chore(skills): add release-widget skill

[yordan-st]

Summary

• Adds `.agents/skills/release-widget/SKILL.md` — automates widget/module release pipeline (version bump → GitHub draft release → OSS clearance → Marketplace publish)
• Previously ran as private trial (untracked); opening as draft for team feedback before promoting to shared skill set

Test plan

• Used successfully for image-web v1.6.0 and charts-web v6.3.2 releases

[github-actions]

AI Code Review

⚠️ Approved with suggestions — low-severity items only, safe to merge

---

What was reviewed

File	Change
.agents/skills/release-widget/SKILL.md	New release pipeline skill (8 phases)
automation/utils/bin/rui-bump-version.ts	New CLI: version bumping with validation
automation/utils/bin/rui-changelog.ts	New CLI: read unreleased changelog entries
automation/utils/bin/rui-create-jira-version.ts	New CLI: create Jira version (non-blocking)
automation/utils/bin/rui-generate-oss-sbom.ts	New CLI: generate OSS SBOM zip
automation/utils/bin/rui-oss-clearance.ts	Refactored: use shared computeSha256
automation/utils/bin/rui-package-info.ts	New CLI: print package info as JSON
automation/utils/bin/rui-upload-readme-oss.ts	New CLI: upload READMEOSS to release
automation/utils/package.json	Added new bin entries
automation/utils/src/bump-version.ts	Refactored: use Version class, add write-back verification
automation/utils/src/changelog-parser/index.ts	Added getPackageChangelog dispatcher
automation/utils/src/github.ts	Renamed type, added getReleaseByTag/listReleases
automation/utils/src/monorepo.ts	Added resolvePackagePath helper
automation/utils/src/oss-clearance.ts	Extracted computeSha256 + verifyAssetDigest
automation/utils/src/package-info.ts	Added isReleasable predicate
automation/utils/src/prepare-release-helpers.ts	Use new getPackageChangelog
automation/utils/src/version.ts	Fixed bumpMajor bug, added isGreaterThan

Skipped (out of scope): dist/, pnpm-lock.yaml

---

Findings

⚠️ Low — listReleases lacks pagination, may miss older drafts

File: automation/utils/src/github.ts line 199
Problem: listReleases hardcodes ?per_page=100 with no pagination loop. getReleaseByTag falls back to this list only when the direct /releases/tags/{tag} endpoint 404s — i.e., for draft releases. The GitHub API returns releases newest-first, so a draft is almost always in the first page, but the assumption silently fails if the release list grows beyond 100 entries.
Fix: Either document the assumption in a comment, or add a simple pagination loop:

async listReleases(): Promise<GitHubRelease[]> {
    const results: GitHubRelease[] = [];
    let page = 1;
    while (true) {
        const page_results = await fetch<GitHubRelease[]>(
            "GET",
            `https://api.github.com/repos/${this.owner}/${this.repo}/releases?per_page=100&page=${page}`,
            undefined,
            { ...this.ghAPIHeaders }
        );
        results.push(...page_results);
        if (page_results.length < 100) break;
        page++;
    }
    return results;
}

---

⚠️ Low — getUnreleasedSubcomponents assumes non-empty changelog content

File: automation/utils/bin/rui-changelog.ts line 348
Problem: changelog.content[0] is destructured without a guard. If getWidgetChangelog returns an empty content array (a widget with no CHANGELOG.md entries or a malformed file), unreleased is undefined and unreleased.sections throws TypeError.
Fix: Add a guard or fall back to an empty sections array:

const [unreleased] = (await getWidgetChangelog(path)).changelog.content;
return { name: depInfo.mxpackage.name, sections: unreleased?.sections ?? [] };

---

Positives

• bumpMajor bug fixed: The original implementation incremented minor instead of major — a real silent correctness bug caught and fixed (version.ts line 34).
• Write-back verification in bumpPackageJson: Rather than trusting pnpm version exited 0, the new code reads package.json back and throws if the version doesn't match — correctly accounts for pnpm silently refusing an unchanged version.
• Draft-aware getReleaseByTag: The two-step lookup (direct endpoint → list fallback) is well-documented and correctly handles the GitHub API's behavior that the /releases/tags/{tag} endpoint 404s for drafts.
• verifyAssetDigest extracted with graceful fallback: Silently skips the check when asset.digest is absent (older releases pre-date GitHub's digest field) rather than failing, which is the right defensive choice.
• Rollback in SKILL.md is human-gated with the carve-out explicitly excluded: Phase 8 lists all teardown commands but requires explicit confirmation — exactly what the security rules require for irreversible operations.
• Jira version creation never blocks release: rui-create-jira-version exits 0 on API failure and reports skipped, preventing a transient Jira issue from halting a time-sensitive release.