From ab093fe6cab8c97acdffd4b7fceb0626e88592d0 Mon Sep 17 00:00:00 2001
From: Zack Whitson <zwhitson01@gmail.com>
Date: Fri, 7 Aug 2026 05:07:56 -0500
Subject: [PATCH] Write release notes from the changelog instead of commit
 subjects

Every release here is a single squashed commit named after the release, so
--generate-notes produced a note whose entire body restated the title and
linked the PR that produced it. A reader landing on the releases page learned
nothing about what changed.

The note is now the changelog entry for the version being tagged, followed by
install commands and the archive digest with the attestation command to check
it against. If no changelog entry matches the tag, the release fails rather
than publishing an empty note.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 50 ++++++++++++++++++++++++++++++++++-
 1 file changed, 49 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 71a28ae..b657413 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -75,10 +75,58 @@ jobs:
           CHECKSUM: ${{ steps.artifact.outputs.checksum }}
           SBOM: ${{ steps.artifact.outputs.sbom }}
         run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          DIGEST="$(cut -d' ' -f1 "$CHECKSUM")"
+
+          # Release notes are the changelog entry for this version, not a list of
+          # commit subjects. `--generate-notes` on a repo whose only commit per
+          # release is "Release CodeTruss CLI vX" produces a note that says
+          # nothing a reader did not already know from the title.
+          {
+            awk -v ver="## $VERSION " '
+              index($0, ver) == 1 { found = 1; next }
+              found && /^## / { exit }
+              found { print }
+            ' CHANGELOG.md
+
+            cat <<NOTES
+
+          ## Install
+
+          \`\`\`bash
+          curl -fsSL https://codetruss.com/install.sh | sh
+          \`\`\`
+
+          Windows (PowerShell):
+
+          \`\`\`powershell
+          irm https://codetruss.com/install.ps1 | iex
+          \`\`\`
+
+          ## Verify what you installed
+
+          \`\`\`
+          sha256  $DIGEST
+          \`\`\`
+
+          \`\`\`bash
+          gh attestation verify codetruss-cli-$VERSION.tgz --repo $GITHUB_REPOSITORY
+          \`\`\`
+
+          The archive ships with a CycloneDX SBOM and SLSA build provenance. You
+          should not have to take our word for what is in it.
+          NOTES
+          } > release-notes.md
+
+          if [ ! -s release-notes.md ]; then
+            echo "No changelog entry found for $VERSION; refusing to publish an empty release note." >&2
+            exit 1
+          fi
+
           gh release create "$GITHUB_REF_NAME" \
             --draft \
             --verify-tag \
-            --generate-notes \
+            --notes-file release-notes.md \
             --title "CodeTruss CLI $GITHUB_REF_NAME"
           gh release upload "$GITHUB_REF_NAME" \
             "$ARCHIVE" \