chore: test git autotagging

.github/PULL_REQUEST_TEMPLATE/pull_request_template.md

@@ -0,0 +1,55 @@
+## 📝 Overview
+
+_What does this PR do? Briefly describe the changes and the goal of this PR._
+
+## 🚀 Type of Change
+
+- [ ] 🐛 **Bug Fix**: Fixed something that was broken.
+- [ ] ✨ **New Feature**: Added new functionality or pages.
+- [ ] 🗄️ **CMS / Database**: Updated collections, fields, or config in Payload CMS.
+- [ ] 🧹 **Chore / Clean up**: Text updates, typos, or code cleanup.
+
+---
+
+## 🧱 CMS & Database Changes
+
+_Skip this section if no CMS or database changes were made._
+
+- [ ] **Migration Created**: Ran `payload migrate:create` and saved the file.
+- [ ] **Local Verification**: Verified changes in the local admin panel.
+
+### 📊 Data Structure
+
+_Describe the new fields/tables or drag-and-drop a screenshot here:_
+
+---
+
+## 🧪 Testing & Validation
+
+- [ ] **Test Case Approval**: Verified that test cases were commented on the assigned GitHub issue and approved by the Project Lead _before_ development started.
+- [ ] **Unit Tests**: Added or updated unit test scripts covering the new logic.
+- [ ] **Admin Panel**: Verified behavior in the CMS Admin UI.
+- [ ] **API Check**: Tested REST/GraphQL endpoints for correct data.
+
+### 📸 Visual Evidence (Mandatory)
+
+> [!IMPORTANT]
+> Visual proof is required to demonstrate that the approved test cases from the issue were successfully met.
+> Please provide screenshots, screen recordings (GIFs/Videos), or sample API outputs proving that the feature satisfies all approved test cases and do not introduce regressions.
+
+---
+
+## 📋 Final Checklist
+
+- [ ] **Sync**: Rebased from `main` and resolved conflicts.
+- [ ] **Pre-commit**: Installed and ran pre-commit hooks successfully.
+- [ ] **Security**: Verified no secrets or local credentials are included.
+- [ ] **Build**: Project builds without errors.
+- [ ] **Visuals**: Attached mandatory visual evidence proving all test cases passed.
+- [ ] **Migrations**: Migration script included (if applicable).
+
+---
+
+## 🧠 Extra Notes / Questions
+
+_Add any additional context or questions for the reviewers here._

.github/PULL_REQUEST_TEMPLATE/release_production.md

@@ -0,0 +1,31 @@
+## 🚀 Production Release PR
+
+> [!IMPORTANT] > **Action Required**: You MUST apply one of the following labels to this PR in the GitHub sidebar before merging:
+>
+> - `release:major` (Breaking changes — e.g., `1.0.0` ➡️ `2.0.0`)
+> - `release:minor` (New features / non-breaking schema additions — e.g., `1.0.0` ➡️ `1.1.0`)
+> - `release:patch` (Bug fixes / chores — e.g., `1.0.0` ➡️ `1.0.1`)
+>
+> This label is required by the CD workflow to calculate the version bump and publish the release.
+
+---
+
+## 📝 Release Summary
+
+_Briefly summarize the major changes included in this release._
+
+## 📊 Included Changes (from main)
+
+_List the features or fixes being promoted, or link to the PRs/Issues._
+
+- [ ] Feature/Fix 1 (#PR-number)
+- [ ] Feature/Fix 2 (#PR-number)
+
+---
+
+## 📋 Release Checklist
+
+- [ ] **CI Validation**: Verify that the CI checks have passed on `main`.
+- [ ] **PR Labels**: Applied the appropriate `release:major`, `release:minor`, or `release:patch` label to this PR.
+- [ ] **Database Migrations**: Verified that any database migration scripts are tested and ready for production.
+- [ ] **QA Approval**: Changes have been tested and verified in staging/dev environment.

.github/pull_request_template.md

@@ -0,0 +1 @@
+PULL_REQUEST_TEMPLATE/pull_request_template.md

.github/release.yml

@@ -0,0 +1,41 @@
+changelog:
+  exclude:
+    labels:
+      - ignore-release
+      - duplicate
+    authors:
+      - github-actions[bot]
+      - dependabot[bot]
+
+  categories:
+    - title: '🚀 Features'
+      labels:
+        - feature
+        - feat
+        - enhancement
+
+    - title: '🐛 Bug Fixes'
+      labels:
+        - bug
+        - fix
+        - hotfix
+
+    - title: '📖 Documentation'
+      labels:
+        - documentation
+        - docs
+
+    - title: '⚙️ Refactoring & Infrastructure'
+      labels:
+        - refactor
+        - chore
+        - ci
+
+    - title: '📦 Dependency Updates'
+      labels:
+        - dependencies
+        - dependency
+
+    - title: '🏡 Other Changes'
+      labels:
+        - '*'

