-on: ubuntu-latest
 

.github/workflows/dependency-security.yml

@@ -14,6 +14,13 @@ permissions:
 jobs:
   # ── npm audit ──────────────────────────────────────────────────────────────
   npm-audit:
+    # A version-bump commit changes four package.json version fields and
+    # nothing else, so there is nothing here for it to check. It used to carry
+    # `[skip ci]` for this, but that marker also suppresses the *tag* push that
+    # rides on the same commit, which silently disabled every release — see
+    # version-bump.yml. Skipping by message keeps the saving without that cost.
+    # Guarded on event_name so pull_request runs are never skipped.
+    if: "${{ github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore: bump version') }}"
     name: npm audit
     runs-on: ubuntu-latest
     steps:
@@ -68,6 +75,13 @@ jobs:
 
   # ── ESLint security rules ──────────────────────────────────────────────────
   eslint-security:
+    # A version-bump commit changes four package.json version fields and
+    # nothing else, so there is nothing here for it to check. It used to carry
+    # `[skip ci]` for this, but that marker also suppresses the *tag* push that
+    # rides on the same commit, which silently disabled every release — see
+    # version-bump.yml. Skipping by message keeps the saving without that cost.
+    # Guarded on event_name so pull_request runs are never skipped.
+    if: "${{ github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore: bump version') }}"
     name: ESLint security
     runs-on: ubuntu-latest
     steps:
@@ -99,6 +113,13 @@ jobs:
   # ── node_modules backdoor / unexpected port scan ───────────────────────────
   # Dedicated deep scan also lives in deps-backdoor-scan.yml (scheduled weekly).
   deps-backdoor-scan:
+    # A version-bump commit changes four package.json version fields and
+    # nothing else, so there is nothing here for it to check. It used to carry
+    # `[skip ci]` for this, but that marker also suppresses the *tag* push that
+    # rides on the same commit, which silently disabled every release — see
+    # version-bump.yml. Skipping by message keeps the saving without that cost.
+    # Guarded on event_name so pull_request runs are never skipped.
+    if: "${{ github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore: bump version') }}"
     name: Deps backdoor / port scan
     runs-on: ubuntu-latest
     steps:

.github/workflows/deps-backdoor-scan.yml

@@ -22,6 +22,13 @@ permissions:
 
 jobs:
   scan-node-modules:
+    # A version-bump commit changes four package.json version fields and
+    # nothing else, so there is nothing here for it to check. It used to carry
+    # `[skip ci]` for this, but that marker also suppresses the *tag* push that
+    # rides on the same commit, which silently disabled every release — see
+    # version-bump.yml. Skipping by message keeps the saving without that cost.
+    # Guarded on event_name so pull_request runs are never skipped.
+    if: "${{ github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore: bump version') }}"
     name: Scan node_modules (ports / backdoors)
     runs-on: ubuntu-latest
     steps:

.github/workflows/secret-scan.yml

@@ -18,6 +18,13 @@ permissions:
 
 jobs:
   gitleaks:
+    # A version-bump commit changes four package.json version fields and
+    # nothing else, so there is nothing here for it to check. It used to carry
+    # `[skip ci]` for this, but that marker also suppresses the *tag* push that
+    # rides on the same commit, which silently disabled every release — see
+    # version-bump.yml. Skipping by message keeps the saving without that cost.
+    # Guarded on event_name so pull_request runs are never skipped.
+    if: "${{ github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore: bump version') }}"
     name: Gitleaks
     runs-on: ubuntu-latest
     steps:

.github/workflows/version-bump.yml

@@ -83,5 +83,16 @@ jobs:
             packages/db/package.json \
             apps/web/package.json \
             apps/cli/package.json
-          git commit -m "chore: bump version to $V [skip ci]"
+          # No [skip ci]. GitHub honours that marker on *every* push event for
+          # the commit, tag pushes included — and the release tag lands on
+          # exactly this commit, so the marker silently disabled Release Gate,
+          # npm Publish and Web Release. v0.2.111 and v0.2.220 were both tagged
+          # and neither fired anything; the last tag that ran a release was
+          # v0.2.73, whose commit was an ordinary fix.
+          #
+          # The loop this marker looked like it was preventing is already
+          # prevented by the `if:` on this job, which refuses to bump a
+          # "chore: bump version" commit. The CI it saved is now saved by a
+          # matching guard on each push-triggered workflow.
+          git commit -m "chore: bump version to $V"
           git push