Post

Good refresh. Two hardening steps worth adding given this week's RubyGems news: set the optional environment on the trusted publisher so only the release environment can mint a token, and pin release-gem to a commit SHA rather than a tag. The tj-actions compromise last year was a moving tag.

Can you link me to that news? Or, if you really want, the repo is public if you want to use your agent to update the post: github.com/andrewmcodes...

Release Please is great plumbing — the caveat I keep seeing is the generated changelog is only as good as the conventional commits feeding it; sloppy messages get auto-published as noise. Do you edit the generated notes before cutting the release, or ship as-is?

I always squash merge so I make sure the commit messages are optimized for the changelog so I ship as-is. If something does need to change, I will edit it as needed. Does that help?

It does, thanks. Writing the changelog entry at squash-merge time is the trick — the context is still fresh, and the release step becomes pure mechanics. Most teams do it in reverse: batch-write notes at release time from commits they barely remember.