ci(ci): add infra for maintenance branches

[BenGSchulz]

• .releaserc.json (4 files) — Added --tag ${nextRelease.channel || 'latest'} to publishCmd. No-op on main, passes correct dist-tag on maintenance branches.

• release.yml — Added release/** trigger, per-ref concurrency group, [skip ci] job guard.

• pr-checks.yml — Added release/** target, replaced 2 hardcoded origin/main refs with origin/${{ github.event.pull_request.base.ref }}.

• dev-publish.yml — Added release/** target, replaced hardcoded origin/main with dynamic base ref.

• dev-cleanup.yml — Added release/** target, replaced hardcoded ref: main checkout with dynamic base ref.

• scripts/create-maintenance-branch.sh (new) — Helper script to automate branch creation from a tag with .releaserc.json configuration.

• CONTRIBUTING.md — Added "Maintenance Releases" section documenting the full workflow.

[github-actions]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (PT)
apollo-canvas	🟢 Ready	Preview, Logs	Apr 12, 2026, 10:34:43 PM
apollo-landing	🟢 Ready	Preview, Logs	Apr 12, 2026, 10:32:19 PM
apollo-ui-react	🟢 Ready	Preview, Logs	Apr 12, 2026, 10:33:54 PM
apollo-vertex	🟢 Ready	Preview, Logs	Apr 12, 2026, 10:33:25 PM
apollo-wind	🟢 Ready	Preview, Logs	Apr 12, 2026, 10:33:09 PM

[github-actions]

Dependency License Review

• ✅ 1948 package(s) scanned
• ✅ No license issues found
• ⚠️ 4 package(s) excluded (see details below)

License distribution

License	Packages
MIT	1707
ISC	89
Apache-2.0	61
BSD-3-Clause	28
BSD-2-Clause	23
BlueOak-1.0.0	8
MPL-2.0	5
MIT OR Apache-2.0	3
MIT-0	3
CC0-1.0	3
LGPL-3.0-or-later	2
Unknown	2
(MIT OR Apache-2.0)	2
Unlicense	2
Python-2.0	1
CC-BY-4.0	1
(MPL-2.0 OR Apache-2.0)	1
Artistic-2.0	1
(WTFPL OR MIT)	1
(BSD-2-Clause OR MIT OR Apache-2.0)	1
CC-BY-3.0	1
0BSD	1
(MIT OR CC0-1.0)	1
MIT AND ISC	1

Excluded packages

Package	Version	License	Reason
@img/sharp-libvips-linux-x64	1.2.4	LGPL-3.0-or-later	LGPL pre-built binary, not linked
@img/sharp-libvips-linuxmusl-x64	1.2.4	LGPL-3.0-or-later	LGPL pre-built binary, not linked
@uipath/proteus-client	0.1.10	Unknown	UiPath internal package, Proprietary license
khroma	2.1.0	Unknown	MIT per GitHub repo, missing license field in package.json

[Copilot]

Pull request overview

Adds CI/release support for package-scoped maintenance branches (release/**) so older major lines can receive backported fixes and publish under a dedicated npm dist-tag.

Changes:

• Pass a channel-derived npm dist-tag into the publish script from semantic-release configs.
• Extend GitHub Actions workflows to run on release/** and to diff against the PR’s actual base ref.
• Add a helper script + contributing docs for creating and operating maintenance branches.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
web-packages/ap-chat/.releaserc.json	Publish with a branch/channel-specific dist-tag for maintenance releases.
packages/apollo-wind/.releaserc.json	Same dist-tag publishing change.
packages/apollo-react/.releaserc.json	Same dist-tag publishing change.
packages/apollo-core/.releaserc.json	Same dist-tag publishing change.
scripts/create-maintenance-branch.sh	New automation script to create/configure maintenance branches from tags.
CONTRIBUTING.md	Documents the maintenance release workflow (branching, backports, installs).
.github/workflows/release.yml	Run releases on release/**, per-ref concurrency, skip-ci guard.
.github/workflows/pr-checks.yml	Run PR checks for PRs targeting release/**; diff vs dynamic base ref.
.github/workflows/dev-publish.yml	Enable dev publish for release/**; diff vs dynamic base ref.
.github/workflows/dev-cleanup.yml	Enable cleanup for release/**; checkout dynamic base ref.