fix: [FEEDS-1358]rewrite CI release flow with PR-title semver and concurrency cancellation

[itsmeadi]

Summary

• replace release-branch based release flow with merged PR auto-release on main/master
• derive bump type from PR title/body (feat => minor, fix/bug => patch, !/BREAKING CHANGE => major) via scripts/release/bump_version.php
• add release concurrency cancellation, remove legacy release workflows, and document the new process in README.md and .github/RELEASE_SETUP.md

Test plan

• php -l scripts/release/bump_version.php
• smoke run: php scripts/release/bump_version.php --title "chore: update docs" --body "" returns should_release=false
• merge a fix: PR in a test repo/branch and verify version bump + tag + GitHub release + Packagist update

Made with Cursor

[mogita]

Review: 3 critical issues found in release automation

[mogita]

Critical: Mixed tag formats will return the wrong base version.

This repo has both bare (5.0.0) and v-prefixed (v1.0.0) tags. --sort=-version:refname can sort v1.0.0 before 5.0.0 in many Git versions, so the foreach below takes the first match and returns 1.0.0 instead of 5.0.0.

Fix: normalize all tags to bare numeric form and sort with version_compare in PHP rather than relying on git's sort order:

$tags = preg_split('/\R/', $tagsRaw) ?: [];
$versions = [];
foreach ($tags as $tag) {
    $normalized = ltrim(trim($tag), 'v');
    if (preg_match('/^\d+\.\d+\.\d+$/', $normalized)) {
        $versions[] = $normalized;
    }
}
usort($versions, 'version_compare');
return end($versions) ?: '0.0.0';

[mogita]

Critical: Multi-line PR body can smuggle extra CLI flags into argv.

$PR_BODY can be multi-line. When double-quoted in the shell, a PR body containing a newline followed by --output /etc/passwd would be word-split into separate positional arguments, overwriting the output path.

Fix: write the body to a temp file and pass it via --body-file:

run: |
  PR_BODY_FILE=$(mktemp)
  printf '%s' "$PR_BODY" > "$PR_BODY_FILE"
  php scripts/release/bump_version.php \
    --title "$PR_TITLE" \
    --body-file "$PR_BODY_FILE" \
    --output "$GITHUB_OUTPUT"

Then update bump_version.php to support --body-file.

[mogita]

Critical: json_decode + json_encode round-trip reorders composer.json keys.

The existing composer.json has a specific key order (name, description, version, type, ...). After json_decode/json_encode, keys may be reordered, producing a large spurious diff on the first release and making git history noisy for every subsequent one.

Fix: use a targeted regex replacement instead of round-tripping through JSON:

$updated = preg_replace(
    '/"version":\s*"[^"]*"/',
    '"version": "v' . $version . '"',
    $raw,
    1
);
if ($updated === null || $updated === $raw) {
    throw new ReleaseScriptException('Could not update version in composer.json');
}