fix(release): accept manager version bumps and render the new release's changelog

[alongubkin]

What

Two release-flow bugs that would hit the next stable release:

1. The next version PR fails "Release qualification". Prepare now bumps infra/helm/alien-manager/Chart.yaml and infra/aws-ecs-manager/variables.tf, but the detect step's file allowlist in release-qualification.yml doesn't list them, so it fails with "Release PR contains non-version files".
2. Each GitHub release body lists the previous release's changes. generate-changelog runs git-cliff --latest before the new tag exists, so it renders the range ending at the previous tag. The v3.3.26 body lists fix: scope Azure storage lifecycle rules to their container #707–chore: release v3.3.25 #756, which shipped in v3.3.25.

How

1. Add both files to the allowlist, and normalize their version fields (version/appVersion in the chart, the alien-manager:v… image default in the module) so any other change to them still fails the check.
2. Use --unreleased --tag v<version>: the commits since the last tag, rendered under the new version.

Verification

• On a scratch commit that applies prepare's own sed bumps for 3.3.27 to main: the old allowlist rejects exactly the two files; the new allowlist and the metadata check pass. A second scratch commit that also changes type: in the chart and the image registry in the module fails with "Release PR changes non-version metadata".
• git-cliff 2.14.2 with cliff.toml on main: --latest renders feat(cli): enable remote-sandbox without flags uses the platform's default image #753–fix: pin the official CLI to a platform build that matches current alien #779 (the v3.3.26 range); --unreleased --tag v3.3.27 renders chore(deps): update rust crate tower-http to v0.7.1 #553–fix: acknowledge completed pull execution receipts #873, the 68 commits since v3.3.26.

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

[High risk] Changes release workflow version detection and changelog generation.

The PR appears safe to merge based on the reviewed release-qualification and changelog changes.

Summary

The PR allows prepared manager chart and ECS module version bumps through release qualification while rejecting other metadata changes. It also generates the release changelog from unreleased commits under the new version rather than rendering the previous tag’s range.

• The follow-up change checks all three manager version values against the PR-head workspace version.
• The existing prepare step produces the formats those checks expect.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Prepare version bump] --> B[Release PR]
  B --> C[Check allowed files and manager versions]
  C --> D[Qualify release]
  D --> E[Generate unreleased changelog under new tag]

Loading

_{Reviews (2) · Last reviewed commit: "fix(release): require the release versio..."}

[alongubkin]

@greptileai review