unblock release notes generation on goreleaser action (#401)

The `changelog.disable: true` goreleaser setting prevents a passed `--release-notes` value from being used. We generate release notes and always supply this flag now, so let's make sure they get used.

GitOrigin-RevId: 559b9fe6f3db037968f992adba4146ef181fda4a

Author: blue-keleher

.github/workflows/release.yaml

@@ -32,22 +32,31 @@ jobs:
           gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
           passphrase: ${{ secrets.PASSPHRASE }}
       - name: Extract release notes from CHANGELOG.md
-        id: release_notes
+        # Fails the release if CHANGELOG.md doesn't have an entry for this
+        # version. Empty release notes are never intentional, and silently
+        # shipping a release without them was the pain point that prompted
+        # this strictness.
         run: |
+          set -eo pipefail
           VERSION="${GITHUB_REF_NAME#v}"
-          if bin/extract-release-notes.sh "$VERSION" CHANGELOG.md > release-notes.md; then
+          HEAD_SHA="$(git rev-parse --short HEAD)"
+          echo "Looking up CHANGELOG.md entry for $VERSION at $HEAD_SHA"
+
+          # `tee` mirrors the extracted notes into the action log; `pipefail`
+          # ensures the script's exit status propagates through the pipeline.
+          if bin/extract-release-notes.sh "$VERSION" CHANGELOG.md | tee release-notes.md; then
             printf '\n---\n**Full Changelog:** [CHANGELOG.md](https://github.com/${{ github.repository }}/blob/main/CHANGELOG.md)\n' >> release-notes.md
-            echo "found=true" >> "$GITHUB_OUTPUT"
           else
-            echo "::warning::No CHANGELOG.md entry found for ${VERSION}. Release will be created without notes."
-            echo "found=false" >> "$GITHUB_OUTPUT"
+            echo "::error::No CHANGELOG.md entry found for ${VERSION} at ${HEAD_SHA}. Aborting release."
+            echo "::group::Top of CHANGELOG.md at ${HEAD_SHA}"
+            head -40 CHANGELOG.md
+            echo "::endgroup::"
+            exit 1
           fi
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5.1.0
         with:
-          args: >-
-            release --clean
-            ${{ steps.release_notes.outputs.found == 'true' && '--release-notes=release-notes.md' || '' }}
+          args: release --clean --release-notes=release-notes.md
         env:
           # GitHub sets the GITHUB_TOKEN secret automatically.
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.goreleaser.yml

@@ -33,8 +33,6 @@ checksum:
   algorithm: sha256
 release:
   name_template: "v{{ .Version }}"
-changelog:
-  disable: true
 signs:
   - artifacts: checksum
     args: