ci: release workflow configuration and auth

Author: jasondamour

.github/workflows/release.yml

@@ -1,20 +1,21 @@
 name: Release
 
-permissions:
-  contents: write
-  pull-requests: write
-  issues: write
-
 on:
   workflow_dispatch:
 
 jobs:
   release:
     name: Create Release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup Python
         uses: actions/setup-python@v5
@@ -41,6 +42,7 @@ jobs:
 
       - name: Create Release
         env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GIT_USER_NAME: "github-actions[bot]"
           GIT_AUTHOR_EMAIL: "github-actions[bot]@users.noreply.github.com"
           GIT_COMMITTER_EMAIL: "github-actions[bot]@users.noreply.github.com"

.releaserc.yaml

@@ -0,0 +1,25 @@
+dryRun: false
+debug: true
+
+branches:
+  - name: main
+
+# Order matters
+plugins:
+  - "@semantic-release/commit-analyzer"
+
+  - "@semantic-release/release-notes-generator"
+
+  - "@semantic-release/changelog"
+
+  - - "@semantic-release/exec"
+    - prepareCommand: uv version ${nextRelease.version}
+
+  - - "@semantic-release/git"
+    - message: 'chore(release): ${nextRelease.version} \n\n${nextRelease.notes}'
+      assets:
+        - CHANGELOG.md
+        - pyproject.toml
+        - uv.lock
+
+  - "@semantic-release/github"