[autobackport: sssd-2-9] Automatically generate release notes when creating new release

[sssd-bot]

This is an automatic backport of PR#8568 Automatically generate release notes when creating new release to branch sssd-2-9, created by @pbrezina.

Please make sure this backport is correct.

Note

The commits were cherry-picked without conflicts.

You can push changes to this pull request

git remote add sssd-bot git@github.com:sssd-bot/sssd.git
git fetch sssd-bot refs/heads/SSSD-sssd-backport-pr8568-to-sssd-2-9
git checkout SSSD-sssd-backport-pr8568-to-sssd-2-9
git push sssd-bot SSSD-sssd-backport-pr8568-to-sssd-2-9 --force

---

Original commits
cb1ef37 - scripts: add fixed-issues.sh script
27aac3a - scripts: add generate-release-notes.py script
033a81b - scripts: add generate-full-release-notes.sh script
c8257a3 - ci: automatically generate release notes

Backported commits

• 2e5c986 - scripts: add fixed-issues.sh script
• 2a84ef4 - scripts: add generate-release-notes.py script
• e0d4b6b - scripts: add generate-full-release-notes.sh script
• a3d8650 - ci: automatically generate release notes

---

Original Pull Request Body

This will generate release notes and open a draft pull request against sssd.io

This will make the release process automated, after the workflow is run:

release notes should be reviewed, edited and pushed
release should be un-drafted and published

[gemini-code-assist]

Code Review

This pull request introduces a suite of scripts to automate the generation and publication of release notes for SSSD. It includes tools to extract fixed issues from git logs, parse commit messages for release-specific tags, and automate the creation of a pull request on the sssd.io repository. Key feedback includes fixing a script name mismatch in the release process, addressing security concerns regarding temporary file usage for tokens and PR messages, and improving the handling of multiline formatting in the Python-based note generator.

[gemini-code-assist]

The script attempts to call ./scripts/full-release-notes.sh, but the file added in this pull request is named scripts/generate-full-release-notes.sh. This mismatch will cause the release process to fail at this step.

Suggested change

	./scripts/full-release-notes.sh --from "$prev_version" --to HEAD --version "$version" > "/tmp/sssd-$version.rst"
	./scripts/generate-full-release-notes.sh --from "$prev_version" --to HEAD --version "$version" > "/tmp/sssd-$version.rst"

[gemini-code-assist]

Writing the GitHub token to a temporary file is a security risk as it could potentially be read by other processes or left behind if the script is interrupted before the rm command. It is safer to pipe the token directly to the gh auth login command.

Suggested change

	echo $FORK_TOKEN > .token
	gh auth login --with-token < .token
	rm -f .token
	echo "$FORK_TOKEN" | gh auth login --with-token

[gemini-code-assist]

This script introduces a dependency on the pypandoc Python library. If this library is not installed in the environment where the release script runs (e.g., a CI runner or a developer's machine), the script will fail. Consider using the subprocess module to call the pandoc binary directly to avoid an external Python dependency, or ensure it is added to the project's build/release requirements.

[gemini-code-assist]

Joining multiline notes with spaces will destroy markdown formatting such as bulleted lists, numbered lists, or code blocks that may be present in the commit message's release note section. This results in unreadable release notes when complex formatting is used.

Suggested change

	note = " ".join([line.strip() for line in match.split("\n")])
	note = "\n".join([line.strip() for line in match.split("\n") if line.strip()])

[gemini-code-assist]

Using a hardcoded path in /tmp for BODY_FILE can lead to conflicts if multiple instances of the script run on the same host, and it is a potential security risk (symlink attacks). It is better to use the temporary working directory $wd created earlier in the script.

Suggested change

	BODY_FILE="/tmp/relnotes-message"
	BODY_FILE="$wd/relnotes-message"

[sssd-bot]

The pull request was accepted by @alexey-tikhonov with the following PR CI status:

---

🟢 CodeQL (success)
🟢 rpm-build:centos-stream-9-x86_64:upstream (success)
🟢 Build / make-distcheck (success)
🟢 ci / prepare (success)
🟢 ci / system (centos-9) (success)
🟢 Static code analysis / codeql (success)
🟢 Static code analysis / pre-commit (success)
🟢 Static code analysis / python-system-tests (success)

---

There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.