diff options
| -rw-r--r-- | .github/workflows/deploy_github_releases.yml | 7 | ||||
| -rw-r--r-- | AGENTS.md | 3 |
2 files changed, 7 insertions, 3 deletions
diff --git a/.github/workflows/deploy_github_releases.yml b/.github/workflows/deploy_github_releases.yml index f78687d1..4c0c7bd9 100644 --- a/.github/workflows/deploy_github_releases.yml +++ b/.github/workflows/deploy_github_releases.yml @@ -37,5 +37,8 @@ jobs: apk="HardenedPass_${TAG}.apk" cp app/build/outputs/apk/release/app-release.apk "$apk" sha256sum "$apk" > "$apk.sha256" - gh release create "$TAG" "$apk" "$apk.sha256" --draft --title "$TAG" \ - --notes "See [CHANGELOG.md](https://github.com/${GITHUB_REPOSITORY}/blob/${TAG}/CHANGELOG.md)." + # The release notes are this version's section of the changelog. + awk -v head="## [${TAG#v}]" 'index($0, head) == 1 { found = 1; next } /^## \[/ { found = 0 } found' \ + CHANGELOG.md > notes.md + grep -q '[^[:space:]]' notes.md || { echo "No CHANGELOG.md section for $TAG"; exit 1; } + gh release create "$TAG" "$apk" "$apk.sha256" --draft --title "$TAG" --notes-file notes.md @@ -220,5 +220,6 @@ be updated again. `openssl enc -aes-256-cbc -md sha256 -pbkdf2`; the key is the `ENCRYPT_KEY` repository secret. `scripts/signing-setup.sh` decrypts them, `signing-cleanup.sh` deletes them. - Pushing a `vX.Y.Z` tag runs `deploy_github_releases.yml`: it builds the signed APK and creates - a draft GitHub Release with `HardenedPass_vX.Y.Z.apk` and its `.sha256`. + a draft GitHub Release with `HardenedPass_vX.Y.Z.apk` and its `.sha256`. The notes are that + version's `CHANGELOG.md` section in full, so the release fails without one. - Never print, log or commit the keystore password or `ENCRYPT_KEY`. |