From 6e92e32afcf1d867cead2bbf97a7d835a9d12a98 Mon Sep 17 00:00:00 2001
From: Fredrik Ahlgren <fredrik@sourceful-labs.com>
Date: Tue, 21 Jul 2026 20:14:23 +0200
Subject: [PATCH] fix: publish release notes from annotated tag

---
 .github/workflows/release.yml | 12 +++++++++++-
 CHANGELOG.md                  |  5 +++++
 docs/releases.md              |  3 ++-
 3 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3398881..4814e4a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,6 +31,10 @@ jobs:
             echo "invalid release tag: ${tag}" >&2
             exit 1
           fi
+          if [[ "$(git cat-file -t "${tag}")" != "tag" ]]; then
+            echo "release tag must be annotated: ${tag}" >&2
+            exit 1
+          fi
           version="$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -n 1)"
           if [[ "v${version}" != "${tag}" ]]; then
             echo "Cargo version ${version} does not match tag ${tag}" >&2
@@ -112,6 +116,12 @@ jobs:
         run: |
           set -euo pipefail
           sort -k2 dist/*.sha256 > dist/SHA256SUMS
+          git for-each-ref --format='%(contents)' \
+            "refs/tags/${GITHUB_REF_NAME}" > dist/RELEASE_NOTES.md
+          if [[ ! -s dist/RELEASE_NOTES.md ]]; then
+            echo "annotated tag has no release notes: ${GITHUB_REF_NAME}" >&2
+            exit 1
+          fi
           prerelease=()
           if [[ "${GITHUB_REF_NAME}" == *-* ]]; then
             prerelease+=(--prerelease)
@@ -121,5 +131,5 @@ jobs:
             --repo "${GITHUB_REPOSITORY}" \
             --verify-tag \
             --title "FTWDB ${GITHUB_REF_NAME}" \
-            --notes-from-tag \
+            --notes-file dist/RELEASE_NOTES.md \
             "${prerelease[@]}"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3653a5a..b83115b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,11 @@ steps in [docs/releases.md](docs/releases.md).
 
 ## [Unreleased]
 
+### Fixed
+
+- Release publication now reads notes from the annotated tag through a file,
+  which works with an explicit GitHub repository target.
+
 ## [0.1.0-alpha.1] - 2026-07-21
 
 First public evaluation release.
diff --git a/docs/releases.md b/docs/releases.md
index c094719..54a6f81 100644
--- a/docs/releases.md
+++ b/docs/releases.md
@@ -46,7 +46,8 @@ remove exposed secrets or meet a legal requirement, and record that event.
 
 Pushing a matching tag starts `.github/workflows/release.yml`. The workflow:
 
-1. checks the tag syntax and exact Cargo/changelog version;
+1. checks that the tag is annotated and matches the exact Cargo/changelog
+   version;
 2. repeats the release test and package checks;
 3. builds native `ftw` archives on GitHub's Linux and macOS runners;
 4. creates `SHA256SUMS` for the archives; and