[diegomarty]

0.5.0 and 1.0.0 were tagged by bump.yml but never released: the tag reached GitHub and release.yml never started. Both GitHub releases had to be created by hand.

Why

bump.yml relied on the tag push itself to start release.yml. That needed the push to be made with a PAT (RELEASE_TOKEN), and it needed the trick of blanking the credential that actions/checkout persists to actually take effect. It did not, twice: GitHub starts no workflow run for a push it attributes to the workflow's own GITHUB_TOKEN.

The release notes were also wrong: release.yml used GitHub's generated list of pull requests instead of the hand-written CHANGELOG notes that gate every release.

Changes

• bump.yml pushes the commit and the tag with GITHUB_TOKEN, so they start nothing. It then dispatches release.yml on the tag with gh workflow run release.yml --ref vX.Y.Z. A workflow_dispatch made with GITHUB_TOKEN is GitHub's documented exception and does start a run, so every tag gets exactly one release run.
• RELEASE_TOKEN is no longer used. The secret can be deleted once this is merged.
• release.yml also accepts workflow_dispatch on a tag ref. The existing tag-vs-package.json check refuses any other ref. The release's notes come from changelog.sh notes <version> (body_path).
• changelog.sh notes <version> prints that version's section. It fails on a missing or empty section, so a release can never go out with empty notes.

Verification

• test/release-workflows.test.ts pins the notes extraction (including the failure on a missing version), the dispatch, and the notes source. Three of its tests failed before these changes.
• make check passes: 1309 tests, Prettier clean.
• Both workflows parse.
• After merging, the dispatch path can be exercised safely with Actions → release → Run workflow on v1.0.0. It re-runs the gates and updates the existing 1.0.0 release with the CHANGELOG notes.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.