docs: harden RELEASING.md with SECURITY sync and guarded release script

Author: clean6378-max-it

RELEASING.md

@@ -1,14 +1,16 @@
 # Releasing
 
-Manual release flow for claude-code-chat-browser. A release is an annotated git tag and a GitHub Release with notes. There is no CI publish workflow, and no wheel, npm package, or other artifact is attached.
+Manual release flow for claude-code-chat-browser. A release is an annotated git tag plus a GitHub Release with notes. No CI publish workflow, and no wheel, npm package, or other artifact.
 
-`v0.1.0` (2026-06-18) is the only shipped tag so far. `v0.2.0` is in progress; these steps describe how it is being cut.
+`v0.1.0` (2026-06-18) is the only shipped tag so far. `v0.2.0` is in progress; these steps describe that cut.
 
 ## Version source
 
-The only version string is `__version__` in `app.py` (line 3). There is no `pyproject.toml` version field.
+The release version is `__version__` in `app.py` line 3. There is no `pyproject.toml` version field.
 
-Between tagged releases, `master` may carry a `.dev0` suffix (for example `0.2.0.dev0` while `0.2.0` was in development). The shipped tag drops `.dev0`.
+`SECURITY.md` line 5 names the version again in the supported-versions blurb (`(currently \`...\`)`). Keep it in sync with `app.py` on every release. `README.md` links to that page for supported versions.
+
+Between tagged releases, `master` may use a `.dev0` suffix (for example `0.2.0.dev0` while `0.2.0` was in development). The shipped tag drops `.dev0`.
 
 ## Pre-release checklist
 
@@ -21,36 +23,47 @@ Between tagged releases, `master` may carry a `.dev0` suffix (for example `0.2.0
 Do the changelog in one PR and the version bump in a second PR, or combine them on a `release/vX.Y.Z` branch. The `v0.2.0` cut used two PRs: changelog first (`docs/changelog-0-2-0`), then the bump (`release/v0.2.0`).
 
 1. Edit [CHANGELOG.md](CHANGELOG.md) ([Keep a Changelog](https://keepachangelog.com/en/1.1.0/)):
-   - Move everything under `## [Unreleased]` into a new `## [X.Y.Z] - YYYY-MM-DD` section with `### Added`, `### Changed`, `### Fixed`, or `### Removed` as needed.
+   - Move everything under `## [Unreleased]` into a new `## [X.Y.Z] - YYYY-MM-DD` section with `### Added`, `### Changed`, `### Deprecated`, `### Fixed`, `### Removed`, or `### Security` as needed.
    - Leave `## [Unreleased]` empty.
    - Update the footer compare links: `[Unreleased]` → `vX.Y.Z...HEAD`, add `[X.Y.Z]` → `vPREVIOUS...vX.Y.Z`.
 2. On a branch from current `master`, set `app.py` line 3 to the release version without `.dev0` (for example `"0.2.0"`).
-3. From the repo root, grep for the old `.dev0` suffix you are replacing:
+3. Update [SECURITY.md](SECURITY.md) line 5 so `(currently \`...\`)` matches that version (for example `(currently \`0.2.0\`)`). Leave the table at lines 7-10 unchanged.
+4. From the repo root, grep for stale version strings (the previous `.dev0` suffix, the old `SECURITY.md` parenthetical, or any other doc that still names the prior release):
    ```sh
-   git grep -n "\.dev0"
+   git grep -nE '\.dev0|\(currently `'
    ```
-   Update any documentation that still names the previous dev version (for example `docs/deprecation-policy.md`).
-4. Open a PR, get review, merge to `master`.
-5. Tag the merge commit:
+   Update any hits that should name the new release (for example `docs/deprecation-policy.md`).
+5. Open a PR, get review, merge to `master`.
+6. Tag the merge commit:
    ```sh
    git checkout master
    git pull
    git tag -a vX.Y.Z -m "vX.Y.Z"
    git push origin vX.Y.Z
    ```
    Tag format: `vMAJOR.MINOR.PATCH` (for example `v0.2.0`).
-6. Publish a GitHub Release, not just the tag. Pull the `## [X.Y.Z]` section from `CHANGELOG.md` and pass it to `gh`:
+7. Cut the GitHub Release after the tag. From the repo root, extract the body from `CHANGELOG.md`:
    ```sh
-   VERSION=X.Y.Z
+   cd "$(git rev-parse --show-toplevel)"
+   VERSION=0.2.0   # no leading v; not the literal X.Y.Z placeholder
+   VERSION="${VERSION#v}"
+   case "$VERSION" in
+     *[!0-9.]*|*.*.*.*|'') echo "error: VERSION must look like 0.2.0" >&2; exit 1 ;;
+   esac
+   NOTES="$(mktemp)"
+   trap 'rm -f "$NOTES"' EXIT
    awk -v ver="$VERSION" '
-     $0 ~ "^## \\[" ver "\\]" {found=1}
-     found && $0 ~ "^## \\[" && $0 !~ "^## \\[" ver "\\]" {exit}
-     found {print}
-   ' CHANGELOG.md > /tmp/release-notes.md
-   gh release create "v${VERSION}" --title "v${VERSION}" --notes-file /tmp/release-notes.md
+     /^## \[/ {
+       if (found) exit
+       if ($0 ~ "^## \\[" ver "\\]") { found=1; next }
+     }
+     /^\[[^]]+\]:/ { if (found) exit }
+     found { print }
+   ' CHANGELOG.md >"$NOTES"
+   [ -s "$NOTES" ] || { echo "error: no CHANGELOG.md section for $VERSION" >&2; exit 1; }
+   gh release create "v${VERSION}" --title "v${VERSION}" --verify-tag --notes-file "$NOTES"
    ```
-   On macOS, Linux, and Git Bash, `/tmp/release-notes.md` works. You can also create the release in the GitHub UI and paste the section there.
-7. Optional: if the project later adds a supported-version table in [SECURITY.md](SECURITY.md), update it when you cut a release. `SECURITY.md` today only says fixes land on latest `master`.
+   On macOS, Linux, and Git Bash, `mktemp` works. Or paste the section in the GitHub UI (skip the `## [X.Y.Z]` heading; the title is already set).
 
 ## After release
 
@@ -63,6 +76,7 @@ Do the changelog in one PR and the version bump in a second PR, or combine them
 |-------|----------|
 | Changelog format | [CHANGELOG.md](CHANGELOG.md) |
 | Version bump | `app.py` line 3 |
+| Supported versions blurb | `SECURITY.md` line 5 |
 | Deprecation / semver | [docs/deprecation-policy.md](docs/deprecation-policy.md) |
 | Security reporting | [SECURITY.md](SECURITY.md) |
 | CI gates | [CONTRIBUTING.md](CONTRIBUTING.md) |