chore(release): commit version and notes together

Allow staged or unstaged release notes and commit their final contents with the version update before tagging. Continue rejecting unrelated tracked changes and require notes to remain uncommitted.

Update the release skill, skip duplicate push CI for release metadata alone, and check the publish script syntax in CI. Validated publication behavior in temporary Git repositories, Bash syntax, and Actionlint.

Co-authored-by: Codex <noreply@openai.com>

.agents/skills/release/SKILL.md

@@ -53,8 +53,9 @@ description: 准备或执行当前仓库发版，维护中文发布说明。用
 ## 执行正式发版
 
 调用入口前重新核对当前脚本的副作用、目标版本和待推送提交，保留无关工作区内容，不自动清理或暂存用户文件。
-当前脚本要求先提交 `release/notes.md`，再由脚本更新 `release/version.yaml` 并创建版本提交，
-不要提前把版本文件改成目标版本，否则脚本会判定该版本已设置。
+先编辑 `release/notes.md`，保留为未提交改动（已暂存或未暂存均可）；其他已跟踪文件的改动应先单独提交。
+脚本会更新 `release/version.yaml`，将它与最终工作区中的发布说明一起提交为 `chore(release): prepare vX.Y.Z`。
+不要提前单独提交说明或把版本文件改成目标版本；脚本要求说明相对 HEAD 有改动，并自行更新版本号。
 本任务需要的提交按贡献文档保留英文 Conventional Commits 与相应署名。
 
 在准备完成且用户已授权正式发布后，将 `release_version` 设为已确定的版本，执行：
@@ -63,7 +64,7 @@ description: 准备或执行当前仓库发版，维护中文发布说明。用
 release/publish "$release_version"
 ```
 
-该命令会创建版本提交与 annotated tag，原子推送分支和 tag，再从长期分支手动触发 `release.yml`。
+该命令会创建包含版本号和发布说明的单次提交与 annotated tag，原子推送分支和 tag，再从长期分支手动触发 `release.yml`。
 它没有只读预演模式；不能为了检查或演练而执行。发布工作流读取 tag 中的说明，修改 tag 之后的本地文件不会改变该次构建。
 
 ## 恢复与验收

.github/workflows/_quality.yml

@@ -205,3 +205,6 @@ jobs:
           rhysd/actionlint:1.7.7@sha256:887a259a5a534f3c4f36cb02dca341673c6089431057242cdc931e9f133147e9
           -color
           .github/workflows/*.yml
+
+      - name: Check release script syntax
+        run: bash -n release/publish

.github/workflows/ci.yml

@@ -6,6 +6,7 @@ on:
       - main
     paths-ignore:
       - 'release/version.yaml'
+      - 'release/notes.md'
   pull_request:
     branches:
       - main

release/publish

@@ -16,8 +16,9 @@ Usage:
 Example:
   release/publish 0.1.4
 
-Before publishing, replace release/notes.md with the new version's notes and
-commit it. Its first line must be "# v<version>".
+Before publishing, replace release/notes.md with the new version's notes,
+starting with "# v<version>". Leave the notes uncommitted; this command commits
+them together with release/version.yaml. Commit other tracked changes first.
 USAGE
 }
 
@@ -94,11 +95,11 @@ remote_url="$(git remote get-url "$remote")" || die "failed to resolve remote UR
 repository="$(gh repo view "$remote_url" --json nameWithOwner --jq '.nameWithOwner' 2>/dev/null)" ||
   die "failed to resolve GitHub repository for $remote_url"
 
-if ! git diff --quiet --ignore-submodules --; then
-  die "tracked files have unstaged changes; commit or stash them first"
+if ! git diff --quiet --ignore-submodules -- . ":(exclude)$NOTES_FILE"; then
+  die "tracked files other than $NOTES_FILE have unstaged changes; commit or stash them first"
 fi
-if ! git diff --cached --quiet --ignore-submodules --; then
-  die "index has staged changes; commit or unstage them first"
+if ! git diff --cached --quiet --ignore-submodules -- . ":(exclude)$NOTES_FILE"; then
+  die "index has staged changes outside $NOTES_FILE; commit or unstage them first"
 fi
 
 current_version="$(read_version_key version)"
@@ -108,6 +109,9 @@ current_version="${current_version#v}"
 tag="${TAG_PREFIX}${version}"
 
 git ls-files --error-unmatch "$NOTES_FILE" >/dev/null 2>&1 || die "$NOTES_FILE is not tracked"
+if git diff HEAD --quiet -- "$NOTES_FILE"; then
+  die "$NOTES_FILE must have uncommitted changes so notes and version are committed together"
+fi
 ruby - "$NOTES_FILE" "$tag" <<'RUBY'
 path, tag = ARGV
 lines = File.readlines(path)
@@ -141,9 +145,9 @@ fi
 
 update_version_file "$version"
 
-git add "$VERSION_FILE"
+git add -- "$VERSION_FILE" "$NOTES_FILE"
 git commit \
-  -m "chore: bump version to $version" \
+  -m "chore(release): prepare $tag" \
   -m "$SIGNATURE"
 
 git tag -a "$tag" -m "$tag"