ci: draft releases with GITHUB_TOKEN and drop the CHANGELOG

.github/CONTRIBUTING.md

@@ -14,8 +14,8 @@ This repository follows the Bugs5382 standard workflow.
 4. Open a PR with a Conventional Commit title. The autolabeler sets the category label
    from the title; fill the PR template, reference the issue (`Closes #N`), and add a
    closing summary before merge.
-5. PRs merge by squash. On merge, release-drafter drafts the next notes and the changelog
-   updates on `main`; the maintainer publishes releases manually.
+5. PRs merge by squash. On merge, release-drafter drafts the next release notes; the
+   maintainer publishes releases manually.
 
 Keep one concern per PR, even small ones. When editing GitHub Actions workflows, a job id must be a
 plain identifier (a letter or `_`, then alphanumerics/`-`/`_`); put emoji and display text in the

.github/workflows/release-drafter.yml

@@ -1,16 +1,8 @@
 name: Release Drafter
 
-# Drafts the next release on push to main and updates CHANGELOG.md before the
-# release is cut; autolabels PRs so the draft is categorized.
-#
-# DISABLED until the org GitHub App is configured: every job is gated on
-# `vars.APP_CLIENT_ID`, so until that variable is set the job is skipped (no
-# runs, no failures). Once APP_CLIENT_ID (variable) and APP_PRIVATE_KEY
-# (secret) are set for the org/repo, it self-enables — no edit required.
-#
-# The App token is used to push the CHANGELOG commit back to main. That commit
-# touches only CHANGELOG.md (path-ignored by ci-go) and carries [skip ci], so
-# it never re-triggers this workflow.
+# Drafts the next release on push to main; autolabels PRs so the draft is
+# categorized. Runs with the built-in GITHUB_TOKEN, no org GitHub App
+# required.
 
 on:
   push:
@@ -30,55 +22,24 @@ concurrency:
 
 jobs:
   draft:
-    name: Draft release and update changelog
-    # Inert until the GitHub App is configured (see header).
-    if: ${{ vars.APP_CLIENT_ID != '' && github.event.pull_request.draft != true }}
+    name: Draft release
+    if: ${{ github.event.pull_request.draft != true }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
-      contents: write # update releases + push the changelog commit
-      pull-requests: write # autolabeler
+      contents: write
+      pull-requests: write
     steps:
-      - name: Create GitHub App token
-        id: app-token
-        uses: actions/create-github-app-token@v3.1.1
-        with:
-          client-id: ${{ vars.APP_CLIENT_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          token: ${{ steps.app-token.outputs.token }}
           fetch-depth: 0
 
       - name: Release Drafter
-        id: drafter
         uses: Bugs5382/release-drafter-action@de0c4559d69039b8b371ef951b62a2532ad3593f  # v1.0.1
         with:
-          token: ${{ steps.app-token.outputs.token }}
+          token: ${{ secrets.GITHUB_TOKEN }}
           extends: CryptOS-PKI/.github@aa8761a2903d759dbb5f48b8d5e3517a9dc6da79
           first-version: 0.1.0
           prerelease: true
           prerelease-identifier: rc
-
-      - name: Update CHANGELOG
-        if: github.event_name != 'pull_request'
-        uses: Bugs5382/changelog-updater-action@v0.3.2
-        env:
-          LOG_LEVEL: debug
-          LOG_FORMAT: text
-          RELEASE_NOTES: >-
-            ${{ steps.drafter.outputs.body }}
-          RELEASE_VERSION: v${{ steps.drafter.outputs.resolved_version }}
-        with:
-          tag: ${{ env.RELEASE_VERSION }}
-          notes: ${{ env.RELEASE_NOTES }}
-          diff: "true"
-
-      - name: Commit changelog
-        if: github.event_name != 'pull_request'
-        uses: stefanzweifel/git-auto-commit-action@v4
-        with:
-          commit_message: "chore(pre-release): v${{ steps.drafter.outputs.resolved_version }} [skip ci]"
-          file_pattern: CHANGELOG.md

CLAUDE.md

@@ -34,7 +34,7 @@ the governance below is shared across all repos created that way.
 - Verify with evidence, not assertions: run the real check for what changed (lint, a full
   template/build render, `actionlint` for workflows) before calling it done. Green CI is necessary,
   not sufficient.
-- One concern per branch/PR, even tiny ones — it keeps reviews and the drafted changelog clean.
+- One concern per branch/PR, even tiny ones — it keeps reviews and the draft release notes clean.
 - When PRs interact, state an explicit merge ORDER rather than opening them and walking away:
   anything a *tag* triggers needs its inputs on `main` first; a new *gate* (check) needs the
   violations it catches fixed first; a workflow that builds from committed content needs that
@@ -52,26 +52,19 @@ issue with ordered **sub-issues** -> put it on the active **milestone** -> branc
 (the autolabeler sets the category label from the title), the template body, and a **closing
 summary** before merge -> **squash** merge. The operator (@CryptOS-PKI) is the assignee.
 
-On merge, release-drafter drafts the next notes by label and `CHANGELOG.md` updates on `main` via the
-changelog action -- **nothing tags automatically**. When the first push to main resolves the version,
-rename the milestone to that version. The maintainer then **manually publishes the GitHub Release**,
-which creates the tag with the finalized changelog (and triggers the publish where the repo ships a
-package).
+On merge, release-drafter drafts the next notes by label -- **nothing tags automatically**. When
+the first push to main resolves the version, rename the milestone to that version. The maintainer
+then **manually publishes the GitHub Release**, which creates the tag with the drafted notes (and
+triggers the publish where the repo ships a package).
 
 Keep public artifacts (issues, PRs, commit messages) free of references to local-only design notes.
 
 ## Releasing
 
-On every push to `main` the **Release Manager** workflow (`.github/workflows/job-version-bump.yaml`)
-runs: release-drafter anticipates the next version, the manifest version is bumped (package
-ecosystems only), `CHANGELOG.md` is updated via the changelog action, and a
-`chore(pre-release): vX [skip ci]` commit is pushed back to `main`. **Nothing tags automatically.**
+On every push to `main` the **Release Drafter** workflow (`.github/workflows/release-drafter.yml`)
+drafts the next release notes using the built-in `GITHUB_TOKEN`. **Nothing tags automatically.**
 The maintainer then publishes the GitHub Release by hand, which creates the `vX.Y.Z` tag with the
-finalized changelog and triggers the publish workflow where the repo ships a package.
-
-The Release Manager pushes to `main` through the release GitHub App, which the branch ruleset
-(`governance/rulesets/branch-default.json`) lists as a bypass actor — without that bypass the
-`[skip ci]` commit would be rejected by the PR-required rule.
+drafted notes and triggers the publish workflow where the repo ships a package.
 
 **GitHub Action repos release differently** — a composite/JS action has no package manifest and is
 **not** published to a registry. The maintainer manually tags `vX.Y.Z`, publishes the GitHub