feat(version-bump): replace inline bash scripts with TypeScript

[GoogilyBoogily]

Summary

Replaces ~110 lines of inline bash in version-bump/action.yml with typed TypeScript scripts. The action YAML becomes a thin orchestrator of named steps.

src/bump-version.ts

• Handles patch/minor/major and pre-release (beta/alpha/rc) bumps
• Uses semver package for dry-run version simulation (no npx semver invocation)
• Updates CHANGELOG.md via String.replace instead of sed -i (portable, no GNU/BSD difference)
• Outputs new_version, writes step summary

src/release-pr.ts

• Creates release branch and PR via octokit.rest.pulls.create instead of gh pr create (eliminates shell injection surface from string interpolation)
• Enables auto-merge via octokit.graphql(enablePullRequestAutoMerge)
• Polls for merge with exponential backoff (10s→20s→40s→60s, 10min max) instead of fixed 30s×20
• Tags and pushes on merge

actions/version-bump/action.yml

• Uses setup-git composite action (from previous PR)
• Calls dist/validate-changelog.js, dist/bump-version.js, dist/release-pr.js
• dry-run input controls both bump simulation and PR skip

package.json

• Added semver, @actions/http-client; @actions/github upgraded to ^9.1.1
• Added overrides.undici to resolve transitive vulnerability in @actions/http-client; npm audit is clean

Test plan

• Trigger version-bump with dry-run: true — logs expected version, no commits or PRs created
• npm audit shows 0 vulnerabilities
• validate-scripts CI passes

[Copilot]

Pull request overview

This PR migrates the version-bump composite action from inline bash to typed TypeScript scripts, aiming to improve portability and reduce shell-related risk while keeping the action YAML as a step orchestrator.

Changes:

• Added TypeScript implementations for version bumping and release PR creation/auto-merge/tagging.
• Updated the version-bump composite action to call dist/*.js scripts instead of inline bash.
• Updated npm dependencies (notably @actions/github) and introduced an undici override.

Reviewed changes

Copilot reviewed 4 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/bump-version.ts	Implements version calculation (including prerelease) and changelog update/commit logic.
src/release-pr.ts	Implements release branch creation, PR creation, auto-merge enablement, merge polling, and tagging.
actions/version-bump/action.yml	Replaces inline bash with Node script invocations; simplifies dry-run handling.
package.json	Adds semver, @actions/http-client, upgrades @actions/github, and adds an undici override.
package-lock.json	Locks updated dependency graph for the new/updated packages.
dist/bump-version.js	Built JS output for the new bump script.
dist/release-pr.js	Built JS output for the new release PR script.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.