refactor: remove automated CHANGELOG commits for security

Based on security research, allowing github-actions bot to bypass branch
protection creates attack vectors for malicious workflows. Following best
practices from Google's release-please and industry standards, CHANGELOG.md
is now manually maintained.

Changes:
- Remove CHANGELOG auto-update and commit steps from workflow
- Add verification step to check CHANGELOG was updated
- Update documentation to reflect manual process
- Simplifies workflow and eliminates branch protection conflicts

Security benefits:
- No bypass permissions needed (eliminates attack surface)
- Manual review ensures quality release notes
- Follows GitHub security best practices
- Matches workflow used by major OSS projects

References:
- https://medium.com/cider-sec/bypassing-required-reviews-using-github-actions-6e1b29135cc7
- https://github.com/googleapis/release-please-action

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: bitwize-music

.github/workflows/auto-release.yml

@@ -79,53 +79,19 @@ jobs:
           --notes-file /tmp/release_notes.md \
           $PRERELEASE
 
-    - name: Update CHANGELOG
+    - name: Verify CHANGELOG was updated
       if: steps.check_tag.outputs.exists == 'false'
-      env:
-        RELEASE_VERSION: ${{ steps.version.outputs.version }}
-      run: |
-        export RELEASE_DATE=$(date +%Y-%m-%d)
-
-        python3 << 'PYTHON_SCRIPT'
-        import os
-        import re
-        from datetime import date
-
-        version = os.environ['RELEASE_VERSION']
-        release_date = os.environ['RELEASE_DATE']
-
-        with open('CHANGELOG.md', 'r') as f:
-            content = f.read()
-
-        # Replace [Unreleased] with [X.Y.Z] - DATE
-        content = content.replace('## [Unreleased]', f'## [{version}] - {release_date}')
-
-        # Add new [Unreleased] section
-        new_section = "## [Unreleased]\n\n### Added\n\n### Changed\n\n### Fixed\n\n"
-        # Insert new section before the versioned release
-        content = content.replace(f'## [{version}] - {release_date}', new_section + f'## [{version}] - {release_date}')
-
-        with open('CHANGELOG.md', 'w') as f:
-            f.write(content)
-
-        print("CHANGELOG.md updated")
-        PYTHON_SCRIPT
-
-    - name: Commit CHANGELOG update
-      if: steps.check_tag.outputs.exists == 'false'
-      continue-on-error: true
       run: |
-        git config user.name "github-actions[bot]"
-        git config user.email "github-actions[bot]@users.noreply.github.com"
-        git add CHANGELOG.md
+        VERSION="${{ steps.version.outputs.version }}"
 
-        # Only commit if there are changes
-        if git diff --cached --quiet; then
-          echo "No CHANGELOG changes to commit"
-          exit 0
+        # Check if this version exists in CHANGELOG
+        if grep -q "## \[$VERSION\]" CHANGELOG.md; then
+          echo "✅ CHANGELOG.md contains release notes for version $VERSION"
+        else
+          echo "⚠️  WARNING: CHANGELOG.md does not contain section for version $VERSION"
+          echo ""
+          echo "The release was created, but please update CHANGELOG.md manually:"
+          echo "1. Rename [Unreleased] to [$VERSION] - $(date +%Y-%m-%d)"
+          echo "2. Add new [Unreleased] section above it"
+          echo "3. Commit and push to main"
         fi
-
-        git commit -m "chore: update CHANGELOG for ${{ steps.version.outputs.version }} release [skip ci]"
-
-        # Try to push, but don't fail if branch protection prevents it
-        git push || echo "⚠️  Could not push CHANGELOG update due to branch protection. Please update manually."

CHANGELOG.md

@@ -9,9 +9,10 @@ This project uses [Conventional Commits](https://conventionalcommits.org/) and [
 ### Added
 
 ### Changed
+- CHANGELOG.md is now manually maintained (no automated commits) for security and quality
+- Auto-release workflow verifies CHANGELOG was updated instead of attempting to modify it
 
 ### Fixed
-- Auto-release workflow now continues successfully even when branch protection prevents CHANGELOG commit
 
 ## [0.5.1] - 2026-01-25
 

CLAUDE.md

@@ -40,14 +40,17 @@ This plugin uses [Semantic Versioning](https://semver.org/) with [Conventional C
 **Release process:**
 1. Update entries in `CHANGELOG.md` under `[Unreleased]` as you work
 2. When ready to release:
+   - Finalize `CHANGELOG.md`: Rename `[Unreleased]` → `[0.x.0] - YYYY-MM-DD`
+   - Add new `[Unreleased]` section above it
    - Update version in `.claude-plugin/plugin.json`
    - Update version in `.claude-plugin/marketplace.json` (must match plugin.json)
 3. Commit: `chore: release 0.x.0`
 4. Push to main → **Automated workflow**:
    - Creates git tag `v0.x.0`
    - Creates GitHub release with CHANGELOG notes
-   - Updates CHANGELOG.md (renames [Unreleased] → [0.x.0] with date)
-   - Commits CHANGELOG update back to main
+   - Verifies CHANGELOG was updated for this version
+
+**Note:** CHANGELOG.md is manually maintained to ensure quality release notes and maintain security (no branch protection bypass needed).
 
 **Version files (must stay in sync):**
 - `.claude-plugin/plugin.json` - Plugin manifest