CodeQL: the pacman rule built a regex from the interpolated version and
escaped only dots. It now compares plain strings, so the exported
requiredAssetRules() carries no escaping trap; only the literal compression
suffix stays a regex.
verify-draft-release:
- Never exits 0 once the release is published. The asset report still
prints (auditing after the fact is useful), but a pre-publication gate
must not report success for a boundary already crossed.
- Polls for the tag run before concluding it does not exist: `gh run list`
reports what is indexed right now, and a run pushed seconds ago routinely
is not. Adds injectable progress/sleep io, so runVerification is async.
- The live sleep timer is deliberately not unref'd — a pending promise does
not hold the event loop open, and an empty loop exits 0, which would turn
a mid-poll exit into a silent false success.
- `--repo` is shape-checked so a typo fails with the usage line.
Announcements: an internal-only release now returns null instead of
throwing a misleading "even a single entry exceeds the limit" error. The
CLI explains it on stderr, leaves stdout empty and exits 0 — the shape
extract-changelog-section.mjs --public already uses for the same case.
Highlight cards: card filenames derive from the note filename, never the
screenshot slug. Two highlights may legitimately share one manifest shot,
which previously made the second card overwrite the first.
Tests: the CLI harness moved to spawnSync — execFileSync discards stderr on
success, hiding exactly the messages these paths emit. Adds regressions for
each finding above (165 passing).
Docs: CLAUDE.md and AGENTS.md release sections (mirrored, verified
identical) now document the highlight field, the announcement/card
commands, and the draft verifier; .changes/README.md records the
internal-only announcement behavior.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Extends the release tooling around the .changes notes pipeline:
- New optional `highlight:` frontmatter field marks a release's headline
changes (max 80 chars, rejected on `type: internal`).
- `--format telegram` renders a paste-ready plain-text post guaranteed to
fit the 4096-character limit (highlights lead, the rest collapses into a
counter); `--format reddit` renders markdown with a suggested title line,
a Highlights section, and a collapsed change list. Both are stdout dry
runs and must run before `--consume`.
- The blog scaffold uses the highlight as a ready section heading instead
of a TODO, and highlight notes without screenshots get their own section.
- `release:verify:draft` waits for the v* tag build via `gh run watch`,
then checks draft status, the authored body, and the complete 27-asset
set (verified against a real full matrix build). Read-only; publishing
stays manual.
- `release:cards:generate` renders branded 1200x630 highlight cards (with
a framed mock-server screenshot strip when the note names one, purely
typographic otherwise) plus a release hero card into dist/, matching the
website palette. Copying into the website tree stays a manual act.
Docs: .changes/README.md, release-notes and release-cut skills (both
copies byte-identical). No release note: release tooling only, no runtime
behavior change.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Backfills the 0.23.0 release notes the .changes/ pipeline missed: it landed
after most of the release was already merged, leaving 4 notes for 79 commits.
Adds 22 curated notes (26 total: 14 features, 11 fixes, 1 perf). Curated
rather than exhaustive — the GitHub release body renders these above
GitHub's own list of every merged PR, so related PRs are folded into one
note per user-facing story: shared player controls (8 PRs), embedded MPV
frame-copy (4), manual EPG mapping (3), plus five more pairs. Tooling-only
scopes get no note. No screenshot slugs: none of the five manifest shots
depicts a 0.23 headline feature, and the capture run asserts TMDB
enrichment stays disabled.
Two tooling fixes found while writing them:
- parseArgs now ignores a bare `--`. npm needs it to forward arguments past
the script name; pnpm hands it to the script verbatim, so
`pnpm run release:notes:github -- --version 0.24.0` died on the very
separator typed to make forwarding work. Unknown flags and missing values
still fail as before. Covered by new subprocess CLI tests wired into the
release-tools target.
- .changes/README.md claimed every non-consume mode was a safe dry run;
--format changelog and --format blog write their target file.
No app or lib code, no version bump, no --consume, no CHANGELOG.md or
website changes — those stay owned by release-cut.
