fix(release): include maintenance notes without triggering releases

[jatmn]

Summary

Release Please skipped refreshing #116 after build-only merges because its generated notes were unchanged. The configuration also hid documentation, build, and CI entries.

Enable native always-update and show those three sections. A separate read-only pinned Manifest planner checks eligibility with those sections hidden, so ordinary docs/build/ci changes appear in an eligible release's notes without opening releases themselves. Breaking changes and explicit version overrides retain their existing behavior.

The planner runs without protected credentials. The protected job verifies its source SHA, then runs tag/draft creation and eligible PR creation as separate native action phases. Existing release and missing-draft recovery remain independent of ordinary release eligibility.

Related: #116. That release branch has already been refreshed with main and the omitted entries. Merge this policy PR first, let the worker regenerate and recheck #116, then merge #116. Permanent policy changes stay outside the bot PR's four-file allowlist.

Contribution checklist

• I checked for duplicate or overlapping existing pull requests.
• This PR does not introduce a new implementation language.
• This PR does not add Python for any reason.
• I can respond to review feedback within one week.
• My PR title follows the Conventional Commit templates in AGENTS.md.

Validation

• Full bash scripts/ci-preflight.sh on the committed snapshot: source/release/recovery/workflow harnesses, clippy, 996 Rust tests, build, docs, CLI smokes, deny and audit passed. Mutation testing correctly skips this non-Rust diff.
• Durable preflight hooks installed with bash scripts/install-git-hooks.sh; pre-commit passed and pre-push repeats required validation.
• Native planner regression tests cover maintenance-only suppression, mixed notes, breaking changes, overrides, pending releases, API errors and unchanged-body updates.
• Final CLI exercised read-only against live GitHub history; returned releasable=true.
• Full final-diff primary review, two forward and two reverse blind searches, and missing-contract search completed without actionable defects.

Reviewed commit: 962a406d9e83e60b1206544e01e4ade2a37dec2e. Protected workflow mutations are not exercised locally; the policy becomes active after merge.

Maintainer checklist

• This PR is ready for review by @jatmn.
• Security-sensitive changes are called out in the summary.
• The PR should only be merged by @jatmn.

Summary by Sourcery

Refresh eligible release branches and include maintenance notes while keeping ordinary documentation, build, and CI changes from opening releases on their own.

New Features:

• Include documentation, build, and CI changes in the notes of otherwise eligible releases without allowing them to trigger releases independently.
• Add read-only release eligibility planning that separates release-note visibility from release creation.

Bug Fixes:

• Refresh eligible release branches even when generated notes are unchanged.
• Prevent release planning from acting on a changed main branch by validating the source SHA before protected release operations.

Enhancements:

• Separate tag or draft completion from release PR creation while preserving pending-release and missing-draft recovery behavior.
• Keep eligibility checks isolated from protected credentials and validate the workflow policy accordingly.

Documentation:

• Update release policy, automation planning, maintainer runbook, and release documentation to describe maintenance-note visibility and eligibility behavior.

Tests:

• Expand release policy and workflow validation coverage for maintenance-only changes, mixed notes, breaking changes, overrides, pending releases, API failures, unchanged-body updates, and source drift.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Needs a human reviewer. If the eligibility planner or workflow gating is wrong, it can create or refresh release branches and notes unexpectedly, and the protected action can still create tags or releases for pending merged releases. Reverting stops future runs but does not undo release PRs, generated notes, tags, or releases already created; human review of release PRs limits the impact.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook