chore: release notes pulled from CHANGELOG.md automatically

- release.yml: extract matching version block from CHANGELOG as release body
- release.md rule: require summary + categorised sections in every CHANGELOG entry
- CHANGELOG: add summary sentence to v0.2.0 entry
- v0.2.0 GitHub Release: patched with full description

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: jakeschepis

.claude/rules/release.md

@@ -37,12 +37,36 @@ Semver: `vMAJOR.MINOR.PATCH`
 - New command → MINOR (`v0.2.0`)
 - Breaking flag/output change → MAJOR (`v1.0.0`)
 
-Steps:
-1. Move `[Unreleased]` items in `CHANGELOG.md` to the new version + date
-2. `git commit -m "chore: release v0.2.0"`
-3. `git tag -a v0.2.0 -m "Release v0.2.0"` — annotated tags only, never lightweight
-4. `git push origin v0.2.0`
+### CHANGELOG.md format
 
-GitHub Actions then builds 5 platform binaries and publishes the GitHub Release automatically.
+The CHANGELOG entry becomes the GitHub Release description automatically — write it well.
+Each version block must have:
+- A one or two sentence **summary** at the top describing what this release is about
+- `### Added` — new commands, features, endpoints
+- `### Fixed` — bug fixes
+- `### Security` — any security improvements (if applicable)
+- `### Changed` — breaking changes or behaviour changes (if applicable)
 
-> Never push a tag without updating CHANGELOG.md first.
+Example:
+```markdown
+## [0.3.0] - 2026-03-01
+
+This release adds budget reporting commands and improves error messages across all commands.
+
+### Added
+- `xero reports budget-summary` — compare actuals vs budget by org
+- `xero reports budget-variance` — line-by-line variance report
+
+### Fixed
+- Auth refresh no longer silently fails when instance_token is missing
+```
+
+### Steps
+1. Write `CHANGELOG.md` entry with summary + categorised changes (see format above)
+2. `git commit -m "chore: release v0.3.0"`
+3. `git tag -a v0.3.0 -m "Release v0.3.0"` — annotated tags only, never lightweight
+4. `git push origin v0.3.0`
+
+GitHub Actions extracts the CHANGELOG entry and uses it as the release description, then builds 5 platform binaries automatically.
+
+> Never push a tag without a well-written CHANGELOG entry first.

.github/workflows/release.yml

@@ -15,19 +15,32 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+
       - uses: actions/setup-go@v5
         with:
           go-version: '1.23'
           cache: true
+
+      - name: Extract release notes from CHANGELOG.md
+        id: changelog
+        run: |
+          VERSION="${{ github.ref_name }}"
+          VERSION_NUM="${VERSION#v}"
+          NOTES=$(awk "/^## \[${VERSION_NUM}\]/{found=1; next} /^## \[/{if(found) exit} found{print}" CHANGELOG.md)
+          echo "notes<<EOF" >> $GITHUB_OUTPUT
+          echo "$NOTES" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
       - name: Build release binaries
         env:
           CLIENT_ID: ${{ secrets.XERO_CLIENT_ID }}
           PROXY_URL: ${{ secrets.PROXY_URL }}
         run: |
           chmod +x scripts/release.sh
           ./scripts/release.sh ${{ github.ref_name }}
+
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
           files: dist/*
-          generate_release_notes: true
+          body: ${{ steps.changelog.outputs.notes }}

CHANGELOG.md

@@ -9,6 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [0.2.0] - 2026-02-20
 
+This release introduces the Cloudflare Worker auth proxy, which removes the Xero `client_secret` from the CLI binary entirely. Authentication is now gated through the Zeus Electron app — users cannot run `xero auth login` directly without being authorised through Zeus first.
+
 ### Added
 - Cloudflare Worker auth proxy (`worker/`) — `client_secret` now lives exclusively in Cloudflare, never in the CLI binary
 - Session token gating: `xero auth login` can only be initiated through the Zeus Electron app (requires `ZEUS_SESSION_TOKEN` env var set by Zeus)