.github/workflows/cd.yml

@@ -1,40 +1,37 @@
-name: CMS Continuous Delivery
+name: Production CD Pipeline
 
 on:
+  push:
+    branches:
+      - release/production
   workflow_dispatch:
+    inputs:
+      bump_type:
+        description: 'SemVer bump type (used if manual run)'
+        required: true
+        default: 'patch'
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
 
 permissions:
   id-token: write
-  contents: read
+  contents: write
   actions: read
-  security-events: write
+  pull-requests: read
 
 jobs:
   deploy:
     name: Build & Production Deploy
-    if: github.ref_name == 'production'
     runs-on: ubuntu-latest
     environment: production
     steps:
-      - name: Verify CI Workflow Completion
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          echo "Checking the status of the latest 'CMS Continuous Integration' run for branch '${{ github.ref_name }}'..."
-          conclusion=$(gh run list --workflow "CMS Continuous Integration" --branch "${{ github.ref_name }}" --limit 1 --json conclusion --jq '.[0].conclusion')
-
-          if [ -z "$conclusion" ]; then
-            echo "❌ No runs found for the CI workflow on branch '${{ github.ref_name }}'."
-            exit 1
-          elif [ "$conclusion" != "success" ]; then
-            echo "❌ The latest run of the CI workflow on branch '${{ github.ref_name }}' is not successful (status: $conclusion)."
-            exit 1
-          fi
-
-          echo "✅ The latest CI workflow run completed successfully."
-
       - name: Checkout Source Code
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Authenticate to AWS
         uses: aws-actions/configure-aws-credentials@v4
@@ -62,6 +59,13 @@ jobs:
           mask-values: true
           recursive: true
 
+      - name: Determine and Apply Version Bump
+        id: version-bump
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BUMP_TYPE_INPUT: ${{ github.event.inputs.bump_type }}
+        run: ./scripts/bump-version.sh
+
       - name: Install Dependencies
         run: npm ci --legacy-peer-deps
 
@@ -101,7 +105,7 @@ jobs:
           file: docker/lambda/Dockerfile
           load: true
           tags: |
-            ${{ steps.login-ecr.outputs.registry }}/durianpy-cms-prod:${{ github.sha }}
+            ${{ steps.login-ecr.outputs.registry }}/durianpy-cms-prod:${{ steps.version-bump.outputs.new_tag }}
           secrets: |
             payload_secret=${{ steps.ssm-param.outputs.PAYLOAD_SECRET }}
             database_url=${{ steps.ssm-param.outputs.DATABASE_URL }}
@@ -113,37 +117,57 @@ jobs:
             AWS_DEFAULT_REGION=ap-southeast-1
             ENVIRONMENT=production
 
-      - name: Codebase Scan (Vulnerabilities & Misconfigurations)
-        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
-        with:
-          scan-type: 'fs'
-          scan-ref: '.'
-          scanners: 'vuln,misconfig'
-          format: 'sarif'
-          output: 'trivy-results.sarif'
-          severity: 'CRITICAL,HIGH'
-          skip-files: '.env.ci-build'
-
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: 'trivy-results.sarif'
-
       - name: Push Image
         if: success()
         run: |
-          docker push ${{ steps.login-ecr.outputs.registry }}/durianpy-cms-prod:${{ github.sha }}
+          docker push ${{ steps.login-ecr.outputs.registry }}/durianpy-cms-prod:${{ steps.version-bump.outputs.new_tag }}
 
       - name: Summarize Build
         if: always()
         run: |
           echo "### 🚢 Deployment Summary" >> $GITHUB_STEP_SUMMARY
-          echo "Image: \`${{ steps.login-ecr.outputs.registry }}/durianpy-cms-prod:${{ github.sha }}\`" >> $GITHUB_STEP_SUMMARY
-          echo "Security Scan: Results uploaded to the GitHub Security tab." >> $GITHUB_STEP_SUMMARY
+          echo "Image: \`${{ steps.login-ecr.outputs.registry }}/durianpy-cms-prod:${{ steps.version-bump.outputs.new_tag }}\`" >> $GITHUB_STEP_SUMMARY
 
       - name: Deploy to AWS Lambda
         if: success()
         run: |
           aws lambda update-function-code \
             --function-name durianpy-cms-prod \
-            --image-uri ${{ steps.login-ecr.outputs.registry }}/durianpy-cms-prod:${{ github.sha }}
+            --image-uri ${{ steps.login-ecr.outputs.registry }}/durianpy-cms-prod:${{ steps.version-bump.outputs.new_tag }}
+
+      - name: Commit and Push Version Bump and CHANGELOG
+        if: success()
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NEW_TAG: ${{ steps.version-bump.outputs.new_tag }}
+        run: |
+          # 1. Generate release notes from GitHub API
+          echo "Generating release notes for $NEW_TAG..."
+          RELEASE_NOTES=$(gh release generate-notes --tag "$NEW_TAG" --target "release/production")
+
+          # 2. Prepend notes to CHANGELOG.md
+          DATE_STR=$(date +%Y-%m-%d)
+          if [ -f CHANGELOG.md ]; then
+            echo -e "# Release $NEW_TAG ($DATE_STR)\n\n$RELEASE_NOTES\n\n$(cat CHANGELOG.md)" > CHANGELOG.md
+          else
+            echo -e "# Release $NEW_TAG ($DATE_STR)\n\n$RELEASE_NOTES" > CHANGELOG.md
+          fi
+
+          # 3. Commit and push changes
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add package.json CHANGELOG.md
+          git commit -m "chore(release): bump version to $NEW_TAG and update CHANGELOG [skip ci]"
+          git push origin release/production
+
+      - name: Create Git Tag and Release
+        if: success()
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NEW_TAG: ${{ steps.version-bump.outputs.new_tag }}
+        run: |
+          echo "🚀 Creating GitHub Release for $NEW_TAG..."
+          gh release create "$NEW_TAG" \
+            --title "Release $NEW_TAG" \
+            --generate-notes \
+            --target "release/production"

.github/workflows/ci.yml

@@ -1,4 +1,4 @@
-name: CMS Continuous Integration
+name: CI Pipeline
 
 on:
   pull_request: