chore/automatic semver [CLI-1465]

[octavian-snyk]

Description

This PR introduces SemVer release tagging workflow for this repo.

Note: When this PR is merged, the repository will bump to version: v1.0.0.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[danskmt]

In the CLI's CONTRIBUTING.md also says about Writing commit messages, by specifying "what" rather than "how". Maybe is worth saying it here as well.

[danskmt]

in code-client-go the config is:

     - name: Get Next Version
        id: semver
        uses: ietf-tools/semver-action@v1
        with:
          token: ${{ github.token }}
          branch: main
          noVersionBumpBehavior: patch

here fixes branch to main instead getting ref_name, and noVersionBumpBehavior sets to patch.
Are we sure about not following the pattern that has in code-client-go?

[danskmt]

maybe have separate steps for creating tag and then pushing?
ref: https://github.com/snyk/code-client-go/blob/main/.github/workflows/release.yml

[danskmt]

Not sure if this BREAKING CHANGE should be in this table as the others are defined at the beginning of the commit message, and BREAKING CHANGE is something that is probably in the commit's body description

[robertolopezlopez]

I guess this is not the main header. Maybe ## or ###?

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Invalid Action Version 🔴 [critical] The workflow references actions/checkout@v6. As noted in the triage hypotheses, the current standard is v4 and v6 does not exist. This will cause the workflow to fail to load, preventing any releases from occurring. - uses: actions/checkout@v6 Insufficient Permissions 🟠 [major] The workflow attempts to push a git tag and create a GitHub release but does not declare permissions: contents: write. Default GitHub Actions tokens are often restricted to read-only access. Without this explicit permission block, both the git push and gh release create steps will fail with authentication errors. run: git push origin ${{ steps.semver.outputs.next }} - name: Release if: ${{ steps.semver.outputs.next != '' }} run: gh release create ${{ steps.semver.outputs.next }} --generate-notes

📚 Repository Context Analyzed This review considered 7 relevant code sections from 4 files (average relevance: 0.61) docs/extension-architecture-guide.md (2 segments, lines 1-209) pkg/workflow/engineimpl.go (lines 1-281) README.md (lines 1-48) CONTRIBUTING.md (3 segments, lines 5-170)