feat: auto-merge chart release and support release-v* hotfixes

[bhaveshpatel640]

Summary

Automate the post-npm chart path (wait for CI, squash-merge the chart bot PR → OCI) and enable release-v* hotfix branches so patches do not have to ship from tip of main.

Chart SemVer is line-local: same X.Y.Z-rc.* cycle stays monotonic; a stable X.Y.* hotfix ignores newer majors/RC lines (e.g. 0.2.0 → 0.2.1 while main is on 0.3.0-rc.*).

Closes AGE-2276

Diff

Before: Version Packages → npm → chart bot PR → human merge → chart OCI
After: Version Packages → npm + image → chart bot PR → auto-merge after CI → chart OCI

Hotfix: cut release-v* from a shipped SHA / charts/trueforge@* → cherry-pick + changeset → same Release lane on that branch (chart PR base = the release branch).

Chart SemVer examples

Case	Starting point	Next chart
Normal RC on main	0.2.0-rc.14	0.2.0-rc.15
Hotfix mid-RC (stale cut)	Chart.yaml 0.2.0-rc.3, tags already at 0.2.0-rc.10	0.2.0-rc.11 (same RC line)
Exit RC → stable	0.2.0-rc.14 + stable app	0.2.0
Hotfix older stable	Cut from 0.2.0; main on 0.3.0-rc.*	0.2.1 (not 0.3.0-rc.*)

Admin prerequisite (Pending)

Limited ruleset bypass for trueforge-dev-bot only (app id 4591571). No admin PAT.

• Bypass mode pull_request — merge via PR only; no direct push
• Split rulesets — bot bypasses approvals; required check check on a no-bypass ruleset
• Same on org release-branch-protection (release-v*)

Changes

• release.yml also runs on release-v*; passes merge_chart_pr: true into the chart workflow
• build-and-prepare-chart-release.yml:
  • Chart PR base is main or the current release-v*
  • Separate bot heads: release-chart/trueforge vs release-chart/trueforge-<release-v*>
  • Optional auto-merge after CI (merge_chart_pr; default true from Release / false on manual dispatch)
  • Chart version baseline = max(Chart.yaml, highest tag on the same SemVer line) via scripts/highest-chart-tag-on-line.sh
  • Global serialize on open/merge; wait for charts/trueforge@* tag before the next run
• release-chart.yml: publish on chart-bot PR merges into main or release-v*
• RELEASING.md: automated OCI lane, hotfix branch flow, line-local SemVer, limited bot bypass
• pnpm test:chart-version: covers resolve + line-local tag picker

How was this tested?

• Workflow YAML reviewed against recent chart PR CI timings (checks appear ~6–10s; initial sleep 20 before gh pr checks --watch)
• pnpm test:chart-version (resolve-chart-version + highest-chart-tag-on-line matrix)
• No app/runtime code changes; full pnpm suite not required for this workflow/docs-only PR

Checklist

• I have read the contributing guidelines
• pnpm build, pnpm test, pnpm typecheck, pnpm lint:ci, and pnpm format:check pass locally
• Tests added/updated where it makes sense
• No hand-edits to generated code (packages/trueforge-sdk, python/trueforge_sdk, .github/fern/openapi/openapi.json, docs/openapi.json) — fork PRs omit SDK regen; maintainers regenerate after merge
• Docs / .env.example updated if configuration or behavior changed

---

Note

Medium Risk
Changes release automation (npm/chart publish paths, bot auto-merge, and SemVer baselines); misconfiguration could block releases or assign wrong chart versions on parallel main vs hotfix lines.

Overview
Automates the chart OCI lane after npm publish: the chart bot PR can wait for CI, squash-merge via the GitHub App, and block until the charts/trueforge@* tag exists so the next run sees the right SemVer baseline. merge_chart_pr defaults to true when called from Release and false on manual dispatch.

Adds release-v* hotfix support end-to-end: Release and chart publish run on main and release-v*; chart PRs target the matching base with separate heads (release-chart/trueforge vs release-chart/trueforge-<branch>). Concurrency is scoped per ref for image/chart builds and globally serialized (with queue: max) for chart version assignment and merge.

Line-local chart SemVer uses new scripts/highest-chart-tag-on-line.sh so the version floor is max(Chart.yaml, highest published tag on the same line)—RC cycles stay monotonic; stable hotfixes do not jump to newer majors/RCs on main. RELEASING.md documents the flow, bot ruleset bypass, and hotfix cut instructions; pnpm test:chart-version runs the new script tests.

^{Reviewed by Cursor Bugbot for commit f9cf0a1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: f9cf0a1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9e350d4. Configure here.}