Inline release notes in appcast so Sparkle stops loading the GitHub site

Previously the appcast carried <sparkle:releaseNotesLink> pointing to
the GitHub release tag page. Sparkle's webview rendered the entire
GitHub site chrome (header, sign-in button, nav) inside the update
prompt, burying the actual notes below the fold.

Now the workflow asks the GitHub API to generate-notes for the tag,
renders the markdown to HTML via the /markdown endpoint, and the
packager inlines that HTML into the appcast as a <description> CDATA
block. A <sparkle:fullReleaseNotesLink> is kept so users still have a
"More…" path to the GitHub release page.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: bones7456

.github/workflows/release.yml

@@ -57,9 +57,6 @@ jobs:
           security set-key-partition-list -S apple-tool:,apple:,codesign: \
             -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" >/dev/null
 
-      - name: Build, sign, notarize, and package
-        run: ./scripts/package_release.sh
-
       - name: Resolve tag
         id: resolve_tag
         run: |
@@ -69,14 +66,42 @@ jobs:
             echo "tag=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
           fi
 
+      - name: Generate release notes
+        id: notes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ steps.resolve_tag.outputs.tag }}
+        run: |
+          set -euo pipefail
+          NOTES_MD="$RUNNER_TEMP/release_notes.md"
+          NOTES_HTML="$RUNNER_TEMP/release_notes.html"
+
+          gh api -X POST "/repos/${{ github.repository }}/releases/generate-notes" \
+            -f tag_name="$TAG" \
+            --jq .body > "$NOTES_MD"
+
+          gh api -X POST /markdown \
+            -F text=@"$NOTES_MD" \
+            -f mode=gfm \
+            -f context="${{ github.repository }}" > "$NOTES_HTML"
+
+          echo "notes_md=$NOTES_MD" >> "$GITHUB_OUTPUT"
+          echo "notes_html=$NOTES_HTML" >> "$GITHUB_OUTPUT"
+
+      - name: Build, sign, notarize, and package
+        env:
+          SPARKLE_RELEASE_NOTES_FILE: ${{ steps.notes.outputs.notes_html }}
+        run: ./scripts/package_release.sh
+
       - name: Upload artifacts to GitHub Release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG: ${{ steps.resolve_tag.outputs.tag }}
+          NOTES_MD: ${{ steps.notes.outputs.notes_md }}
         run: |
           set -euo pipefail
           if ! gh release view "$TAG" >/dev/null 2>&1; then
-            gh release create "$TAG" --title "Notchy $TAG" --generate-notes
+            gh release create "$TAG" --title "Notchy $TAG" --notes-file "$NOTES_MD"
           fi
           ASSETS=(dist/Notchy-*.zip dist/Notchy-*.dmg)
           if [ -f dist/appcast.xml ]; then

scripts/package_release.sh

@@ -25,6 +25,12 @@ set -euo pipefail
 #                           skipped with a warning.
 #   SPARKLE_VERSION         Optional. Sparkle release tag to download tools
 #                           from. Defaults to 2.9.2.
+#   SPARKLE_RELEASE_NOTES_FILE
+#                           Optional. Path to an HTML file with rendered
+#                           release notes. When set, its content is inlined
+#                           into appcast.xml as <description><![CDATA[...]]>
+#                           so the Sparkle prompt displays the notes
+#                           directly instead of loading an external URL.
 #
 # Behavior:
 #   - If SIGNING_IDENTITY is unset, the .app is built but left ad-hoc-signed
@@ -220,6 +226,11 @@ if [ -n "${SPARKLE_PRIVATE_KEY:-}" ]; then
     ZIP_URL="https://github.com/bones7456/notchy/releases/download/v${MARKETING_VERSION}/${BASENAME}.zip"
     MIN_OS="$(/usr/libexec/PlistBuddy -c 'Print :LSMinimumSystemVersion' "$BUILT_APP/Contents/Info.plist" 2>/dev/null || echo "")"
 
+    NOTES_HTML=""
+    if [ -n "${SPARKLE_RELEASE_NOTES_FILE:-}" ] && [ -f "$SPARKLE_RELEASE_NOTES_FILE" ]; then
+        NOTES_HTML="$(cat "$SPARKLE_RELEASE_NOTES_FILE")"
+    fi
+
     echo "==> Writing $APPCAST_PATH"
     {
         printf '<?xml version="1.0" encoding="utf-8"?>\n'
@@ -231,7 +242,12 @@ if [ -n "${SPARKLE_PRIVATE_KEY:-}" ]; then
         printf '            <title>Version %s</title>\n' "$MARKETING_VERSION"
         printf '            <sparkle:version>%s</sparkle:version>\n' "$MARKETING_VERSION"
         printf '            <sparkle:shortVersionString>%s</sparkle:shortVersionString>\n' "$MARKETING_VERSION"
-        printf '            <sparkle:releaseNotesLink>https://github.com/bones7456/notchy/releases/tag/v%s</sparkle:releaseNotesLink>\n' "$MARKETING_VERSION"
+        if [ -n "$NOTES_HTML" ]; then
+            printf '            <description><![CDATA[\n'
+            printf '%s' "$NOTES_HTML"
+            printf '\n]]></description>\n'
+        fi
+        printf '            <sparkle:fullReleaseNotesLink>https://github.com/bones7456/notchy/releases/tag/v%s</sparkle:fullReleaseNotesLink>\n' "$MARKETING_VERSION"
         printf '            <pubDate>%s</pubDate>\n' "$PUB_DATE"
         if [ -n "$MIN_OS" ]; then
             printf '            <sparkle:minimumSystemVersion>%s</sparkle:minimumSystemVersion>\n' "$MIN_OS"