chore: cut 1.9.0

[danielmeppiel]

TL;DR

Rename ## [Unreleased] -> ## [1.9.0] - 2026-05-18 in CHANGELOG.md, document the apm-version default bump under Changed, and bump the default in action.yml from 0.13.0 to 0.14.0. Release-machinery only - no source changes.

Draft until apm CLI v0.14.0 ships

Blocked on microsoft/apm#1372 merging + the v0.14.0 tag being pushed. The default-bump in action.yml would resolve to a 404 install before v0.14.0 exists on GitHub Releases.

Once v0.14.0 is tagged, mark this PR ready, merge, then:

git tag -a v1.9.0 -m "v1.9.0"
git tag -f v1
git push origin v1.9.0
git push -f origin v1
gh release create v1.9.0 --notes-from-tag

Why this PR exists

apm-action mode: release (the flagship feature of this cut) calls apm pack --check-versions --check-clean --json. Those flags landed in apm CLI #1365 and are tagged for v0.14.0. Cutting v1.9.0 without bumping the apm-version default to 0.14.0 would ship an action whose flagship feature is broken against its own default install.

So this PR pairs:

1. The cut (Unreleased -> 1.9.0)
2. The default-version bump (0.13.0 -> 0.14.0) and its Changed entry

What's in 1.9.0

• mode: release umbrella (microsoft/apm#1348) - single input collapses gate + matrix pack + sha256 sidecars + drift detection + Step Summary + gh release create into one step
• New inputs: mode, release-tag, release-name, release-notes, release-draft, release-prerelease (true/false/auto), release-skip-publish
• New outputs: packages (JSON), marketplace-drift, release-url, release-tag; packages always set to '[]' outside mode: release so fromJSON() consumers never break
• Mutually exclusive with classic dispatch surface (pack, bundle, bundles-file, setup-only) - one consolidated error if mixed
• Reference workflow: tests/fixtures/release/ (aggregator + single-plugin)
• Default apm-version bumped 0.13.0 -> 0.14.0

How to test

Local (post-tag):

# In a release-shaped consumer repo
- uses: microsoft/apm-action@v1.9.0
  with:
    mode: release
    release-tag: v1.0.0
    release-skip-publish: 'true'  # dry-run

Live attestation on DevExpGbb/zava-agent-config is planned post-tag - that repo today hand-rolls ~150 lines of release.yml that mode: release collapses to ~20.

Validation evidence

Gate	Status
npm test	181 passed across 5 suites
Source changes	None - cut + default-bump only

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

This PR prepares the apm-action v1.9.0 release by moving current changelog entries into a release section and bumping the default APM CLI version used by the action.

Changes:

• Adds a 1.9.0 changelog section dated 2026-05-18.
• Documents the apm-version default bump to 0.14.0.
• Updates action.yml so the default installed APM CLI is 0.14.0.

Show a summary per file

File	Description
CHANGELOG.md	Adds the v1.9.0 release section and documents the default CLI bump.
action.yml	Updates the apm-version input example and default from 0.13.0 to 0.14.0.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 2

[danielmeppiel]

Good catch -- fixed in 77f3b29. Added [1.9.0]: ...compare/v1.8.0...v1.9.0 and bumped [Unreleased] to compare from v1.9.0.

[danielmeppiel]

Declining -- the v0.14.0 bump is the intentional core of this cut, not a stowaway.

Why the bump is required, not optional: mode: release (the flagship feature of v1.9.0) calls apm pack --check-versions --check-clean --json. Those flags landed in apm CLI #1365 and only exist as of v0.14.0. Cutting v1.9.0 while keeping the default at 0.13.0 would ship an action whose own flagship feature is broken against its own default install. The PR body calls this out explicitly.

MCP Registry v0.1 scope is narrower than it reads: the breaking surface in apm#1337 only affects users who install MCP servers from a self-hosted registry serving /v0/ paths. Both public registries (api.mcp.github.com, registry.modelcontextprotocol.io) are unaffected. The intersection of (1) using apm-action in CI, (2) installing MCP servers via apm install rather than directly, and (3) sourcing them from a self-hosted v0-only registry is a vanishingly small slice of users.

Affected users have a one-line escape hatch: with: { apm-version: '0.13.5' } pins the old CLI. The CHANGELOG entry and PR body both document the upgrade and the workaround.

Not a major-version trigger: floating v1 already tracks CLI bumps (we've moved through 0.10.x -> 0.13.x without majoring), the breaking change is squarely in the CLI's documented ### Breaking section, and SemVer for the action surface remains intact (no apm-action input/output contract change in this minor).