ci: use explicit release notes for immutable releases (#456)

Refs #455\n\nThe v0.5.0 publication run successfully built, published,
and attested the artifacts, but the final GitHub Release creation failed
through gh generated notes with HTTP 404. The release was recovered with
explicit notes. Remove the generated-notes API path and add a regression
test so future release runs use the known-good explicit-notes path.

Author: codeforester

.github/workflows/package.yml

@@ -496,7 +496,6 @@ jobs:
           gh release create "$tag" "${assets[@]}" \
             --repo "$GITHUB_REPOSITORY" \
             --title "$tag" \
-            --generate-notes \
             --notes "Published distributions and release metadata for $tag. See CHANGELOG.md for the reviewed release notes." \
             || create_status=$?
 

tests/test_package_workflow.py

@@ -46,6 +46,16 @@ def test_package_workflow_does_not_replace_published_release_assets() -> None:
     assert "--clobber" not in workflow
 
 
+def test_package_workflow_uses_explicit_release_notes() -> None:
+    workflow = (Path(__file__).resolve().parents[1] / ".github/workflows/package.yml").read_text(encoding="utf-8")
+
+    assert "--generate-notes" not in workflow
+    assert (
+        '--notes "Published distributions and release metadata for $tag. See CHANGELOG.md for the reviewed release notes."'
+        in workflow
+    )
+
+
 def test_package_workflow_gates_writes_on_release_provenance() -> None:
     workflow = (Path(__file__).resolve().parents[1] / ".github/workflows/package.yml").read_text(encoding="utf-8")
     jobs = yaml.safe_load(workflow)["jobs"]