fix

.github/workflows/release.yml

@@ -81,6 +81,7 @@ jobs:
       name: GitHub
       url: "https://github.com/ei-grad/flask-shell-ipython/releases/"
     permissions:
+      attestations: write
       contents: write
       id-token: write
     steps:
@@ -90,7 +91,11 @@ jobs:
       - name: Extract Version from pyproject.toml
         run: |
           pip install toml
-          VERSION_FROM_PYPROJECT=$(python -c "import toml; print(toml.load('pyproject.toml')['project']['version'])")
+          VERSION_FROM_PYPROJECT=$(python << EOF
+          import toml
+          print(toml.load('pyproject.toml')['project']['version'])
+          EOF
+          )
           echo "VERSION_FROM_PYPROJECT=$VERSION_FROM_PYPROJECT" >> $GITHUB_ENV
       - name: Ensure version consistency
         run: |
@@ -100,17 +105,22 @@ jobs:
           fi
           echo VERSION=$VERSION_FROM_GIT_REF >> $GITHUB_ENV
       - name: Extract changelog for release notes
-        id: changelog
         run: |
-          CHANGELOG=$(awk -v version="$VERSION" '{
-              if ($0 ~ "^## \\[" version "\\]") inSection = 1;
-              else if ($0 ~ "^## \\[" && inSection) inSection = 0;
-              if (inSection) print $0;
-          }' CHANGELOG.md)
-          echo '::set-output name=section::${CHANGELOG}'
+          (
+            echo "CHANGELOG<<EOF"
+            awk -v version="$VERSION" '{
+                if ($0 ~ "^## \\[" version "\\]") inSection = 1;
+                else if ($0 ~ "^## \\[" && inSection) inSection = 0;
+                if (inSection) print $0;
+            }' CHANGELOG.md
+            echo "EOF"
+          ) >> $GITHUB_ENV
       - name: Validate changelog content
-        if: steps.changelog.outputs.section == ''
-        run: echo "Changelog section for release notes is empty" && exit 1
+        run: |
+          if [ -z "$CHANGELOG" ] ; then
+            echo "Missing CHANGELOG.md section for release $VERSION"
+            exit 1
+          fi
       - name: Download artifacts
         uses: actions/download-artifact@v4
       - name: Attest build provenance
@@ -121,14 +131,14 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: >-
-          gh release create '${{ github.ref_name }}'
+          gh release create "$VERSION"
           --draft
-          --notes '${{ steps.changelog.outputs.section }}'
+          --notes "$CHANGELOG"
       - name: Upload artifact signatures to GitHub Release
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: >-
-          gh release upload '${{ github.ref_name }}' dist/**
+          gh release upload "$VERSION" dist/**
 
   pypi-publish:
     name: Release on PyPI