Critical Fix: Release Workflow and Dependabot Removal

[radleta]

Critical Fix: Release Workflow and Dependabot Removal

Summary

This PR contains a critical fix for the GitHub Actions release workflow that caused all 215 integration tests to fail during the v1.1.0 release attempt. It also removes Dependabot configuration to reduce PR noise for this solo-maintained project.

Changes

🐛 Critical Fix: Release Workflow Test/Build Order

• Problem: Release workflow ran tests before build, causing all integration tests to fail
• Root Cause: Integration tests execute dist/src/index.js which doesn't exist until after build
• Solution: Swapped order - build now runs before tests in .github/workflows/release.yml
• Impact: All 625 tests will now pass in CI/CD, unblocking releases

🔧 Maintenance: Remove Dependabot

• Rationale: Excessive PR noise for solo-maintained project
• Approach: Manual dependency updates in batches by maintainers
• Security: npm audit still runs automatically in CI/CD (fails on high/critical vulnerabilities)
• Documentation: Added "Dependency Management" section to CONTRIBUTING.md explaining this decision

📝 Documentation Updates

• Added CHANGELOG.md Unreleased section with these changes
• Updated CONTRIBUTING.md with Dependency Management section
• Updated .claude/commands/release-ready.md audit guidance

Files Changed

 .claude/commands/release-ready.md |   3 +-
 .github/dependabot.yml            |  46 deletion (removed)
 .github/workflows/release.yml     |   6 +-- (swap test/build order)
 CHANGELOG.md                      |  10 +++-
 CONTRIBUTING.md                   |   4 ++++
 5 files changed, 16 insertions(+), 53 deletions(-)

Testing

• ✅ Verified workflow changes locally
• ✅ Pre-commit hooks passed
• ✅ All documentation updated
• 🔄 CI/CD will verify full test suite runs successfully with new workflow order

Related Issues

Fixes the v1.1.0 release failure discovered in GitHub Actions run #49124003405

Deployment Notes

After merge:

1. Tag new version: v1.1.1 or re-tag v1.1.0 if preferred
2. Push tag to trigger release workflow
3. Verify release workflow completes successfully with new build/test order

Checklist

• Changes tested locally
• Documentation updated (CHANGELOG, CONTRIBUTING)
• Commit follows conventional commit format
• No breaking changes
• Security: No secrets or sensitive files committed

---

Type: Hotfix
Priority: Critical (blocks releases)
Scope: CI/CD infrastructure + maintenance