fix(ci): release permissions and Node.js 24

.github/workflows/build-and-test.yml

@@ -17,7 +17,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '24'
           cache: 'pnpm'
       - name: Install dependencies
         run: pnpm install --frozen-lockfile

.github/workflows/release.yml

@@ -5,27 +5,32 @@ on:
     types: [closed]
     branches:
       - main
+  workflow_dispatch:
+
+permissions:
+  contents: write
 
 jobs:
   release:
-    # Only run if the PR was merged and has the "Release" label
-    if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'Release')
+    if: >
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.pull_request.merged == true &&
+       contains(github.event.pull_request.labels.*.name, 'Release'))
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           fetch-depth: 0 # Fetch full history for version tagging
-          token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install pnpm
         uses: pnpm/action-setup@v4
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '24'
           cache: 'pnpm'
 
       - name: Install dependencies
@@ -49,20 +54,35 @@ jobs:
 
       - name: Package extension
         run: pnpm run package
-
+
+      - name: Prepare release notes
+        id: release-notes
+        env:
+          PR_BODY: ${{ github.event.pull_request.body }}
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          {
+            echo "## Release v${VERSION}"
+            echo
+            if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+              echo "Manually triggered release from main."
+            else
+              echo "This release was automatically created from PR #${{ github.event.pull_request.number }}: ${{ github.event.pull_request.title }}"
+              echo
+              echo "### Changes"
+              echo "$PR_BODY"
+            fi
+          } > release-notes.md
+
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         id: create-release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           tag_name: v${{ steps.get-version.outputs.version }}
           name: Release v${{ steps.get-version.outputs.version }}
-          body: |
-            ## Release v${{ steps.get-version.outputs.version }}
-
-            This release was automatically created from PR #${{ github.event.pull_request.number }}: ${{ github.event.pull_request.title }}
-
-            ### Changes
-            ${{ github.event.pull_request.body }}
+          body_path: release-notes.md
           files: |
             commitollama-${{ steps.get-version.outputs.version }}.vsix
           draft: false

.github/workflows/version-bump.yml

@@ -13,6 +13,10 @@ on:
         - minor
         - major
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   bump-version:
     runs-on: ubuntu-latest
@@ -29,7 +33,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '24'
           cache: 'pnpm'
 
       - name: Install dependencies