ci: release automatically from conventional PR titles

[KartikP]

Every qualifying merge to main is versioned and published automatically. There is no bump PR, no approval step and no personal access token.

Release rule (.github/workflows/release.yml, one decision per squash merge)

1. Path gate: the merge must change a shipped file. For core that means a file under brainscore_core/ or the [project] dependencies in pyproject.toml. Changes only to tests, docs, .github, *.md, sqlite3.db and so on never release, whatever the title says.
2. Title type: feat gives a minor release; fix and perf give a patch. Every other allowed type gives no release: refactor, docs, test, ci, chore, build, plugin, model, benchmark, data, metric.
3. Major: needs ! in the title or a BREAKING CHANGE footer, and the major update label on the PR. Without the label it is downgraded to minor.

The workflow computes the level and passes it to python-semantic-release as a forced bump (force: patch|minor|major). python-semantic-release then:

• updates version in pyproject.toml;
• commits chore(release): X.Y.Z with the skip-ci marker;
• tags vX.Y.Z and pushes to main with a GitHub App token (actions/create-github-app-token);
• builds the sdist and wheel, and creates a GitHub release.

A separate publish job in the pypi environment uploads with pypa/gh-action-pypi-publish through trusted publishing (id-token: write, no stored PyPI token).

The level is forced rather than left to python-semantic-release, because it would otherwise read every commit since the last tag, and a skipped feat (for example, a tests-only merge) would leak into the next release.

• Loop guard: the skip-ci marker on the release commit, plus a job condition that skips head commits starting with chore(release):.
• workflow_dispatch with a level choice is for the first release and for missed ones. Merging this PR does not release by itself, because it changes no shipped file. Cutting 2.4.0 (feat feat(metadata): add shared schema and publication safeguards #172, feat(metadata): merge scoring output into existing metadata #177 and feat(metadata): add dataset and license vocabularies #178 since v2.3.8) is one manual run with minor.

PR title check (.github/workflows/pr-title.yml, amannn/action-semantic-pull-request)

• It runs on pull_request_target (opened, edited, synchronize, reopened, labeled, unlabeled), so fork PRs get it too. It never checks out PR code, and its only permission is pull-requests: write.
• On an invalid title it posts one sticky comment showing:
  • the failing title;
  • each type with the release it causes;
  • the major-label rule and the path rule;
  • the type(scope): subject format and three examples.
• The comment updates in place on each edit and is deleted once the title passes.
• A second sticky comment warns when a breaking title or body has no major update label.

Reuse: both workflows also declare workflow_call. Vision and language call them from main (secrets: inherit), and their only setting is the release-paths regex. For vision, for example: ^brainscore_vision/(?!(models|benchmarks|data|metrics)/), so plugin-only PRs never release.

Local checks

• Path and title gate on a scratch repo:

Merge	Level
feat under brainscore_core/	minor
feat only under tests/	none
fix	patch
docs in the package	none
build(deps)	none
fix(deps) changing dependencies	patch
version-only pyproject edit	none
feat! without the label	minor
feat! with the label	major
plugin	none

• python-semantic-release 10.7.0 --noop on current main: forced patch gives 2.3.9, minor gives 2.4.0, major gives 3.0.0.
• The vision regex keeps model_helpers/ and __init__.py as shipped, and excludes models/, benchmarks/ and metrics/.
• Neither new workflow runs on this PR (push-only and pull_request_target read from main). Jenkins and metadata-contract.yml are unchanged.

Before merging, complete the one-time setup in the hive note shared/core_auto_release.md: the App, the secrets, a ruleset with the App as bypass and the title check required, squash-only merging with the PR title, and the PyPI trusted publisher.