release: promote beta to main (publish v2.15.0)

[steilerDev]

Release Summary

Second promotion for v2.15.0. The content of this release already merged to main in #2075 (merge commit df45a58b), but it was never published — semantic-release crashed and the workflow reported success anyway. This promotion carries the one commit that fixes that, so main can actually cut the release.

What happened

Release ran on df45a58b, correctly chose version 2.15.0, then died in generateNotes:

Missing helper: "conventional-changelog-conventionalcommits requires
conventional-changelog-writer@9 or newer"

Because the step ran npx semantic-release 2>&1 || true and decided the outcome by grepping stdout for Created tag v, a crash was indistinguishable from "no releasable commits". The job went green with new-release-published=false, and Merge Back to Beta, Docker publish, Docker Scout, and Docs Deploy all skipped. Full detail in #2082.

Nothing was published for v2.15.0: no git tag, no GitHub Release, no steilerdev/cornerstone:2.15.0 / :2.15 / :latest images, no docs deploy.

Changes

Fixes

• fix(release) (c7c10441, closes Release workflow publishes nothing and reports success: semantic-release generateNotes crash (v2.15.0 never released) #2082) — pins conventional-changelog-conventionalcommits to 9.3.1 and stops release.yml swallowing the semantic-release exit code.

Why 9.3.1 and not simply reverting the bump

The bug is older than the crash. conventional-changelog-writer@8 is handlebars-based and expects partials as template strings; writer 9 replaced handlebars with @conventional-changelog/template, whose partials are JS functions. ccc 10.x emits function partials while @semantic-release/release-notes-generator@14 still pins writer ^8 — and handing functions to handlebars doesn't throw, it renders an empty changelog.

That is why release notes have been hollow for months:

Release	Body size
v2.15.0-beta.6	116 bytes — compare-link header only
v2.15.0-beta.5	116 bytes
v2.14.0	2845 bytes, but only because RELEASE_SUMMARY.md is prepended

ccc 10.3.0 added a deliberate poison pill to turn that silence into a loud failure, so the Dependabot bump exposed the bug rather than causing it. Reverting to 10.2.1 would have restored the silence, not the notes. 9.3.1 is the last release on the writer-8 line and keeps every package inside its declared range with no overrides.

Verification — the fix is proven, not assumed

Merging c7c10441 to beta published v2.15.0-beta.7 with 1726 bytes of properly grouped notes (Bug Fixes / Documentation / Chores / Continuous Integration), and the downstream jobs that had been silently skipping all ran: Docker Build (linux/amd64), Docker Build (linux/arm64), Docker, and Docker Scout all succeeded.

Change Inventory

Docs / Config

• package.json, package-lock.json — ccc 10.4.0 → 9.3.1; lockfile delta is 35 lines, confined to that downgrade plus the orphaned @conventional-changelog/template
• .github/workflows/release.yml — capture and honour the semantic-release exit status; ::error annotation; distinct "Release Failed" job summary
• .github/dependabot.yml — narrow version-update:semver-major ignore for that one package
• .claude/agent-memory/product-architect/** — toolchain notes

Reviews

• security-engineer — APPROVED. Independently re-queried npm's bulk advisory endpoint for all 1798 package/version pairs in the regenerated lockfile: zero advisories against conventional-changelog-*, compare-func, semantic-release, or release-notes-generator. Confirmed the lockfile integrity hash matches the registry, the Dependabot ignore is appropriately narrow with a concrete removal condition, and the workflow change does not widen what reaches public logs.
• product-architect authored the fix, so its review is skipped per the PR Review Gate.

Expected on merge

Release runs on main and publishes v2.15.0: git tag, GitHub Release (notes enriched from RELEASE_SUMMARY.md), Docker 2.15.0 / 2.15 / latest, docs site deploy, and the automated merge-back PR into beta.

Validation

The application code is unchanged from #2075, which was already validated and approved — this promotion touches only release tooling. The v2.15.0 UAT checklist from #2075 still stands, in particular the Diary scenarios on #2060 that have not been walked through.

Testing

• DockerHub beta image: docker pull steilerdev/cornerstone:beta

🤖 Generated with Claude Code

[github-actions]

🎉 This PR is included in version 2.15.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