ci: fix the release job being skipped, and take the notes from the changelog

The job inherited the implicit success() and was skipped whenever the build job
upstream was skipped (images reused). It now checks publish explicitly, like
publish does. Notes come from the matching CHANGELOG section through
scripts/release-notes.sh, not from the commit log of the whole history.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -220,7 +220,9 @@ jobs:
   gitea-release:
     name: Cria a release no Gitea
     needs: [publish, prepare]
-    if: startsWith(gitea.ref, 'refs/tags/v')
+    # Explicit, like publish: the build job upstream is skipped when the images
+    # are reused, and the implicit success() would then skip this job too.
+    if: ${{ !cancelled() && needs.publish.result == 'success' && startsWith(gitea.ref, 'refs/tags/v') }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -233,21 +235,7 @@ jobs:
           API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
           NAMESPACE: ${{ env.REGISTRY }}/${{ needs.prepare.outputs.namespace }}
         run: |
-          prev=$(git describe --tags --abbrev=0 "$TAG^" 2>/dev/null || true)
+          scripts/release-notes.sh "$TAG" "$NAMESPACE" > notes.md
-          range=${prev:+$prev..}$TAG
-          {
-            echo "## Imagens"
-            echo
-            echo '```'
-            for s in protocols auth storage webmail migrations rspamd; do
-              echo "$NAMESPACE/$s:${TAG#v}"
-            done
-            echo '```'
-            echo
-            echo "## Mudanças${prev:+ desde $prev}"
-            echo
-            git log --no-merges --format='- %s (%h)' "$range"
-          } > notes.md
           pre=false; case "$TAG" in *-*) pre=true ;; esac
           jq -n --arg tag "$TAG" --arg name "LambdaMail ${TAG#v}" --rawfile body notes.md --argjson pre "$pre" \
             '{tag_name:$tag, name:$name, body:$body, prerelease:$pre}' > release.json

scripts/release-notes.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Prints the release notes for a tag: the images it publishes, then the matching
+# section of CHANGELOG.md (the commit log since the previous tag if the changelog
+# has no section for that version).
+#
+#   scripts/release-notes.sh v1.2.3 git.example.com/owner/project
+set -euo pipefail
+
+tag=${1:?usage: release-notes.sh <tag> <image-namespace>}
+namespace=${2:?usage: release-notes.sh <tag> <image-namespace>}
+version=${tag#v}
+
+echo "## Images"
+echo
+echo '```'
+for service in protocols auth storage webmail migrations rspamd; do
+  echo "$namespace/$service:$version"
+done
+echo '```'
+echo
+
+section=""
+if [ -f CHANGELOG.md ]; then
+  section=$(awk -v head="## [$version]" '
+    index($0, head) == 1 { found = 1; next }
+    found && /^## \[/ { exit }
+    found && /^\[[^]]+\]: / { next }
+    found { print }
+  ' CHANGELOG.md)
+fi
+
+if [ -n "$(printf '%s' "$section" | tr -d '[:space:]')" ]; then
+  printf '%s\n' "$section"
+else
+  previous=$(git describe --tags --abbrev=0 "$tag^" 2>/dev/null || true)
+  echo "## Changes${previous:+ since $previous}"
+  echo
+  git log --no-merges --format='- %s (%h)' "${previous:+$previous..}$tag"
+fi