The sync-release-changelog workflow now uses a GitHub App token instead
of GITHUB_TOKEN so pushes to the release PR branch re-trigger CI (the
repo's ruleset requires 5 status checks to pass). Also hardens PR
discovery with --limit 100 --base main, and serializes concurrent runs
with cancel-in-progress: false to prevent non-fast-forward push races.
release.yml generates GitHub release notes from git log at release time
instead of reading from CHANGELOG.md, closing the merge-before-sync
race where someone merges the release PR before the changelog sync
finishes.
auto-tag-on-release-pr-merge.yml now triggers the internal
sprout-releases Buildkite pipeline via REST API after pushing the tag,
passing version metadata so the pipeline's input step is skipped.
When a release PR sits open and new commits merge to main, the release
binary includes those commits (the tag lands on the merge commit) but
the changelog doesn't mention them. The new sync-release-changelog
workflow fires on every push to main, finds any open same-repo
version-bump/* PR, and regenerates the CHANGELOG.md section from
<last-tag>..origin/main — keeping the PR's changelog accurate until it
merges.
Uses origin/main as the log range upper bound (not HEAD) to exclude the
release commit and any prior sync commits on the PR branch. No merge
commit is created; only CHANGELOG.md is touched. Fails loudly when
multiple release PRs are open to avoid targeting the wrong one.
Signed-off-by: Will Pfleger <wpfleger@block.xyz>
