From 8c99c6b1ca94e1d2b80dd59bb96eb24b7b3b2dfa Mon Sep 17 00:00:00 2001
From: asepharyana <superaseph@gmail.com>
Date: Thu, 3 Sep 2026 08:33:44 +0700
Subject: [PATCH] fix(ci): Release workflow install semantic-release tanpa
 merusak package.json
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

npm install -D menulis 5 paket semantic-release + 333 dep ke devDependencies
package.json — padahal repo pakai bun.lock. prepareCmd lalu jalankan
'bun install --frozen-lockfile' yang melihat package.json 'terpolusi'
(1561 paket vs 30 di bun.lock) -> 'lockfile had changes, but lockfile is
frozen' -> Release selalu gagal.

Fix: install semantic-release ke prefix terisolasi /tmp/sr-tools + tambah ke
GITHUB_PATH, jalankan 'semantic-release' langsung (bukan npx yang pakai
proses -D). prepareCmd (--frozen-lockfile) dibiarkan benar: bun.lock
version-agnostic, verifikasi lokal lolos.
---
 .github/workflows/release.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f437a52..8d084bc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -40,16 +40,18 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
 
-      - name: Install semantic-release
+      - name: Install semantic-release (isolated prefix — do NOT touch repo package.json)
         run: |
-          npm install -D \
+          mkdir -p /tmp/sr-tools
+          npm install --prefix /tmp/sr-tools \
             semantic-release \
             @semantic-release/exec \
             @semantic-release/git \
             @semantic-release/changelog \
             @semantic-release/github
+          echo "/tmp/sr-tools/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Run semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: npx semantic-release
+        run: semantic-release