🤖 I have created a release *beep* *boop*
---


##
[2.0.0](hve-core-v1.1.0...hve-core-v2.0.0)
(2026-01-28)


### ⚠ BREAKING CHANGES

* **agents:** add Task Reviewer and expand RPI to 4-phase workflow
([#277](#277))

### ✨ Features

* **agents:** add hve-core-installer agent to extension package
([#297](#297))
([c0e48c6](c0e48c6))
* **agents:** add Task Reviewer and expand RPI to 4-phase workflow
([#277](#277))
([ae76cab](ae76cab))
* **build:** add code coverage reporting to Pester workflow
([#230](#230))
([a34822a](a34822a))
* **docs:** add GOVERNANCE.md for OSSF Silver Badge compliance
([#235](#235))
([b0e752c](b0e752c))
* **docs:** add ROADMAP.md for OSSF Silver badge compliance
([#238](#238))
([4a41c16](4a41c16))
* **mcp:** add MCP server configuration guidance and installer
enhancements ([#225](#225))
([0bce418](0bce418))
* **scripts:** add YAML linting with actionlint
([#234](#234))
([d9301f9](d9301f9))
* **security:** add OpenSSF Scorecard workflow and badge
([#271](#271))
([7c6d788](7c6d788))
* **skills:** add video-to-gif conversion skill with FFmpeg two-pass
optimization ([#247](#247))
([8d65c42](8d65c42))
* **tests:** add Pester tests for LintingHelpers and
Validate-MarkdownFrontmatter
([#197](#197),
[#198](#198))
([#205](#205))
([51ae563](51ae563))


### 🐛 Bug Fixes

* **build:** detect table formatting changes via git diff
([#261](#261))
([985eee0](985eee0))
* **build:** disable MD024 lint rule in CHANGELOG for release-please
([#220](#220))
([971df94](971df94))
* **build:** quote shell variables and group redirects in workflow files
([#299](#299))
([3372509](3372509))
* **build:** resolve scorecard badge and workflow security issues
([#301](#301))
([aeaed13](aeaed13))
* **extension:** remove frontmatter from README and exclude from
markdown linting
([#223](#223))
([4272529](4272529))
* **instructions:** quote applyTo glob pattern for YAML compatibility
([#216](#216))
([085199c](085199c))
* **scripts:** add FooterExcludePaths parameter to frontmatter
validation ([#334](#334))
([64db98d](64db98d))
* **scripts:** add GHSA word and logs/ exclusion to cspell config
([#214](#214))
([5c99b3f](5c99b3f))
* **scripts:** correct type assertions in Invoke-YamlLint.Tests.ps1
([#332](#332))
([af7050d](af7050d))
* **scripts:** eliminate false positives in dependency pinning npm
pattern ([#273](#273))
([ccbdfa3](ccbdfa3))
* **security:** add artifact attestation for signed releases
([#257](#257))
([c52d6e2](c52d6e2))
* standardize markdown footers and complete frontmatter
([#217](#217))
([b4e7556](b4e7556))


### 📚 Documentation

* add OpenSSF Best Practices Passing badge to README
([#239](#239))
([91bc529](91bc529))
* **architecture:** add architecture documentation and value proposition
([#252](#252))
([0e4b02f](0e4b02f))
* **contributing:** add testing requirements for OSSF compliance
([#254](#254))
([4db1a18](4db1a18))
* **docs:** add enterprise status badges to README header
([#270](#270))
([ccb68a4](ccb68a4))
* **security:** add security assurance case and threat model for OSSF
Silver ([#259](#259))
([a390e26](a390e26))


### ♻️ Refactoring

* **application:** wrap execution with try blocks, ensure proper …
([#296](#296))
([35c4417](35c4417))
* **scripts:** extract frontmatter validation to testable module
([#293](#293))
([4e8707e](4e8707e))
* **scripts:** extract pure functions for Pester testability
([#221](#221))
([d40e742](d40e742))


### 🔧 Maintenance

* **deps-dev:** bump cspell from 9.4.0 to 9.6.0 in the npm-dependencies
group ([#208](#208))
([855914b](855914b))
* **deps-dev:** bump cspell from 9.6.0 to 9.6.1 in the npm-dependencies
group ([#294](#294))
([1e45ad6](1e45ad6))
* **deps:** bump actions/setup-node from 6.1.0 to 6.2.0 in the
github-actions group
([#209](#209))
([c4c69e2](c4c69e2))
* **deps:** bump the github-actions group with 4 updates
([#295](#295))
([d8337b8](d8337b8))
* remove step-security/harden-runner from workflows
([#246](#246))
([c5708d8](c5708d8))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: hve-core-release-please[bot] <254602402+hve-core-release-please[bot]@users.noreply.github.com>

…it window issue (#342)

## Description

Configure release-please search depths to prevent version detection
failures when the latest release tag is beyond the default commit
scanning window. This addresses a known limitation
([googleapis/release-please#2267](googleapis/release-please#2267))
where release-please fails to find tags older than ~250 commits, causing
it to reprocess the entire commit history and incorrectly detect
already-released breaking changes.

