Add label-driven release automation - #8

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/scripts/bump_version.py:
- Line 11: The long single-line regex assigned to VERSION_RE exceeds the
100-character limit; split it across lines by using a multi-line string or
re.VERBOSE and combine flags so the pattern stays readable and under 100 chars
per line (e.g., build the pattern with implicit string concatenation or use
re.VERBOSE and pass re.MULTILINE | re.VERBOSE to re.compile) while preserving
the named groups (?P<version>, ?P<minor>, ?P<patch>) and the raw string prefix.

In @.github/workflows/release.yml:
- Line 27: Pin every uses: entry to an immutable commit SHA instead of tag names
for actions referenced (e.g., replace actions/checkout@v4,
actions/github-script@v7, astral-sh/setup-uv@v3, actions/upload-artifact@v4,
actions/download-artifact@v4, pypa/gh-action-pypi-publish@release/v1 with their
corresponding full commit SHAs) and for the second checkout step (the "Checkout
main" checkout action) add with: persist-credentials: false so the GITHUB_TOKEN
is not retained; then enable authentication only on the specific step(s) that
perform git push/tag (configure that push/tag step to use a short-lived token or
set persist-credentials: true just for that step via a separate checkout if
needed).
- Around line 40-45: The "Checkout main" step currently uses actions/checkout@v4
without disabling credential persistence; update that step (named "Checkout
main", referencing uses: actions/checkout@v4 and ref: main) to add
persist-credentials: false so the default GITHUB_TOKEN is not left configured
for subsequent steps, and ensure you explicitly set up an authenticated remote
only for the push step (e.g., by adding a dedicated git remote or using an
authenticated action/step) before "Push version commit and tag".

In `@docs/release-process.md`:
- Line 34: Replace the all-caps platform name "GITHUB" with the proper
capitalization "GitHub" in the document; search for the token "GITHUB"
(including the occurrence in the phrase "PyPI publishing requires a trusted
publisher configured for this repository and the") and update every occurrence
to "GitHub" to ensure consistent, user-facing platform naming.

---

Nitpick comments:
In @.github/workflows/release-labels.yml:
- Around line 17-28: The workflow currently uses actions referenced by tags
(actions/checkout@v4 and actions/github-script@v7); to harden supply-chain
security, replace those tagged references with specific commit SHAs for each
action (e.g., actions/checkout@<commit-sha> and
actions/github-script@<commit-sha>) while keeping the existing pattern that
checks out the default branch and requires the release_labeler.cjs script;
update the two "uses" entries that mention actions/checkout and
actions/github-script accordingly and verify the checkout ref: ${{
github.event.repository.default_branch }} and the labeler import remain
unchanged.

In `@src/mcp_ynab/__init__.py`:
- Around line 17-20: Add an explicit type annotation for the module-level
variable __version__: declare __version__ as a str and keep the existing
try/except that sets it via version("mcp-ynab") and PackageNotFoundError
fallback; update the __version__ assignment site (the try/except block using
version and PackageNotFoundError) to use the annotated variable so the module
consistently follows modern Python typing.

In `@tests/test_release_version.py`:
- Line 9: Add explicit type hints: annotate the helper load_bump_version_module
to return types.ModuleType (or typing.Any if you prefer) and update the test
function signatures to include return type -> None and type the tmp_path fixture
as pathlib.Path; specifically modify load_bump_version_module(), and the test
functions named in the file (eg. test_bump_version_from_pyproject and
test_bump_version_from_setup_py) to accept tmp_path: Path and return None. Also
add the necessary imports (from types import ModuleType and from pathlib import
Path) if not already present.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/mcp_ynab/tools/transactions.py`:
- Around line 1099-1135: The create_scheduled_transaction implementation
violates the declared contract by allowing both payee_id and payee_name to be
sent and truncates amounts; update create_scheduled_transaction to validate
exclusivity (raise ValueError if both payee_id and payee_name are provided) and
ensure milliunit conversion matches the rest of the module by using rounding
(use int(round(amount * 1000))) before passing the value into
SaveScheduledTransaction (reference SaveScheduledTransaction, txn/txn_date, and
the function create_scheduled_transaction for locating the changes).

In `@tests/test_tools.py`:
- Around line 1922-1926: The current assertion checks for "$15.99" in result but
doesn't ensure the negative sign is present; update the test in
tests/test_tools.py to assert the negative sign is included (e.g., require
"-$15.99" in result) or use a regex match against result (for example matching a
leading minus or Unicode minus before $15.99) so the test fails if the negative
sign is dropped; locate the assertion referring to result and replace the final
assert that checks "$15.99" with the stricter check for the negative formatted
amount.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Around line 26-30: The checkout steps currently pin `with: ref: main` which
can cause the release job to operate on a moved main tip; update both checkout
steps (the "Checkout workflow scripts" step and the other actions/checkout at
lines referenced around 40-46) to use the PR merge commit SHA via
`github.event.pull_request.merge_commit_sha` for the release flow (fallback to
`github.sha` or fail fast if the merge SHA is not set), so the release
builds/tags/pushes the exact PR merge commit rather than a moving `main` tip;
alternatively add a guard that compares `main` head with the expected merge SHA
and fails/retries before `git tag`/`git push` if they differ.

In `@src/mcp_ynab/code_mode/examples.md`:
- Around line 119-121: The example calls ynab.write.approve_transactions using
budget_id in the else branch before it’s defined; fix by computing an
effective_budget_id first (e.g., set effective_budget_id =
transactions[0].budget_id if hasattr(transactions[0], "budget_id") else
provided_budget_id or a default) and then pass effective_budget_id to
ynab.write.approve_transactions (reference symbols: transactions, budget_id,
ynab.write.approve_transactions).

In `@src/mcp_ynab/resources.py`:
- Around line 186-190: The loop over groups should skip YNAB groups that are
marked deleted so stale categories aren't rendered; before deriving
group_name/categories/active (in the for group in groups loop in
src/mcp_ynab/resources.py) add a guard that continues if getattr(group,
"deleted", False) is True (or equivalently check group.deleted), and keep the
existing check that continues when there are no non-deleted categories (the
active list) so only non-deleted groups with active categories are processed.

In `@src/mcp_ynab/tools/budgeting.py`:
- Around line 310-317: In move_money, add an early check after resolving
from_category_id and to_category_id to detect if they refer to the same category
(compare the resolved IDs or Category objects) and short-circuit as a no-op
(return immediately) to avoid performing the two-step update that would
incorrectly change the budget; place this check before computing delta
(int(amount * 1000)) and before calling _resolve_month so the function exits
cleanly when from_category_id == to_category_id (or their resolved equivalents).