Address review feedback: fix jq normalization, response format, permissions, and changelog default

- Split label extraction into two lines so tr normalization always runs
- Standardize responseFormat to match detect-breaking.prompt.yml shape
- Bump maxCompletionTokens from 10 to 25 for JSON output headroom
- Restore top-level permissions so reusable security workflow gets security-events:write
- Default RELEASE_CHANGELOG to empty string so GoReleaser template doesn't fail on missing key

Author: jeremy

.github/prompts/classify-pr.prompt.yml

@@ -19,23 +19,23 @@ messages:
       When a PR mixes categories: bug > enhancement > documentation.
       Prefer diff evidence over the PR title.
 model: openai/gpt-4o-mini
-responseFormat:
-  type: json_schema
-  json_schema:
-    name: classification
-    strict: true
-    schema:
-      type: object
-      properties:
-        label:
-          type: string
-          enum:
-            - bug
-            - enhancement
-            - documentation
-      required:
-        - label
-      additionalProperties: false
+responseFormat: json_schema
+jsonSchema: |-
+  {
+    "name": "classification",
+    "strict": true,
+    "schema": {
+      "type": "object",
+      "properties": {
+        "label": {
+          "type": "string",
+          "enum": ["bug", "enhancement", "documentation"]
+        }
+      },
+      "required": ["label"],
+      "additionalProperties": false
+    }
+  }
 modelParameters:
-  maxCompletionTokens: 10
+  maxCompletionTokens: 25
   temperature: 0

.github/workflows/ai-labeler.yml

@@ -80,7 +80,8 @@ jobs:
           RESPONSE_FILE: ${{ steps.classify.outputs.response-file }}
           PR: ${{ github.event.pull_request.number }}
         run: |
-          LABEL=$(jq -r '.label // empty' "$RESPONSE_FILE" 2>/dev/null || tr -d '[:space:]' < "$RESPONSE_FILE" | tr '[:upper:]' '[:lower:]')
+          LABEL=$(jq -r '.label // empty' "$RESPONSE_FILE" 2>/dev/null || cat "$RESPONSE_FILE")
+          LABEL=$(printf '%s' "$LABEL" | tr -d '[:space:]' | tr '[:upper:]' '[:lower:]')
           case "$LABEL" in
             bug|enhancement|documentation) ;;
             *) echo "Unexpected: $LABEL — skipping"; exit 0 ;;

.github/workflows/release.yml

@@ -5,6 +5,13 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: write
+  id-token: write
+  security-events: write
+  pull-requests: read
+  models: read
+
 jobs:
   test:
     uses: ./.github/workflows/test.yml
@@ -182,10 +189,11 @@ jobs:
           MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
           MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
         run: |
+          RELEASE_CHANGELOG=""
           if [ -n "$CHANGELOG_FILE" ] && [ -f "$CHANGELOG_FILE" ]; then
             RELEASE_CHANGELOG=$(cat "$CHANGELOG_FILE")
-            export RELEASE_CHANGELOG
           fi
+          export RELEASE_CHANGELOG
           goreleaser release --clean
 
       - name: Check CLI surface compatibility