Auto-create GitHub Release on tag push

.github/workflows/release.yml

@@ -45,7 +45,11 @@ jobs:
       url: https://pypi.org/p/dcebe
     permissions:
       id-token: write     # required for OIDC trusted publishing
+      contents: write     # required for the GitHub Release step below
     steps:
+      - name: Checkout (for CHANGELOG.md if present)
+        uses: actions/checkout@v4
+
       - uses: actions/download-artifact@v4
         with:
           name: dist
@@ -56,3 +60,30 @@ jobs:
         # No `password:` argument — OIDC trusted publisher (configure
         # at https://pypi.org/manage/account/publishing/ before the
         # first release).
+
+      - name: Extract release notes from CHANGELOG.md (or fall through)
+        # Pulls the section bounded by `## <ver>` (bracket-tolerant) and
+        # the next `## ` heading. DCEBE doesn't have a CHANGELOG.md yet —
+        # this step writes a stub link to the tag's commits, and the
+        # release-creation step's `generate_release_notes: true` provides
+        # an auto-generated PR/commit summary as the visible content.
+        run: |
+          VER="${GITHUB_REF_NAME#v}"
+          if [ -f CHANGELOG.md ]; then
+            awk -v ver="$VER" '
+              $0 ~ "^## \\[?" ver "\\]?( |$)" { found=1; next }
+              found && /^## / { exit }
+              found { print }
+            ' CHANGELOG.md > release-notes.md
+          fi
+          [ -s release-notes.md ] || echo "See [tag commits](https://github.com/${GITHUB_REPOSITORY}/commits/${GITHUB_REF_NAME})." > release-notes.md
+
+      - name: Create GitHub Release
+        # Idempotent: updates an existing Release for this tag rather
+        # than erroring, so manual pre-creation never blocks a re-run.
+        uses: softprops/action-gh-release@v2
+        with:
+          name: ${{ github.ref_name }}
+          body_path: release-notes.md
+          generate_release_notes: true
+          files: dist/*