- Added `release-search-depth: 800` at root level to increase release
pagination depth
- Added `commit-search-depth: 1000` at root level to increase commit
scanning depth
- Added `include-component-in-tag: true` to explicitly match the
existing tag format (`hve-core-vX.Y.Z`)

## Related Issue(s)

Related to
[googleapis/release-please#2267](googleapis/release-please#2267)

## Type of Change

Select all that apply:

**Code & Documentation:**

- [x] Bug fix (non-breaking change fixing an issue)
- [ ] New feature (non-breaking change adding functionality)
- [ ] Breaking change (fix or feature causing existing functionality to
change)
- [ ] Documentation update

**Infrastructure & Configuration:**

- [ ] GitHub Actions workflow
- [ ] Linting configuration (markdown, PowerShell, etc.)
- [ ] Security configuration
- [ ] DevContainer configuration
- [ ] Dependency update

**AI Artifacts:**

- [ ] Reviewed contribution with `prompt-builder` agent and addressed
all feedback
- [ ] Copilot instructions (`.github/instructions/*.instructions.md`)
- [ ] Copilot prompt (`.github/prompts/*.prompt.md`)
- [ ] Copilot agent (`.github/agents/*.agent.md`)

> **Note for AI Artifact Contributors**:
>
> - **Agents**: Research, indexing/referencing other project (using
standard VS Code GitHub Copilot/MCP tools), planning, and general
implementation agents likely already exist. Review `.github/agents/`
before creating new ones.
> - **Model Versions**: Only contributions targeting the **latest
Anthropic and OpenAI models** will be accepted. Older model versions
(e.g., GPT-3.5, Claude 3) will be rejected.
> - See [Agents Not
Accepted](../docs/contributing/custom-agents.md#agents-not-accepted) and
[Model Version
Requirements](../docs/contributing/ai-artifacts-common.md#model-version-requirements).

**Other:**

- [ ] Script/automation (`.ps1`, `.sh`, `.py`)
- [ ] Other (please describe):

## Sample Prompts (for AI Artifact Contributions)

N/A - This is a configuration fix, not an AI artifact contribution.

## Testing

- Validated JSON syntax using `node -e
"require('./release-please-config.json')"`
- Verified configuration matches the release-please JSON schema (no IDE
validation errors)
- Expected behavior: Next release-please run will correctly detect the
v2.0.1 tag regardless of commit distance

## Checklist

### Required Checks

- [x] Documentation is updated (if applicable)
- [x] Files follow existing naming conventions
- [x] Changes are backwards compatible (if applicable)
- [ ] Tests added for new functionality (if applicable)

### AI Artifact Contributions

N/A

### Required Automated Checks

The following validation commands must pass before merging:

- [ ] Markdown linting: `npm run lint:md`
- [ ] Spell checking: `npm run spell-check`
- [ ] Frontmatter validation: `npm run lint:frontmatter`
- [ ] Link validation: `npm run lint:md-links`
- [ ] PowerShell analysis: `npm run lint:ps`

## Security Considerations

- [x] This PR does not contain any sensitive or NDA information
- [ ] Any new dependencies have been reviewed for security issues
- [x] Security-related scripts follow the principle of least privilege

## Additional Notes

This fix addresses the erroneous v3.0.0 release PR (#341) that was
created immediately after publishing v2.0.1. The root cause was the
250-commit window limitation causing release-please to reprocess the
entire commit history and re-detect the breaking change from PR #277
that was already released in v2.0.0.

🔧 - Generated by Copilot

… conversion (#545)

## Description

Fixes a race condition where release-please `"draft": true`
configuration caused draft releases that are excluded from the GitHub
Releases API "latest" query, making them invisible to release-please's
own version anchoring within the same workflow invocation. Because the
draft release is invisible, release-please scans the full commit
history, finds an old breaking change (PR #277), and proposes erroneous
v3.0.0 major version bumps. Also added auto-detection of version from
the latest GitHub release tag in both extension publish workflows,
removing the requirement for manual version input on every dispatch.

