ci(release): auto-publish releases with CHANGELOG-driven notes

Restructures release.yml so a pushed v* tag produces a published release
with notes lifted straight from CHANGELOG.md, not a draft sitting forever.

  notes        Extracts the '## [X.Y.Z]' section from CHANGELOG.md and
               exposes it as a step output. Fails loudly with an ::error::
               directive when the section is missing, so a tag push with no
               CHANGELOG update no longer produces a release with a generic
               placeholder body.

  build-*      macOS / Linux / Windows builds, now reading
               needs.notes.outputs.body for the release body instead of a
               hardcoded 'See the assets below' string.

  publish      New job, depends on all three builds. Runs
               'gh release edit --draft=false --latest', flipping the draft
               that tauri-action created into a public release marked as
               latest.

Adds workflow_dispatch with a 'version' input for dry-running just the
notes job (build matrix + publish are gated by github.event_name == 'push').
Lets maintainers validate CHANGELOG slicing without doing a real release.

Author: delexw

.github/workflows/release.yml

@@ -4,9 +4,60 @@ on:
   push:
     tags:
       - "v*"
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to dry-run, e.g. 0.5.1 (no v prefix). Only the notes job runs; nothing is built or published."
+        required: true
+        type: string
 
 jobs:
+  notes:
+    name: Extract release notes from CHANGELOG
+    runs-on: ubuntu-latest
+    outputs:
+      body: ${{ steps.extract.outputs.body }}
+      version: ${{ steps.extract.outputs.version }}
+    steps:
+      - uses: actions/checkout@v5
+
+      - id: extract
+        shell: bash
+        env:
+          INPUT_VERSION: ${{ github.event.inputs.version }}
+        run: |
+          if [ -n "$INPUT_VERSION" ]; then
+            VERSION="$INPUT_VERSION"
+          else
+            VERSION="${GITHUB_REF_NAME#v}"
+          fi
+          echo "Resolving CHANGELOG section for v$VERSION"
+          BODY=$(awk -v ver="$VERSION" '
+            $0 ~ "^## \\[" ver "\\]" { inside=1; print; next }
+            inside && /^## \[/ { exit }
+            inside { print }
+          ' CHANGELOG.md 2>/dev/null || true)
+          if [ -z "$BODY" ]; then
+            echo "::error file=CHANGELOG.md::No CHANGELOG section found for version $VERSION. Add a '## [$VERSION] — YYYY-MM-DD' heading before tagging."
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          {
+            echo 'body<<RELEASE_NOTES_EOF'
+            printf '%s\n' "$BODY"
+            echo RELEASE_NOTES_EOF
+          } >> "$GITHUB_OUTPUT"
+          {
+            echo "## Release notes preview for v$VERSION"
+            echo
+            echo '```markdown'
+            printf '%s\n' "$BODY"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
   build-macos:
+    needs: notes
+    if: github.event_name == 'push'
     runs-on: macos-latest
     permissions:
       contents: write
@@ -37,11 +88,13 @@ jobs:
         with:
           tagName: ${{ github.ref_name }}
           releaseName: ${{ github.ref_name }}
-          releaseBody: "See the assets below to download the app."
+          releaseBody: ${{ needs.notes.outputs.body }}
           releaseDraft: true
           prerelease: false
 
   build-linux:
+    needs: notes
+    if: github.event_name == 'push'
     runs-on: ubuntu-22.04
     permissions:
       contents: write
@@ -77,11 +130,13 @@ jobs:
         with:
           tagName: ${{ github.ref_name }}
           releaseName: ${{ github.ref_name }}
-          releaseBody: "See the assets below to download the app."
+          releaseBody: ${{ needs.notes.outputs.body }}
           releaseDraft: true
           prerelease: false
 
   build-windows:
+    needs: notes
+    if: github.event_name == 'push'
     runs-on: windows-latest
     permissions:
       contents: write
@@ -112,6 +167,23 @@ jobs:
         with:
           tagName: ${{ github.ref_name }}
           releaseName: ${{ github.ref_name }}
-          releaseBody: "See the assets below to download the app."
+          releaseBody: ${{ needs.notes.outputs.body }}
           releaseDraft: true
           prerelease: false
+
+  publish:
+    name: Publish release (flip draft → public)
+    needs: [build-macos, build-linux, build-windows]
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Publish release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release edit "${{ github.ref_name }}" \
+            --repo "${{ github.repository }}" \
+            --draft=false \
+            --latest