Derive the GitHub release notes, and show them at the dry-run checkpoint #84

New issue

Closed

opened 2026-09-22 15:47:26 +01:00 by cruelacid · 0 comments

cruelacid commented

2026-09-22 15:47:26 +01:00

Owner

Part of #77. Needs the ledger (#82).

Why

Two things, and the second is the more surprising.

releaseNotes(tag, sourceSha) in scripts/publish-plugin.mjs is a fixed
template — install instructions, sha256(main.js), the source sha. It should
carry the version's section from docs/changelog-plugin.md.

And the operator has never seen the notes before they are published.
releaseNotes() is an inline argument to gh release create, so it is never
printed. The dry-run exit is the only human checkpoint in the entire plugin
release, and it shows everything except the thing that becomes public and
permanent.

What to do

releaseNotes() takes the version's section from the ledger, generated rather
than hand-written.
Print the full notes at the dry-run exit, so the one checkpoint in the
release actually shows what is about to be published.
Keep the install instructions and the sha256(main.js). The hash is how
somebody checks the artefact against the source, and the client is the trust
anchor — that must not be traded away for tidier notes.

Watch for

assertAuthorship() enforces cedric@nectenda.com across all mirror history.
Nothing here should touch it, but a change to the commit path can trip it.

Part of #77. Needs the ledger (#82). ## Why Two things, and the second is the more surprising. `releaseNotes(tag, sourceSha)` in `scripts/publish-plugin.mjs` is a fixed template — install instructions, `sha256(main.js)`, the source sha. It should carry the version's section from `docs/changelog-plugin.md`. And **the operator has never seen the notes before they are published.** `releaseNotes()` is an inline argument to `gh release create`, so it is never printed. The dry-run exit is **the only human checkpoint in the entire plugin release**, and it shows everything except the thing that becomes public and permanent. ## What to do - `releaseNotes()` takes the version's section from the ledger, generated rather than hand-written. - **Print the full notes at the dry-run exit**, so the one checkpoint in the release actually shows what is about to be published. - Keep the install instructions and the `sha256(main.js)`. The hash is how somebody checks the artefact against the source, and the client is the trust anchor — that must not be traded away for tidier notes. ## Watch for `assertAuthorship()` enforces `cedric@nectenda.com` across all mirror history. Nothing here should touch it, but a change to the commit path can trip it.

cruelacid added this to the Backlog - unscheduled milestone

2026-09-22 15:47:26 +01:00

cruelacid added the

area:plugin

label

2026-09-22 15:47:26 +01:00

cruelacid referenced this issue

2026-09-22 15:48:40 +01:00

The pull request as the unit of change, and a changelog built on it #77

cruelacid referenced this issue

2026-09-23 15:08:36 +01:00

ci.yml: narrow push to main, move the e2e gate onto the pull request #80