feat(release): build notes from highlights and the change list together

[AprilNEA]

Highlights were the only source of release notes, so a release without them had nothing to ship and cargo xtask release notes refused to build. Two consequences, both observed:

• v1.34.2, v1.34.3 and v1.34.4 each cut a tag and a GitHub release with no DMG behind them — the extraction is the first step of Release DMG (release.yml:80), and it runs after release-please has already tagged.
• 581a33c moved that check onto PRs to catch it earlier, which was right. But release-please never writes Highlights, so every release PR failed by construction: chore(master): release 1.35.0 #382 → chore(master): release 1.35.1 #388 → chore(master): release 1.36.0 #390 → chore(master): release 1.37.0 #392, no exceptions. One merged red pointed every other PR at the same failure, before Lint/Build/Run Tests — 22 hours of blocked CI after 1.35.0, and fix(ui): slide the detail tab indicator instead of morphing glass #386 had to smuggle the changelog fix into a UI PR to verify itself.

The change

The prose and the list answer different questions. Curated Highlights say why to update; Features and Bug Fixes say what changed. So emit both, in that order, and let either be absent.

Live, against the current release branch:

Before — Error: release 1.37.0 has no non-empty ### Highlights section

After

### Features

* **sandboxes:** surface the sandbox template catalog (CORE-107)

And with Highlights written (real 1.36.0), the two appear together:

ArcBox keeps running after you close its window, so a sandbox execution that
finished and a daemon that died were both invisible until you went back and
looked. […]

### Features

* **notifications:** notify on sandbox results and daemon health

What still fails, and why that one is worth keeping

Only a release with neither prose nor user-facing entries. That is a real signal instead of a standing tax: a bare engine bump lands under Miscellaneous, produces no user-facing entry, and genuinely needs a human to say what it means — 1.36.1 was exactly that release.

Two supporting decisions:

• Section titles reuse ChangelogParser's user-facing set (Features, Bug Fixes, Performance, Security), so the About window and the update dialog cannot disagree about what counts as user-facing.
• The ([#387](…)) ([abc1234](…)) trailers are stripped. Right for a changelog, noise in an update dialog — and shipping them would reintroduce exactly what fix(updater): embed release notes in appcast instead of linking GitHub #233 removed when it stopped linking GitHub. Judgment call, reversible by deleting strip_trailing_links; say the word if you'd rather keep them.

Second commit: scope the gate

Kept from the earlier version of this PR. Fatal on the release PR and on master, where it guards the tag and says master is unshippable; a warning on every other PR, where failing turned one bad release PR into everyone's outage. github.head_ref is read via env: rather than interpolated, since it is attacker-controllable on forked PRs.

Verification

• make test-xtask: 15 passed. Five new cases — pairing, fallback with no Highlights, the nothing-user-facing rejection, an absent release, and that link stripping leaves ordinary parenthesised prose alone.
• Real extractions run against the live changelog for 1.36.0 and 1.37.0, with the old binary run side by side for the before/after above.
• Gate branching exercised across release PR / master push / normal PR × missing / present.
• make lint-xtask clean, actionlint clean, zizmor adds no new findings.
• CONTRIBUTING.md and xtask/README.md both described Highlights as mandatory; updated.

Not addressed

Nothing here stops a release PR merging red — the master ruleset still has no required_status_checks rule at all. That is a settings change; the prepared payload is still waiting.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[greptile-apps]

Greptile Summary

The PR builds Sparkle release notes from optional curated Highlights followed by selected user-facing changelog sections, while retaining rejection when both sources are empty.

• Adds parsing, rendering, trailer removal, and focused release-note tests.
• Makes the release-note gate fatal on release branches and pushes while warning on other pull requests.
• Updates contributor and xtask documentation for the new fallback behavior.

Confidence Score: 4/5

The PR does not appear safe to merge until ordinary pull requests distinguish an expected lack of user-facing notes from unexpected release-note generation failures.

The existing catch-all remains: any nonzero release-note command result on an ordinary pull request, including missing releases and filesystem failures, is converted into a successful warning rather than failing CI.

Files Needing Attention: .github/workflows/pr.yml

Important Files Changed

Filename	Overview
.github/workflows/pr.yml	Scopes the release-note gate by branch and event, but still conflates expected empty-note failures with unrelated command and I/O failures on ordinary pull requests.
xtask/src/commands/release/notes.rs	Combines Highlights with user-facing changelog sections, strips generated link trailers, rejects empty output, and adds representative tests.
CONTRIBUTING.md	Documents Highlights as optional when user-facing changelog entries provide fallback release notes.
xtask/README.md	Updates the release-notes command description to reflect combined extraction and empty-output rejection.

_{Reviews (3): Last reviewed commit: "Merge branch 'master' into ci/scope-high..." | Re-trigger Greptile}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[linear-code]

ABXD-158