Automate tag, stable branch, and GitHub release after changeset publish

Adds five steps to the changeset-release job in release.yml that run
after `pnpm release latest` succeeds:

1. Get version — reads packages/cli/package.json
2. Create tag — bare X.Y.Z, idempotent
3. Create stable branch — only on main with a minor/major bump, idempotent
4. Build release notes — from the .changeset/*.md files consumed by the
   Version Packages merge, with PR + author resolved by walking main's
   first-parent history and reading the merge subject
5. Create GitHub release — reads notes from the file written in step 4,
   --latest=legacy lets GitHub assign the badge by semver

Release notes are scoped to changesets only — anything without a
changeset is excluded by construction. Each step is independently
idempotent, so re-running the workflow recovers from partial failures.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: isaacroldan

.github/workflows/release.yml

@@ -116,6 +116,102 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SHOPIFY_CLI_BUILD_REPO: ${{ github.repository }}
 
+      - name: Get version
+        id: version
+        if: steps.changesets.outputs.hasChangesets == 'false'
+        run: |
+          VERSION=$(node -p "require('./packages/cli/package.json').version")
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Version: $VERSION"
+
+      - name: Create tag
+        if: steps.changesets.outputs.hasChangesets == 'false'
+        env:
+          TAG: ${{ steps.version.outputs.version }}
+        run: |
+          set -euo pipefail
+          if git ls-remote --exit-code --tags origin "$TAG" >/dev/null 2>&1; then
+            echo "Tag $TAG already exists, skipping"
+            exit 0
+          fi
+          git tag "$TAG"
+          git push origin "$TAG"
+          echo "Created tag $TAG"
+
+      - name: Create stable branch
+        if: steps.changesets.outputs.hasChangesets == 'false' && github.ref_name == 'main' && endsWith(steps.version.outputs.version, '.0')
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          set -euo pipefail
+          MINOR=${VERSION%.0}
+          BRANCH="stable/$MINOR"
+          if git ls-remote --exit-code --heads origin "$BRANCH" >/dev/null 2>&1; then
+            echo "Branch $BRANCH already exists, skipping"
+            exit 0
+          fi
+          git push origin "HEAD:refs/heads/$BRANCH"
+          echo "Created branch $BRANCH"
+
+      - name: Build release notes
+        if: steps.changesets.outputs.hasChangesets == 'false'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          PREV=HEAD^1
+          DELETED=$(git diff --name-only --diff-filter=D "$PREV" HEAD -- '.changeset/*.md' | grep -v 'README\.md$' || true)
+
+          NOTES=""
+          while IFS= read -r FILE; do
+            [ -z "$FILE" ] && continue
+            CONTENT=$(git show "$PREV:$FILE")
+            BODY=$(awk '/^---$/{c++;next} c>=2' <<< "$CONTENT" | sed '/./,$!d' | awk 'NF{p=1} p')
+            [ -z "$BODY" ] && continue
+
+            ADD_SHA=$(git log --first-parent --diff-filter=A --format=%H -- "$FILE" | head -1)
+            PR_INFO=""
+            if [ -n "$ADD_SHA" ]; then
+              PR_NUM=$(git log -1 --format=%s "$ADD_SHA" | grep -oE '#[0-9]+' | head -1 | tr -d '#')
+              if [ -n "$PR_NUM" ]; then
+                PR_INFO=$(gh pr view "$PR_NUM" --repo "${GITHUB_REPOSITORY}" \
+                  --json url,author --jq '" by @\(.author.login) in \(.url)"' 2>/dev/null || true)
+              fi
+            fi
+
+            FIRST_LINE=$(head -n 1 <<< "$BODY")
+            REST=$(tail -n +2 <<< "$BODY")
+            ENTRY="- ${FIRST_LINE}${PR_INFO}"
+            if [ -n "$REST" ]; then
+              INDENTED_REST=$(awk '{print "  "$0}' <<< "$REST")
+              ENTRY="${ENTRY}"$'\n'"${INDENTED_REST}"
+            fi
+            NOTES+="${ENTRY}"$'\n\n'
+          done <<< "$DELETED"
+
+          [ -z "$NOTES" ] && NOTES="_No changeset entries for this release._"
+
+          printf '%s' "$NOTES" > release-notes.md
+          echo "--- Generated release notes ---"
+          cat release-notes.md
+
+      - name: Create GitHub release
+        if: steps.changesets.outputs.hasChangesets == 'false'
+        env:
+          TAG: ${{ steps.version.outputs.version }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            echo "Release $TAG already exists, skipping"
+            exit 0
+          fi
+          gh release create "$TAG" \
+            --title "$TAG" \
+            --notes-file release-notes.md \
+            --latest=legacy
+          echo "Created release $TAG"
+
   # Manual/Cron release job - runs on schedule or manual trigger with tag
   manual-cron-release:
     name: Manual & Cron Release