ci(release): drive releases with release-please, held below 1.0 (LAB-5117)

[27Bslash6]

Releases now go through release-please, and the version stays below 1.0.

• release-please (rust release type, same changelog sections as the other CacheKit SDKs) runs on every push to main and keeps a release PR open with the next version and changelog. bump-minor-pre-major is on, so a breaking change bumps the minor version while the crate is below 1.0. The first release is 0.1.0: the Rust strategy's initial version. The manifest starts at 0.0.0.
• One workflow, one run. Merging the release PR creates the tag and GitHub Release. The same run then checks out that tag, tests and builds each target, attests the archives and binaries, uploads them to the release, and publishes the crate through crates.io trusted publishing. Tags created by the App token do not trigger workflows, so the old tag trigger is gone. A pushed tag releases nothing.
• Verify command. The README now adds --source-ref refs/heads/main, so an attestation only passes if the release workflow ran from main.
• The release PR is assigned to the maintainer, as in the other SDKs, and the App token is scoped to contents, pull requests and issues.

Needs the APP_ID and APP_PRIVATE_KEY repository secrets for the release App before merge; without them the release-please job fails on every push to main.

Closes LAB-5117

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

[27Bslash6]

Verification of the first release, v0.1.0, built by Release run 37159870532 from 702e0b3, using the command the README documents:

gh attestation verify <file> --repo cachekit-io/cachekit-cli \
  --signer-workflow cachekit-io/cachekit-cli/.github/workflows/release.yml \
  --source-ref refs/heads/main --deny-self-hosted-runners

File	Exit	Signer workflow	Source ref	Runner	Source commit
ck-v0.1.0-x86_64-unknown-linux-musl.tar.gz	0	.github/workflows/release.yml@refs/heads/main	refs/heads/main	github-hosted	702e0b3e05f4f3e99b73b16635e483165cb214bd
ck-v0.1.0-aarch64-unknown-linux-musl.tar.gz	0	same	refs/heads/main	github-hosted	same
ck-v0.1.0-aarch64-apple-darwin.tar.gz	0	same	refs/heads/main	github-hosted	same
ck unpacked from the x86_64 archive	0	same	refs/heads/main	github-hosted	same

The unpacked binary's SHA-256 is a0b1a96affe49c18a332ddc20674596ddf160ec24bfaea905503ca7d43f2f1c2, which matches its subject in the attestation. With --source-ref refs/heads/other, the same archive fails with exit 1: expected SourceRepositoryRef to be refs/heads/other, got refs/heads/main.

crates.io records cachekit-cli 0.1.0 as published through trusted publishing from the same run (trustpub_data: provider github, run 37159870532, sha 702e0b3). cargo install --locked cachekit-cli --version 0.1.0 installs ck.