fix(ci): auto RC generation on develop merge via pull_request trigger

.github/workflows/release.yml

@@ -3,21 +3,30 @@ name: Release Pipeline
 on:
   push:
     branches:
-      - develop
       - main
     tags:
       - 'v*.*.*'
+  pull_request:
+    types: [closed]
+    branches:
+      - develop
+      - main
   workflow_dispatch:
     inputs:
       version:
         description: 'Semantic Version Tag (e.g. v1.0.0-rc.26)'
         required: true
         default: 'v1.0.0-rc.26'
 
+concurrency:
+  group: release-${{ github.event.pull_request.base.ref || github.ref_name }}
+  cancel-in-progress: false
+
 jobs:
   release:
     name: Build, Scan & Publish Release Artifacts
     runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.merged == true
     permissions:
       contents: write
       packages: write
@@ -28,6 +37,7 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
+          ref: ${{ github.event.pull_request.merge_commit_sha || github.sha }}
 
       - name: Determine & Auto-Create Release Tag
         id: release_tag
@@ -36,15 +46,22 @@ jobs:
           INPUT_VERSION: ${{ inputs.version }}
           REF_NAME: ${{ github.ref_name }}
           REF_TYPE: ${{ github.ref_type }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPOSITORY: ${{ github.repository }}
         run: |
           git fetch --tags origin
 
+          TARGET_BRANCH="$REF_NAME"
+          if [ "$EVENT_NAME" = "pull_request" ]; then
+            TARGET_BRANCH="$BASE_REF"
+          fi
+
           if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
             TAG="$INPUT_VERSION"
           elif [ "$REF_TYPE" = "tag" ]; then
             TAG="$REF_NAME"
-          elif [ "$REF_NAME" = "develop" ]; then
+          elif [ "$TARGET_BRANCH" = "develop" ]; then
             LATEST_RC=$(git tag -l "v*-rc.*" | sort -V | tail -n 1)
             if [ -z "$LATEST_RC" ]; then
               TAG="v1.0.0-rc.1"
@@ -57,11 +74,12 @@ jobs:
             echo "Auto-generated Release Candidate Tag for develop: $TAG"
             git config user.name "github-actions[bot]"
             git config user.email "github-actions[bot]@users.noreply.github.com"
+            git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GH_REPOSITORY}.git"
             if ! git rev-parse "$TAG" >/dev/null 2>&1; then
               git tag -a "$TAG" -m "Automated release candidate $TAG"
-              git push origin "$TAG" || true
+              git push origin "$TAG"
             fi
-          elif [ "$REF_NAME" = "main" ]; then
+          elif [ "$TARGET_BRANCH" = "main" ]; then
             LATEST_RC=$(git tag -l "v*-rc.*" | sort -V | tail -n 1)
             if [ -n "$LATEST_RC" ]; then
               TAG=$(echo "$LATEST_RC" | sed -E 's/-rc\.[0-9]+$//')
@@ -76,12 +94,13 @@ jobs:
             echo "Auto-generated Official Release Tag for main: $TAG"
             git config user.name "github-actions[bot]"
             git config user.email "github-actions[bot]@users.noreply.github.com"
+            git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GH_REPOSITORY}.git"
             if ! git rev-parse "$TAG" >/dev/null 2>&1; then
               git tag -a "$TAG" -m "Automated official release $TAG"
-              git push origin "$TAG" || true
+              git push origin "$TAG"
             fi
           else
-            echo "Error: Unsupported ref $REF_NAME"
+            echo "Error: Unsupported ref $TARGET_BRANCH"
             exit 1
           fi
 

