Release notes & tag message are stripped to title-only when the release squash commit omits the PR body #298

Problem

The post-release Create GitHub Release path derives both the GitHub Release body and the annotated tag message from the release commit's message body, not from the release PR. When the next → master (or hotfixes → master) squash lands as a title-only commit — i.e. the squash didn't carry the PR body — the generated notes collapse to just the release title plus a regenerated contributors block. The curated changelog and the coverage block, which live in the PR/commit body, are lost from the published Release and from the tag.

Where

actions/github/jobs/create-release/action.yml:

• Both the release body: (line 204) and the tag message: (line 152) come from steps.release-notes.outputs.changelog-content.
• steps.release-notes is git/steps/generate-comprehensive-changelog invoked with use-single-commit-message: true.
• In that action (generate-comprehensive-changelog/action.mjs, the single-commit paths around L1098–1119 and L1152–1170) the notes are built from git log -1 --pretty="%s|%b" — the release commit — and a 👥 Contributors <details> block is then regenerated via buildContributorMentionsDetails(...) and appended. When %b is empty, releaseNotes = subject only.

Evidence (CLDMV/slothlet)

Release-commit body sizes on master:

Every release since v3.15.1 (2026-09-02) is title-only; v3.15.0 and earlier carry full bodies — the 24.5 KB v3.13.0 body rules out a size limit. The published v3.16.1 release shows only the title and a 👥 Contributors block; that block is the regenerated one (it even lists @cldmv-bot), which confirms the body-derived content is gone while the independently-appended piece survives.

Root cause

Two layers:

1. .github (this repo — fixable here): the notes are sourced from the fragile release-commit body instead of the durable release-PR body. Any squash that omits the body (see layer 2) yields empty notes.
2. Merge path (outside .github): the next → master squash is landing title-only even though the repo sets squash_merge_commit_message: PR_BODY and the PR body is fully populated (the merge dialog even previews it). That is the merge client dropping the body; .github cannot control the merge client, so the robust fix belongs in layer 1.

Proposed fix

Source the release notes from the merged release PR's body rather than the release commit body: parse the (#N) PR reference from the release commit subject, fetch that PR's body via the API (a token is already available to generate-comprehensive-changelog for user lookups), and use it for both the Release body and the tag message, falling back to the current commit-message behavior when no PR reference is present or the fetch fails. This makes the notes complete regardless of whether the squash carried the body.

Secondary defect (resolved by the same fix)

The post-release buildContributorMentionsDetails path computes contributors from the single bot-authored release commit, so the appended 👥 Contributors block includes @cldmv-bot. The release PR body's own contributor block already excludes bots, so sourcing from it avoids this. If the commit-message regeneration path is retained as a fallback, it should exclude the signing bot via the existing isBotAuthor / getHumanContributors helpers.

Scope

Affects every CLDMV repo on the v4 release flow, not only slothlet — any release whose squash landed title-only has stripped published notes and tag messages. Already-affected releases can be backfilled from their PR bodies separately.