ci(release): roll CHANGELOG [Unreleased] into the version on tag (#4904)

* ci(release): roll CHANGELOG [Unreleased] into the version on tag

The changelog once drifted five releases behind the tags, with
everything piled under [Unreleased] (reconstructed in #4898), because
releases are cut automatically but the rollup was manual.

Mechanize it: when the release workflow cuts vX.Y.Z and [Unreleased]
has entries, it rewrites the header into an empty [Unreleased] plus a
dated [X.Y.Z] section carrying those entries, commits, pushes to
master with the release PAT, and tags the rolled commit. If the push
is rejected (branch protection), it warns and tags the current HEAD —
a release is never blocked on the docs commit. With no entries there
is nothing to roll and the step is skipped.

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: 3 people

.github/workflows/loop-release.yml

@@ -95,6 +95,63 @@ jobs:
 
           git config user.name "loop release bot"
           git config user.email "noreply@users.noreply.github.com"
+
+          # Roll [Unreleased] into the new version's section BEFORE tagging, so
+          # the changelog can never drift behind the tags again (it once fell
+          # five releases behind, with everything piled under [Unreleased]).
+          # The rolled commit is what gets tagged. If master rejects the push
+          # (e.g. branch protection), fall back to tagging the current HEAD and
+          # say so loudly — a release must not be blocked on the docs commit.
+          if printf '%s\n' "$UNRELEASED" | grep -qE '^### '; then
+            DATE=$(date -u +%Y-%m-%d)
+            if DATE="$DATE" NEXT="$NEXT" python3 - <<'PY'
+import os
+import sys
+
+path = "CHANGELOG.md"
+next_ver = os.environ["NEXT"].lstrip("v")
+date = os.environ["DATE"]
+
+with open(path, "r", encoding="utf-8") as f:
+    txt = f.read()
+
+needle = "## [Unreleased]\n"
+placeholder = "\n\n_Nothing yet — rolled into a version section on each release._\n\n---\n\n"
+
+pos = txt.find(needle)
+if pos == -1:
+    sys.exit(1)
+
+after = txt[pos + len(needle):]
+# If the placeholder block is still present under [Unreleased], strip it so it
+# does not get carried into the versioned section.
+if after.startswith(placeholder):
+    after = after[len(placeholder):]
+# Normalize spacing so the version header is followed by exactly one blank line.
+after = after.lstrip("\n")
+
+out = txt[:pos + len(needle)] + placeholder + f"## [{next_ver}] - {date}\n\n" + after
+
+with open(path, "w", encoding="utf-8") as f:
+    f.write(out)
+PY
+            then
+              git add CHANGELOG.md
+              git commit -m "docs(changelog): roll [Unreleased] into ${NEXT#v}"
+              if git push "https://x-access-token:${RELEASE_TOKEN}@github.com/${REPO}.git" HEAD:master; then
+                echo "Rolled CHANGELOG [Unreleased] into ${NEXT#v}."
+              else
+                echo "::warning::CHANGELOG roll push to master was rejected — tagging without it. Roll [Unreleased] into ${NEXT#v} manually."
+                git reset --hard HEAD^
+              fi
+            else
+              echo "::warning::CHANGELOG [Unreleased] header not found in the expected shape — tagging without the roll."
+              git checkout -- CHANGELOG.md
+            fi
+          else
+            echo "CHANGELOG [Unreleased] has no entries — nothing to roll."
+          fi
+
           git tag -a "$NEXT" -m "Release $NEXT — automated $KIND ($COUNT commits since $LATEST)"
           git push "https://x-access-token:${RELEASE_TOKEN}@github.com/${REPO}.git" "$NEXT"
           echo "Pushed $NEXT."