From 0e06d46740009d0c39564ece1e5b09a0403d2f6f Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Thu, 5 Nov 2026 16:28:38 +0100 Subject: ci: use the changelog section as the release notes Readers see what changed on the download page, with no trip to another document. A tag without a changelog section now fails instead of publishing empty notes. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/deploy_github_releases.yml | 7 +++++-- AGENTS.md | 3 ++- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/deploy_github_releases.yml b/.github/workflows/deploy_github_releases.yml index f78687d1..4c0c7bd9 100644 --- a/.github/workflows/deploy_github_releases.yml +++ b/.github/workflows/deploy_github_releases.yml @@ -37,5 +37,8 @@ jobs: apk="HardenedPass_${TAG}.apk" cp app/build/outputs/apk/release/app-release.apk "$apk" sha256sum "$apk" > "$apk.sha256" - gh release create "$TAG" "$apk" "$apk.sha256" --draft --title "$TAG" \ - --notes "See [CHANGELOG.md](https://github.com/${GITHUB_REPOSITORY}/blob/${TAG}/CHANGELOG.md)." + # The release notes are this version's section of the changelog. + awk -v head="## [${TAG#v}]" 'index($0, head) == 1 { found = 1; next } /^## \[/ { found = 0 } found' \ + CHANGELOG.md > notes.md + grep -q '[^[:space:]]' notes.md || { echo "No CHANGELOG.md section for $TAG"; exit 1; } + gh release create "$TAG" "$apk" "$apk.sha256" --draft --title "$TAG" --notes-file notes.md diff --git a/AGENTS.md b/AGENTS.md index 2b81fc3f..0b2a5005 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -220,5 +220,6 @@ be updated again. `openssl enc -aes-256-cbc -md sha256 -pbkdf2`; the key is the `ENCRYPT_KEY` repository secret. `scripts/signing-setup.sh` decrypts them, `signing-cleanup.sh` deletes them. - Pushing a `vX.Y.Z` tag runs `deploy_github_releases.yml`: it builds the signed APK and creates - a draft GitHub Release with `HardenedPass_vX.Y.Z.apk` and its `.sha256`. + a draft GitHub Release with `HardenedPass_vX.Y.Z.apk` and its `.sha256`. The notes are that + version's `CHANGELOG.md` section in full, so the release fails without one. - Never print, log or commit the keystore password or `ENCRYPT_KEY`. -- cgit v1.2.3