More release workflow updates

Author: agriyakhetarpal

.github/update-hugo.md

@@ -14,5 +14,4 @@ https://github.com/gohugoio/hugo/releases/tag/v${LATEST_VERSION}
 
 - [ ] Merge this PR
 - [ ] Run `nox -s tag -- v${LATEST_VERSION}` locally to create a signed tag
-- [ ] Push the tag: `git push origin v${LATEST_VERSION}`
-- [ ] Run `nox -s release -- v${LATEST_VERSION}` to create the GitHub release (or create it manually)
+- [ ] Push the tag: `git push origin v${LATEST_VERSION}` — the CD workflow will build and publish the release automatically

.github/workflows/cd.yml

@@ -432,15 +432,67 @@ jobs:
       contents: write # Required to upload signed artifacts to a GitHub release
       attestations: write # Required to generate build provenance attestations
     runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/')
+    if: startsWith(github.ref, 'refs/tags/') && github.event_name != 'schedule'
 
     steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
       - name: Download all artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: upload/
           merge-multiple: true
 
+      - name: Generate release notes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          TAG="${GITHUB_REF_NAME}"
+          VERSION="${TAG#v}"
+
+          # Select template based on whether this is a patch release
+          PATCH=$(echo "$VERSION" | cut -d. -f3)
+          if [ "$PATCH" -gt 0 ]; then
+            TEMPLATE="release_notes/patch.md"
+          else
+            TEMPLATE="release_notes/stable.md"
+          fi
+
+          # Find the previous tag
+          PREVIOUS_TAG=$(git tag --sort=-v:refname | \
+            awk -v tag="${TAG}" '$0 == tag {found=1; next} found {print; exit}')
+          if [ -z "$PREVIOUS_TAG" ]; then
+            PREVIOUS_TAG=$(git describe --tags --abbrev=0 "${TAG}^")
+          fi
+
+          # Extract PR numbers from commits between the two tags
+          PR_NUMBERS=$(git log "${PREVIOUS_TAG}..${TAG}" --oneline | \
+            grep -oE '#[0-9]+' | tr -d '#' || true)
+
+          # Fetch PR titles and authors, filtering out bot PRs
+          PR_LINES=""
+          for NUM in $PR_NUMBERS; do
+            LINE=$(gh pr view "$NUM" --json title,author \
+              --jq '"- \(.title) by @\(.author.login) in #'"$NUM"'"' 2>/dev/null || true)
+            [ -z "$LINE" ] && continue
+            echo "$LINE" | grep -qE 'dependabot\[bot\]|pre-commit-ci\[bot\]' && continue
+            PR_LINES="${PR_LINES}${LINE}"$'\n'
+          done
+
+          if [ -n "$PR_LINES" ]; then
+            CHANGES_SECTION=$'\n## Changes that made it to this release\n\n'"${PR_LINES}"
+          else
+            CHANGES_SECTION=""
+          fi
+
+          export VERSION PREVIOUS_TAG CHANGES_SECTION
+          envsubst '${VERSION} ${PREVIOUS_TAG} ${CHANGES_SECTION}' \
+            < "$TEMPLATE" > /tmp/release-notes.md
+
       - uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
         with:
           # Comment this line out to publish to PyPI
@@ -465,10 +517,6 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          # Create a draft release and upload all artifacts (wheels, sdist, and
-          # Sigstore signatures), then publish — the release becomes immutable
-          # once it is no longer a draft
           gh release create "${GITHUB_REF_NAME}" upload/* \
-            --draft \
-            --generate-notes
-          gh release edit "${GITHUB_REF_NAME}" --draft=false
+            --title "${GITHUB_REF_NAME}" \
+            --notes-file /tmp/release-notes.md

noxfile.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 import re
-import string
 import subprocess
 from pathlib import Path
 
@@ -46,26 +45,6 @@ def _get_version(session: nox.Session) -> str:
     return match.group(1)
 
 
-def _get_previous_tag(current_tag: str) -> str:
-    result = subprocess.run(
-        ["git", "tag", "--sort=-v:refname"],
-        capture_output=True,
-        text=True,
-        check=True,
-    )
-    tags = result.stdout.strip().splitlines()
-    for i, t in enumerate(tags):
-        if t == current_tag and i + 1 < len(tags):
-            return tags[i + 1]
-    result = subprocess.run(
-        ["git", "describe", "--tags", "--abbrev=0", f"{current_tag}^"],
-        capture_output=True,
-        text=True,
-        check=True,
-    )
-    return result.stdout.strip()
-
-
 @nox.session(default=False)
 def tag(session: nox.Session) -> None:
     """Create a signed, annotated tag for a release.
@@ -103,82 +82,3 @@ def tag(session: nox.Session) -> None:
         external=True,
     )
     session.log(f"Tag {tag_name} created. Push it with: git push origin {tag_name}")
-
-
-@nox.session(default=False)
-def release(session: nox.Session) -> None:
-    """Create a GitHub release with formatted release notes.
-
-    Usage: nox -s release -- 0.157.0
-    """
-    version = _get_version(session)
-    tag_name = f"v{version}"
-
-    previous_tag = _get_previous_tag(tag_name)
-    is_patch = int(version.split(".")[2]) > 0
-    template_name = "patch.md" if is_patch else "stable.md"
-    template_path = DIR / "release_notes" / template_name
-    template = string.Template(template_path.read_text())
-
-    # Extract PR numbers from merge commits between the two tags
-    log_output = subprocess.run(
-        ["git", "log", f"{previous_tag}..{tag_name}", "--oneline"],
-        capture_output=True,
-        text=True,
-        check=True,
-    ).stdout.strip()
-
-    pr_numbers = re.findall(r"#(\d+)", log_output)
-
-    pr_lines = []
-    for num in pr_numbers:
-        result = subprocess.run(
-            [
-                "gh",
-                "pr",
-                "view",
-                num,
-                "--json",
-                "title,author",
-                "--jq",
-                '"- \\(.title) by @\\(.author.login) in #' + num + '"',
-            ],
-            capture_output=True,
-            text=True,
-            check=False,
-        )
-        if result.returncode != 0:
-            continue
-        line = result.stdout.strip()
-        if "dependabot[bot]" in line or "pre-commit-ci[bot]" in line:
-            continue
-        pr_lines.append(line)
-
-    pr_log = "\n".join(pr_lines)
-
-    if pr_log:
-        changes_section = f"\n## Changes that made it to this release\n\n{pr_log}\n"
-    else:
-        changes_section = ""
-
-    substitutions = {
-        "VERSION": version,
-        "PREVIOUS_TAG": previous_tag,
-        "CHANGES_SECTION": changes_section,
-    }
-
-    body = template.substitute(substitutions)
-
-    session.log(f"Creating GitHub release for {tag_name}")
-    session.run(
-        "gh",
-        "release",
-        "create",
-        tag_name,
-        "--title",
-        tag_name,
-        "--notes",
-        body,
-        external=True,
-    )
-    session.log(f"Release {tag_name} created!")