Add a create-release action alongside get-version. Closes #21

[easylife-agents]

Summary

• Adds a second action, create-release, alongside the existing get-version action -- so any repository (starting with EasyLife365/.github, which currently hand-rolls the exact same logic in bash) can cut a tagged release without duplicating validate-tag-release-move-major-tag logic.
• Talks to the GitHub REST API directly (@actions/github's getOctokit) -- no checkout, no fetch-depth: 0, no git push. Reuses the semver dependency get-version already has instead of a hand-rolled regex.
• Moves a floating major tag (v1, v2, ...) inline, in the same call, skipped automatically for a prerelease -- fixes a real bug present, unfixed, in this repo's own update-major-tag.yml (now removed): its regex also matched a prerelease tag like v1.2.3-rc.1, which would have force-moved v1 onto an unstable commit.
• No separated code: this repo's own release.yml now calls its own create-release action instead of a parallel bash implementation (dogfooding), and the now-redundant update-major-tag.yml is deleted.

A real dependency/tooling issue found and fixed along the way

@actions/github v9 is ESM-only ("type": "module", no require export condition) -- already a listed dependency, unused until now. This broke Jest's CJS-based test resolution (Cannot find module '@actions/github') even though esbuild's bundler handles it fine for the actual runtime output. Fixed with a manual __mocks__/@actions/github.js, matching this repo's existing __mocks__/@actions/core.js pattern, rather than fighting Jest's module resolution for a dependency it fundamentally can't require().

Test plan

• npm run build, npm run lint -- --max-warnings 0, npm run test (57 tests, 100% coverage on the new core logic), npm run package -- all green locally.
• npm run test:runtime-smoke extended with a new smoke test for the create-release bundle, mirroring the existing one -- proves the ESM-only @actions/github dependency loads correctly under node20 when bundled, not just under esbuild's own resolver.
• Manually ran the bundled create-release/dist/index.js directly with a real (fake) token against a real repository -- confirmed it reaches a genuine "Bad credentials" GitHub API response rather than a raw ERR_REQUIRE_ESM crash, proving the full Octokit code path works end-to-end in the actual runtime bundle, not just under test mocks.
• The repo's own precommit hook (lint + build + package + dist-up-to-date check) ran clean on commit.

🤖 Generated with Claude Code

[plamber]

Clean after fixing a real CI-coverage gap — one open governance question, not resolved here.

Both reviewers confirmed the code itself is sound: prerelease-exclusion, tag construction (always via semver's own normalized output, never raw input), the force: true major-tag move (always targeting v${parsed.major}, never an arbitrary caller-supplied ref), and token handling (never logged) all check out. Test isolation is correct in both files, and no leftover explicit jest.mock('@actions/github', ...) factory conflicts with the new manual mock.

Security review found a real gap, fixed: tests.yml/build-dist.yml's dist-freshness checks and the pre-commit hook only ever covered dist/ (the root bundle) — a PR touching src/createRelease/*.ts without rebuilding create-release/dist/index.js would have passed every PR-time check with a stale compiled bundle next to reviewed source. Now all three cover both. Also strengthened the README's note that update-major-tag defaults to true (a default-on destructive operation, not just available).

One finding not resolved in this review, surfaced for you directly: this repo has zero branch/tag protection (verified live — no rulesets, main returns "Branch not protected", tag protection 404) and no required PR review, per an existing, documented decision made when this repo shipped only a read-only action. create-release changes that risk profile — it's a write-capable action meant for cross-repo adoption starting with .github. Worth a fresh look at whether that acceptance still holds, not something to silently carry forward or that I should decide in a code review.

---

_Generated by Claude Code