**Proof the race condition fires in production:** after v2.3.4 merged,
release-please created the v2.3.4 release as draft at 22:05:23 UTC. At
22:08:14 UTC — while v2.3.4 was still draft — release-please opened PR
#547 proposing v3.0.0. The v2.3.4 release was not published until
22:10:08 UTC, confirming that release-please computed the next version
while v2.3.4 was invisible to its own Releases API query.

Additionally, v2.3.2 remains stuck in draft state, demonstrating that
the `publish-release` job's `gh release edit --draft=false` is
unreliable when it depends on upstream jobs that may not always run.

### Changes

- fix(workflows): removed `"draft": true` from root and package level in
`release-please-config.json` so release-please creates published
releases that are immediately visible to the Releases API for version
anchoring
- fix(workflows): removed `"force-tag-creation": true` from
`release-please-config.json` since it requires release-please v17.2.0+
and was silently ignored by the bundled v17.1.3
- fix(workflows): replaced 20-line tag bridge step in `main.yml` with a
`gh release edit --draft=true` post-creation conversion, allowing assets
to be uploaded to a mutable draft release while preserving release
visibility for version anchoring
- feat(workflows): added auto-detection of version from latest GitHub
release tag in `extension-publish-prerelease.yml` when version input is
empty, with ODD minor derivation for the pre-release channel
- feat(workflows): added auto-detection of version from latest GitHub
release tag in `extension-publish.yml` when version input is empty, with
`hve-core-v` prefix stripping
- fix(workflows): updated `extension-publish.yml` input description to
match new auto-detect behavior (was incorrectly referencing
`package.json`)

## Related Issue(s)

Fixes #543

## Type of Change

Select all that apply:

**Code & Documentation:**

- [x] Bug fix (non-breaking change fixing an issue)
- [ ] New feature (non-breaking change adding functionality)
- [ ] Breaking change (fix or feature causing existing functionality to
change)
- [ ] Documentation update

**Infrastructure & Configuration:**

- [x] GitHub Actions workflow
- [ ] Linting configuration (markdown, PowerShell, etc.)
- [ ] Security configuration
- [ ] DevContainer configuration
- [ ] Dependency update

**AI Artifacts:**

- [ ] Reviewed contribution with `prompt-builder` agent and addressed
all feedback
- [ ] Copilot instructions (`.github/instructions/*.instructions.md`)
- [ ] Copilot prompt (`.github/prompts/*.prompt.md`)
- [ ] Copilot agent (`.github/agents/*.agent.md`)
- [ ] Copilot skill (`.github/skills/*/SKILL.md`)

**Other:**

- [ ] Script/automation (`.ps1`, `.sh`, `.py`)
- [ ] Other (please describe):

## Testing

- Validated YAML linting passes via `npm run lint:yaml` — all 25
workflow files passed
- Verified `release-please-config.json` is valid JSON with no schema
errors
- Confirmed the `publish-release` job already contains `gh release edit
--draft=false` to finalize releases after asset upload
- Confirmed `gh release view --json tagName` correctly returns the
latest release tag format (`hve-core-v2.3.4`)

## Checklist

### Required Checks

- [x] Documentation is updated (if applicable)
- [x] Files follow existing naming conventions
- [x] Changes are backwards compatible (if applicable)
- [ ] Tests added for new functionality (if applicable)

### Required Automated Checks

The following validation commands must pass before merging:

- [x] Markdown linting: `npm run lint:md`
- [ ] Spell checking: `npm run spell-check`
- [ ] Frontmatter validation: `npm run lint:frontmatter`
- [ ] Link validation: `npm run lint:md-links`
- [ ] PowerShell analysis: `npm run lint:ps`

## Security Considerations

- [x] This PR does not contain any sensitive or NDA information
- [ ] Any new dependencies have been reviewed for security issues
- [x] Security-related scripts follow the principle of least privilege

## Additional Notes

The release lifecycle after this change follows a four-phase sequence:
release-please creates a **published** release (tag created, visible to
Releases API) → post-creation step converts to **draft** (mutable for
asset upload) → package/attest/upload jobs attach assets →
`publish-release` job converts back to **published**. This preserves the
original HTTP 422 fix from PR #538 while eliminating the version
anchoring race condition that caused PRs #530, #532, #534, #539, #540,
#542, and #547.

### Why the tag bridge didn't work

The tag bridge step from PR #538 manually created git tags after draft
release creation. However, release-please anchors its version
calculation on the GitHub **Releases** API (not the Tags API). Even
though tag `hve-core-v2.3.4` existed at commit `9a72f2b`,
release-please's query for the latest release excluded the draft,
causing it to scan the full commit history and hit the old breaking
change from PR #277.