feat(release): credit contributors automatically in the release notes

[devops-thiago]

What type of PR is this?

• 🏗️ CI/CD

Description

Release notes were assembled from CHANGELOG.md alone, so GitHub's generated New Contributors
section never ran and outside contributors went uncredited.

v0.5.0 has one: @matheusandre1 wrote the wider default ignored-files patterns (#429).

Workflow

gh release create gains the generated section — but not via --generate-notes. The existing
workflow has two paths, and gh release edit (the re-run path) has no --generate-notes flag,
so adding it only to create would mean any re-run silently overwrites the body and drops the
credit. Instead the notes are generated once through the Release Notes API and both paths publish
the same release_body.md:

cp release_notes.md release_body.md
if generated=$(gh api "repos/${GITHUB_REPOSITORY}/releases/generate-notes" \
    -f tag_name="$TAG" --jq .body 2>/dev/null) && [ -n "$generated" ]; then
  printf '\n\n%s\n' "$generated" >> release_body.md
else
  echo "::warning::Could not generate release notes; publishing CHANGELOG notes only"
fi

Best-effort by design: if generation fails the release still publishes with the curated notes and a
warning, rather than failing at the last step of a release.

contents: write and GH_TOKEN are already present on that step, so no permission change.

.github/release.yml (new)

Shapes the generated section. Excludes dependabot and github-actions: seven Dependabot PRs
landed in v0.5.0 and would bury the humans in both the PR list and the contributor credit, and the
bumps are already summarised under Dependencies in the changelog.

Related Issues

N/A — release process.

How Has This Been Tested?

• Manual testing

• .github/release.yml parses and carries the changelog root key GitHub expects

• Confirmed gh release edit lacks --generate-notes (gh release edit --help), which is what
  drove the generate-once approach rather than the one-flag version

• Confirmed the step already exports GH_TOKEN and the job holds contents: write, both required
  by the generate-notes endpoint

• Contributors verified from the branch itself: git shortlog -sne origin/main..origin/release/v0.5.0
  → Thiago Gonzaga (28), dependabot (7), Matheus André (1, feat(review): enhance ignored files configuration and add tests for default patterns #429)

The generated section itself can only be verified when a release is cut — the failure mode if
anything is wrong is a warning plus notes-as-before, not a broken release.

Checklist

• My code follows the project's coding standards
• I have performed a self-review of my own code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[thrillhousebot]

🤖 ThrillhouseBot PR Summary

What this PR does

The PR modifies the release workflow to use the GitHub Releases API to generate additional release notes (including new contributor credit) and appends them to the curated changelog notes, while keeping the release process robust. It also adds a release.yml configuration to shape the generated section and includes a manual contributor entry in CHANGELOG.md.

Control-Flow Diagram

🔀 Show diagram

flowchart TD
  A["Copy release_notes.md to release_body.md"] --> B["Call generate-notes API"]
  B --> C{"generation succeeded\nand generated != empty?"}
  C -- yes --> D["Append generated notes to release_body.md"]
  C -- no --> E["Emit warning (notes only)"]
  D --> F{"Release TAG exists?"}
  E --> F
  F -- yes --> G["gh release upload artifacts\nand gh release edit with --notes-file release_body.md"]
  F -- no --> H["gh release create with --notes-file release_body.md"]

Loading

Changes Overview

• Files changed: 3
• Lines added: +43
• Lines removed: -2

Changed Files

File	Change	Summary
.github/release.yml	Added	Added config to exclude bot authors and categorize generated release notes
.github/workflows/release.yml	Modified	Prepends curated notes and appends generated section to a combined release_body.md, used by both create and edit paths
CHANGELOG.md	Modified	Added Contributors section for v0.5.0 with credit to @matheusandre1

Risk Assessment

Risk	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	0
🔵 Low	0

No new issues found in this PR, but the review cannot be approved until CI is confirmed green.

⚠️ CI Checks Status

Some checks are still pending or have failed:

Check	Type	Status	Detail
frontend	check-run	⏳ Pending	-
changes	check-run	⏳ Pending	-
trivy	check-run	⏳ Pending	-
format	check-run	⏳ Pending	-
actionlint	check-run	⏳ Pending	-
test	check-run	⏳ Pending	-
dependency-review	check-run	⏳ Pending	-

---

Automated review by ThrillhouseBot. Reply with /review to re-run.

[thrillhousebot]

Everything's coming up Thrillhouse! 🎉

No issues found in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud