diff options
| author | Danilo M. <danix@danix.xyz> | 2026-11-05 16:28:38 +0100 |
|---|---|---|
| committer | Danilo M. <danix@danix.xyz> | 2026-11-05 16:28:38 +0100 |
| commit | 0e06d46740009d0c39564ece1e5b09a0403d2f6f (patch) | |
| tree | b08d2b835a46319c2abc939b431e6c82fa351b0f | |
| parent | a93ec3fcdef07392f8db90fa3c8b68fb88bd9f96 (diff) | |
| download | HardenedPass-0e06d46740009d0c39564ece1e5b09a0403d2f6f.tar.gz HardenedPass-0e06d46740009d0c39564ece1e5b09a0403d2f6f.zip | |
ci: use the changelog section as the release notes
Readers see what changed on the download page, with no trip to another document.
A tag without a changelog section now fails instead of publishing empty notes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
| -rw-r--r-- | .github/workflows/deploy_github_releases.yml | 7 | ||||
| -rw-r--r-- | AGENTS.md | 3 |
2 files changed, 7 insertions, 3 deletions
diff --git a/.github/workflows/deploy_github_releases.yml b/.github/workflows/deploy_github_releases.yml index f78687d1..4c0c7bd9 100644 --- a/.github/workflows/deploy_github_releases.yml +++ b/.github/workflows/deploy_github_releases.yml @@ -37,5 +37,8 @@ jobs: apk="HardenedPass_${TAG}.apk" cp app/build/outputs/apk/release/app-release.apk "$apk" sha256sum "$apk" > "$apk.sha256" - gh release create "$TAG" "$apk" "$apk.sha256" --draft --title "$TAG" \ - --notes "See [CHANGELOG.md](https://github.com/${GITHUB_REPOSITORY}/blob/${TAG}/CHANGELOG.md)." + # The release notes are this version's section of the changelog. + awk -v head="## [${TAG#v}]" 'index($0, head) == 1 { found = 1; next } /^## \[/ { found = 0 } found' \ + CHANGELOG.md > notes.md + grep -q '[^[:space:]]' notes.md || { echo "No CHANGELOG.md section for $TAG"; exit 1; } + gh release create "$TAG" "$apk" "$apk.sha256" --draft --title "$TAG" --notes-file notes.md @@ -220,5 +220,6 @@ be updated again. `openssl enc -aes-256-cbc -md sha256 -pbkdf2`; the key is the `ENCRYPT_KEY` repository secret. `scripts/signing-setup.sh` decrypts them, `signing-cleanup.sh` deletes them. - Pushing a `vX.Y.Z` tag runs `deploy_github_releases.yml`: it builds the signed APK and creates - a draft GitHub Release with `HardenedPass_vX.Y.Z.apk` and its `.sha256`. + a draft GitHub Release with `HardenedPass_vX.Y.Z.apk` and its `.sha256`. The notes are that + version's `CHANGELOG.md` section in full, so the release fails without one. - Never print, log or commit the keystore password or `ENCRYPT_KEY`. |