ci: main ships: releases, and a core bump that proves itself in Prism (#23)

[Maxaubert]

Closes #23. Owner, 2026-09-19: "that compiled copy needs to be auto bumped when a new Prism Terminal release or merge to main happens", "we need automated tests to confirm it never conflicts. that's important", and "users of the app can get an update available banner in their app title bar."

What merging to main does after this

release.yml (new). A push to main with a NEW package.json version runs the same gates as CI, builds the installer and publishes v<version> as the latest release. That is what the in-app update chip has always looked for; until now nothing published anything, so the chip could never fire. A version that is already released publishes nothing and does not fail (docs-only merges are not errors).

core-release.yml (new). A push to main that touches core/:

1. re-splits core/ into core-dist and tags core-v<version>. Same contents as an existing tag: nothing to do. Different contents under an existing tag: it fails; a tag people pinned is never moved.
2. opens a PR in Maxaubert/Prism that bumps the pin AND Prism's version (minor when the core's major.minor moved, else patch), so Prism's release workflow will publish a NEW release and its users' update chip fires.
3. waits for that PR's checks. Those now include Prism's terminal gate on a GitHub runner (Prism Links in Claude Code's fullscreen view lose their blue after a hover until a scroll #163 / Clicking a tab shifts the tab strip (Powerline, and Full fills) #164): it builds the app and drives every scenario the terminal can break, real dictation included. Measured green 3 runs of 3, 173 checks, about six minutes.
4. If the repo variable PRISM_AUTO_MERGE is true, it merges the PR and Prism releases itself. Otherwise (the default) the green PR waits for a person. A red check never merges, in either mode.

ci.yml gains core-version: a PR that changes core/ without bumping core/package.json fails on the PR, not after the merge.

Two switches, both the owner's

• Secret PRISM_BUMP_TOKEN (fine-grained token on Maxaubert/Prism, Contents + Pull requests read/write). Without it the workflow releases the core, warns, and opens nothing.
• Variable PRISM_AUTO_MERGE. Unset means "open the PR and wait for me". true is a standing exception to "never merge without my word", scoped to these bot-made bump PRs.

What the CI gate already caught (in Prism #163 / core rc.6)

Running the gate on a runner for the first time found that the speech-engine fetch failed when started from PowerShell 7, which is how every runner starts it: it would have broken BOTH apps' release builds. Fixed in the core. It also found two test assumptions about the owner's machine (a real claude CLI; a repo under C:\Users).

Verification

All three workflow files parse. The release decision (split, compare trees with the tag) and the minor-or-patch rule were run locally against this repo's real tags and pins. The workflows themselves can only run for real on main: the first release run is this merge (it will publish v0.1.1, the first release this repo has had), and the first core-release run is the dictation merge (#22, core 0.2.0). I will watch both.

One slip, fixed before review: my first commit on this branch swept in vendor/ and .e2e-cache/ (89 MB; main's .gitignore did not know them yet). Removed from the commit, ignored, force-pushed.

🤖 Generated with Claude Code