ci: publish a GitHub Release with a commit list on each crate release

release.sh now assembles the Release notes — a bullet list of every
non-merge commit since the previous tag, plus a compare link — before the
version-bump commit lands, and hands the version + notes file to the
workflow via $GITHUB_OUTPUT (guarded so the script still runs locally).

ci.yml's publish job gains a "Create GitHub Release" step that cuts a
Release for the tag release.sh just pushed, using that commit list as the
description. It is skipped on a no-op release and is idempotent: a forced
re-publish refreshes the notes of an existing release instead of failing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XdYPGMXtFwVDZySXhfz8ev

Author: claude

.github/workflows/ci.yml

@@ -94,7 +94,26 @@ jobs:
       # it satisfies the master ruleset) and carries [skip ci], so it does not
       # re-trigger CI.
       - name: Release & publish
+        id: release
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
           FORCE_VERSION: ${{ github.event.inputs.force_version }}
         run: bash scripts/release.sh
+
+      # Cut a GitHub Release for the tag release.sh just pushed, using the commit
+      # list it assembled as the description. Skipped when the release step was a
+      # no-op (no release-worthy commits). Idempotent: if a release for the tag
+      # already exists (e.g. a forced re-publish), refresh its notes instead of
+      # failing.
+      - name: Create GitHub Release
+        if: steps.release.outputs.released == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_PAT }}
+        run: |
+          tag="v${{ steps.release.outputs.version }}"
+          notes="${{ steps.release.outputs.notes_file }}"
+          if gh release view "$tag" >/dev/null 2>&1; then
+            gh release edit "$tag" --title "$tag" --notes-file "$notes"
+          else
+            gh release create "$tag" --title "$tag" --notes-file "$notes" --verify-tag
+          fi

scripts/release.sh

@@ -2,9 +2,10 @@
 #
 # Master-only release step (run by .github/workflows/ci.yml after the lint/test
 # gates pass). Computes the next version from conventional commits; if there is
-# one, it bumps the workspace version, commits + tags it, pushes to master, and
-# publishes the changed crates. A clean no-op when no release-worthy commit
-# landed since the last tag.
+# one, it bumps the workspace version, commits + tags it, pushes to master,
+# publishes the changed crates, and assembles the GitHub Release notes (a commit
+# list since the previous tag) for the workflow to publish. A clean no-op when no
+# release-worthy commit landed since the last tag.
 #
 # The release commit is pushed with RELEASE_PAT (an admin token, so it satisfies
 # the master branch ruleset) and carries `[skip ci]`, so it does not re-trigger CI.
@@ -27,6 +28,24 @@ fi
 current="$(grep -m1 '^version = ' Cargo.toml | sed -E 's/.*"([^"]+)".*/\1/')"
 echo ">> releasing v$new (was v$current)"
 
+# Assemble the GitHub Release notes BEFORE the version-bump commit lands, so the
+# range is exactly the feature commits going into this release (everything since
+# the previous tag, the release chore commit excluded). The workflow turns this
+# into the Release description.
+prev_tag="$(git tag --list 'v*' --sort=-version:refname | head -n1)"
+notes_range="${prev_tag:+$prev_tag..}HEAD"
+notes_file="$(pwd)/release-notes.md"
+repo="${GITHUB_REPOSITORY:-artiz/fleischwolf}"
+{
+  echo "## What's changed"
+  echo
+  git log "$notes_range" --no-merges --format='- %s (%h)'
+  if [[ -n "$prev_tag" ]]; then
+    echo
+    echo "**Full changelog**: https://github.com/$repo/compare/$prev_tag...v$new"
+  fi
+} >"$notes_file"
+
 # Bump the single version key in the root manifest's [workspace.package].
 sed -i -E "0,/^version = \"[^\"]+\"/ s//version = \"$new\"/" Cargo.toml
 
@@ -58,4 +77,15 @@ git push origin "v$new"
 # crates.io), in dependency order.
 scripts/ci_publish.sh
 
+# Hand the released version + notes file to the workflow, which cuts the GitHub
+# Release for the tag we just pushed. Guarded so the script still runs locally
+# (where $GITHUB_OUTPUT is unset).
+if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
+  {
+    echo "released=true"
+    echo "version=$new"
+    echo "notes_file=$notes_file"
+  } >>"$GITHUB_OUTPUT"
+fi
+
 echo ">> released v$new"