CONTEXT.md

@@ -92,7 +92,7 @@ Guidelines below are continuously updated from internal code reviews, CodeRabbit
 29. **URL Path Sanitization for File Serving**: Code serving files from `fs.FS` based on URL paths MUST use `filepath.Clean` (not `path.Clean`) for sanitization, followed by `filepath.ToSlash` to maintain forward-slash compatibility with `fs.FS`. Semgrep flags `path.Clean` on user input as `filepath-clean-misuse`.
 30. **External Coverage Tool Consistency**: When using external coverage tools (Codecov) as merge gates with multiple CI jobs uploading coverage, configure `after_n_builds: N` (N = number of upload jobs) and `wait_for_ci: true` to prevent premature evaluation. The tool may post a SUCCESS CheckRun after partial data, then correct to FAILURE — but auto-merge already triggered.
 31. **Required Status Checks Completeness**: Every CI quality gate job MUST be added to the branch protection required status checks list. A job that runs and fails but is not required will NOT block the merge. Verify with `gh api repos/{owner}/{repo}/branches/{branch}/protection/required_status_checks`.
-32. **GITHUB_TOKEN Workflow Trigger Limitation**: `GITHUB_TOKEN` pushes (including auto-merge) do NOT trigger subsequent workflow runs on the target branch. CI workflows MUST include `workflow_dispatch` for manual baseline refresh. Coverage tools using `target: auto` will have stale baselines without this.
+32. **GITHUB_TOKEN Workflow Trigger Limitation**: `GITHUB_TOKEN` pushes (including auto-merge) do NOT trigger subsequent workflow runs on the target branch. Workflows that must fire on merge (e.g., Release Pipeline) MUST use `pull_request: types: [closed]` with an `if: github.event.pull_request.merged == true` guard instead of `push:` triggers. CI workflows MUST include `workflow_dispatch` for manual baseline refresh. Coverage tools using `target: auto` will have stale baselines without this. See also #100.
 33. **Pagination/Normalization Tests Must Assert Normalized Values**: Tests exercising pagination defaults (zero/negative page, out-of-range perPage) MUST assert the actual normalized values passed to the repository mock — not just `err == nil`. Capture limit/offset/status via mock fields and verify against expected defaults.
 34. **Concurrent Async API Batching in ViewModels**: When fetching multiple independent API endpoints for a screen/dashboard, ViewModels MUST execute requests concurrently using `coroutineScope` + `async { ... }` instead of sequential `await`s to minimize total network latency. Always cancel any in-flight fetch job before launching a new fetch to prevent stale async responses from overwriting updated state.
 35. **Lifecycle Disposal & Cleanup for ViewModels in Compose**: When a Composable instantiates or remembers a ViewModel with background coroutines/jobs (such as auto-refresh loops or SSE event listeners), use `DisposableEffect(viewModel)` with `onDispose { viewModel.clear() }` to guarantee that background jobs are cancelled when the route unmounts or dependencies change.
@@ -160,3 +160,4 @@ Guidelines below are continuously updated from internal code reviews, CodeRabbit
 97. **Dedicated `onError` Token for Dark Themes**: Dark color schemes MUST define a dedicated dark `onError` color with high contrast over the `error` surface, not reuse `onBackground`/`onSurface` (which are light text colors). Light foreground text (`#f8f8f2`) over a bright error surface (`#ff5555`) fails WCAG contrast. Use a near-black token (e.g., `#1a0a0a`).
 98. **Inline Health Fallback Over Separate Fallback Jobs**: When a ViewModel fetches multiple concurrent API results and some are auth-gated while health is public, the error handler MUST extract health data inline from the already-awaited health result instead of launching a separate fallback job. Separate fallback jobs create race conditions with auto-refresh and SSE-triggered reloads, leading to out-of-order state updates.
 99. **Generation Token for Stale Response Rejection**: ViewModels executing async fetch operations that can be re-triggered (manual refresh, SSE events, auto-refresh) MUST use a monotonic generation counter. Each trigger increments the counter; the async handler captures the generation at start and skips state updates if the generation has advanced (another fetch was triggered while this one was in-flight).
+100. **Release Pipeline Must Use `pull_request: closed` Trigger for Auto-Merge Branches**: Workflows that must run after auto-merge (e.g., Release Pipeline creating RC tags) MUST trigger on `pull_request: types: [closed]` with `if: merged == true`, NOT on `push:` to the target branch. `GITHUB_TOKEN` auto-merges suppress `push` events (#32). The checkout step MUST use `ref: ${{ github.event.pull_request.merge_commit_sha }}` to tag the actual merge commit (not the test merge ref). Git push credentials MUST be configured explicitly via `git remote set-url` with the token since `persist-credentials: false` is required (#80). Add `concurrency` groups keyed on the target branch to prevent duplicate runs.

frontend/webpack.config.d/wasm-assets.js

@@ -0,0 +1,7 @@
+config.module.rules.push({
+    test: /\.wasm$/,
+    type: "asset/resource",
+    generator: {
+        filename: "[name][ext]"
+    }
+});