chore: sign release version bump commits

[marandaneto]

💡 Motivation and Context

The release workflow's version-bump commit used raw git commit / git push, which fails against the repository rule requiring verified signatures. The workflow also interpolated step outputs directly inside a shell script, which Semgrep blocks as a shell-injection risk.

💚 How did you test it?

• Parsed .github/workflows/release.yml as YAML

📝 Checklist

• I reviewed the submitted code.
• I added tests to verify the changes.
• I updated the docs if needed.
• No breaking change or entry added to the changelog.

If releasing new changes

• Ran pnpm changeset to generate a changeset file

[github-actions]

posthog-dotnet Compliance Report

Date: 2026-05-05 15:20:33 UTC
Duration: 555ms

⚠️ Some Tests Failed

2/16 tests passed, 14 failed

---

Feature_Flags Tests

⚠️ 2/16 tests passed, 14 failed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	❌	44ms
Request Payload.Flags Request Uses V2 Query Param	❌	23ms
Request Payload.Flags Request Hits Flags Path Not Decide	❌	5ms
Request Payload.Flags Request Omits Authorization Header	❌	5ms
Request Payload.Token In Flags Body Matches Init	❌	5ms
Request Payload.Groups Round Trip	❌	5ms
Request Payload.Groups Default To Empty Object	❌	5ms
Request Payload.Person Properties Distinct Id Auto Populated When Caller Omits It	❌	5ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	❌	4ms
Request Payload.Disable Geoip Omitted Defaults To False	❌	5ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	❌	5ms
Request Lifecycle.No Flags Request On Init Alone	✅	3ms
Request Lifecycle.No Flags Request On Normal Capture	✅	180ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	❌	7ms
Request Lifecycle.Mock Response Value Is Returned To Caller	❌	5ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	❌	4ms

Failures

request_payload.request_with_person_properties_device_id

404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'

request_payload.flags_request_uses_v2_query_param

404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'

request_payload.flags_request_hits_flags_path_not_decide

404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'

request_payload.flags_request_omits_authorization_header

404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'

request_payload.token_in_flags_body_matches_init

404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'

request_payload.groups_round_trip

404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'

request_payload.groups_default_to_empty_object

404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'

request_payload.person_properties_distinct_id_auto_populated_when_caller_omits_it

404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'

request_payload.disable_geoip_false_propagates_as_geoip_disable_false

404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'

request_payload.disable_geoip_omitted_defaults_to_false

404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'

request_payload.flag_keys_to_evaluate_contains_only_requested_key

404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'

request_lifecycle.two_flag_calls_produce_two_remote_requests

404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'

request_lifecycle.mock_response_value_is_returned_to_caller

404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'

side_effect_events.get_feature_flag_captures_feature_flag_called_event

404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'

[greptile-apps]

_{Reviews (1): Last reviewed commit: "chore: sign release version bump commits" | Re-trigger Greptile}