ci(release): generate release notes from changelog

.github/workflows/release.yml

@@ -171,15 +171,7 @@ jobs:
 
       - name: Generate release body
         run: |
-          if [[ "${{ needs.native.outputs.packaging_mode }}" == "development" ]]; then
+          ./scripts/atlas/generate-release-body.sh "${GITHUB_REF_NAME#V}" "${{ needs.native.outputs.packaging_mode }}" RELEASE_BODY.md
-            {
-              echo "Native macOS assets in this tag were packaged in development mode because Developer ID release-signing credentials were not configured for this run."
-              echo
-              echo "These \`.zip\`, \`.dmg\`, and \`.pkg\` files are intended for internal testing or developer use. macOS Gatekeeper may require \`Open Anyway\` or a right-click \`Open\` flow before launch."
-            } > RELEASE_BODY.md
-          else
-            echo "Native macOS assets in this tag were packaged in CI using Developer ID signing and notarization, then uploaded alongside the existing command-line release artifacts." > RELEASE_BODY.md
-          fi
 
       - name: Display structure of downloaded files
         run: ls -R bin/

Docs/Execution/Release-Signing.md

@@ -97,6 +97,13 @@ KEEP_INSTALLED_APP=1 ./scripts/atlas/verify-dmg-install.sh
 
 Tagged pushes matching `V*` now reuse the same packaging flow in CI and attach native release assets to the GitHub Release created by `.github/workflows/release.yml`.
 
+The GitHub Release body is generated from the matching version section in `CHANGELOG.md`, then appends the actual packaging mode note:
+
+- `developer-id` -> signed/notarized packaging note
+- `development` -> prerelease fallback note
+
+If a changelog section is missing for the pushed tag version, the workflow falls back to a short placeholder instead of publishing an empty body.
+
 Required GitHub Actions secrets:
 
 - `ATLAS_RELEASE_APP_CERT_P12_BASE64`

scripts/atlas/generate-release-body.sh

@@ -0,0 +1,82 @@
+#!/bin/bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
+CHANGELOG_FILE="$ROOT_DIR/CHANGELOG.md"
+
+usage() {
+    cat <<'EOF'
+Usage:
+  ./scripts/atlas/generate-release-body.sh <version> <packaging-mode> [output-file]
+
+Examples:
+  ./scripts/atlas/generate-release-body.sh 1.0.3 development
+  ./scripts/atlas/generate-release-body.sh 1.0.3 developer-id /tmp/RELEASE_BODY.md
+EOF
+}
+
+if [[ $# -lt 2 || $# -gt 3 ]]; then
+    usage >&2
+    exit 1
+fi
+
+VERSION="$1"
+PACKAGING_MODE="$2"
+OUTPUT_FILE="${3:-$ROOT_DIR/RELEASE_BODY.md}"
+
+if [[ ! -f "$CHANGELOG_FILE" ]]; then
+    echo "Missing changelog: $CHANGELOG_FILE" >&2
+    exit 1
+fi
+
+if [[ "$PACKAGING_MODE" != "development" && "$PACKAGING_MODE" != "developer-id" ]]; then
+    echo "Unsupported packaging mode: $PACKAGING_MODE" >&2
+    exit 1
+fi
+
+extract_changelog_section() {
+    local version="$1"
+    awk -v version="$version" '
+        $0 ~ "^## \\[" version "\\] - " {
+            printing = 1
+        }
+        printing {
+            if ($0 ~ "^## \\[" version "\\] - ") {
+                print "# Atlas for Mac " version
+                print ""
+                next
+            }
+            if ($0 ~ "^## \\[" && $0 !~ "^## \\[" version "\\] - ") {
+                exit
+            }
+            print
+        }
+    ' "$CHANGELOG_FILE"
+}
+
+CHANGELOG_SECTION="$(extract_changelog_section "$VERSION")"
+
+if [[ -z "${CHANGELOG_SECTION//[$'\n\r\t ']}" ]]; then
+    {
+        echo "# Atlas for Mac $VERSION"
+        echo
+        echo "Release notes for this version were not found in CHANGELOG.md."
+    } > "$OUTPUT_FILE"
+else
+    printf '%s\n' "$CHANGELOG_SECTION" > "$OUTPUT_FILE"
+fi
+
+{
+    echo
+    echo "## Packaging Status"
+    echo
+    if [[ "$PACKAGING_MODE" == "development" ]]; then
+        echo "Native macOS assets in this tag were packaged in development mode because Developer ID release-signing credentials were not configured for this run."
+        echo
+        echo "These \`.zip\`, \`.dmg\`, and \`.pkg\` files are intended for internal testing or developer use. macOS Gatekeeper may require \`Open Anyway\` or a right-click \`Open\` flow before launch."
+    else
+        echo "Native macOS assets in this tag were packaged in CI using Developer ID signing and notarization, then uploaded alongside the existing command-line release artifacts."
+    fi
+} >> "$OUTPUT_FILE"
+
+printf 'Generated release body for %s (%s) at %s\n' "$VERSION" "$PACKAGING_MODE" "$OUTPUT_FILE"