docs: retire CHANGELOG.md in favour of the generated release notes

.github/workflows/ci.yml

@@ -258,11 +258,14 @@ jobs:
         id: pack
         shell: pwsh
         run: |
+          # --no-build, like Test above: packing the same outputs the tests ran against is what lets
+          # docs/publishing.md promise a release ships exactly what CI exercised. Without it pack is
+          # free to re-run Build, and a regenerated assembly could reach a package untested.
           if ($env:PUBLIC_RELEASE -eq 'true') {
-            dotnet pack src/Repl.slnx -c Release --no-restore -p:PublicRelease=true -p:WarnOnPackingNonPackableProject=false -o '${{ runner.temp }}/packages'
+            dotnet pack src/Repl.slnx -c Release --no-build --no-restore -p:PublicRelease=true -p:WarnOnPackingNonPackableProject=false -o '${{ runner.temp }}/packages'
           }
           else {
-            dotnet pack src/Repl.slnx -c Release --no-restore -p:WarnOnPackingNonPackableProject=false -o '${{ runner.temp }}/packages'
+            dotnet pack src/Repl.slnx -c Release --no-build --no-restore -p:WarnOnPackingNonPackableProject=false -o '${{ runner.temp }}/packages'
           }
 
       - name: Package readiness report (non-blocking)
@@ -508,13 +511,43 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          set -euo pipefail
           VERSION="${{ needs.build-test-pack.outputs.version }}"
           PRERELEASE=""
           [[ "$VERSION" == *-* ]] && PRERELEASE="--prerelease"
-          gh release create "v${VERSION}" packages/* \
-            --title "v${VERSION}" \
-            --generate-notes \
-            $PRERELEASE
+
+          # A release branch's version has no {height}, so every commit on it computes the same
+          # number. Creating the release twice is therefore an ordinary occurrence rather than an
+          # error, and failing here would skip Publish to NuGet for a run that had nothing wrong
+          # with it. So this path does nothing at all — deliberately, and loudly.
+          #
+          # Nothing, rather than re-uploading: a published version is immutable on NuGet, so
+          # replacing the release's assets would leave a direct GitHub download and a NuGet install
+          # of the same version carrying different binaries, with the tag describing neither.
+          # Whatever a repeat run built cannot ship under this version; that needs a version bump.
+          if gh release view "v${VERSION}" >/dev/null 2>&1; then
+            echo "::warning title=Release v${VERSION} already exists::Its assets and tag are left untouched. NuGet still runs and will skip every version it already has — but it accepts one it is missing, which is how a partial push recovers. If this commit changed shipped code, bump the version on the release branch: the release's own assets will not be updated."
+            {
+              echo "### Release \`v${VERSION}\` already exists — left untouched"
+              echo
+              echo "Its assets and tag are unchanged. \`Publish to NuGet\` still runs: it skips every"
+              echo "version already published, which is the normal outcome here, and uploads one that"
+              echo "is missing, which is how a partially failed push recovers."
+              echo
+              echo "So a code change in this commit cannot reach consumers as \`${VERSION}\` through the"
+              echo "release assets, and reaches NuGet only for a package NuGet does not yet have."
+              echo "Bump the version on the release branch if the change is meant to ship."
+            } >> "$GITHUB_STEP_SUMMARY"
+          else
+            # --target is what makes the tag point at the commit that built these packages. Without
+            # it, gh creates a missing tag from the latest state of the default branch, so a
+            # release/** publish would tag main instead of the release branch it ran on.
+            gh release create "v${VERSION}" packages/* \
+              --title "v${VERSION}" \
+              --target "${GITHUB_SHA}" \
+              --generate-notes \
+              $PRERELEASE
+          fi
 
       - name: Publish to NuGet
         if: success()