`deepagents-code` release PRs currently expose release-please's
generated changelog directly. Maintainers need a durable place to turn
those generated entries into concise, user-facing notes without losing
their edits the next time release-please refreshes the PR.
When a `deepagents-code` release PR moves from draft to ready for
review, the release bot posts a marked comment containing a polished
draft. Maintainers can edit that comment while preserving the generated
version heading, then run `@dcode-release-bot apply` to copy the
finalized section into both `libs/code/CHANGELOG.md` and the release PR
preview.
For a ready, non-bypassed release PR, the `curated release notes` check
binds the latest valid bot-authored draft to its applied metadata,
requires the current version section in `libs/code/CHANGELOG.md` and the
PR-body preview to match that draft, and verifies that the recorded
draft and apply commits remain in the current release branch's ancestry.
Unrelated descendant commits are allowed. If release-please regenerates
the curated section or adds generated entries, the check fails until a
maintainer runs `@dcode-release-bot draft` and then `@dcode-release-bot
apply` again. While a release PR is still a draft, the check passes
without validating curation and the manual commands are disabled. The
exact `release: dangerously skip curated notes` label remains an
explicit escape hatch for exceptional releases.
Drafting makes one non-agentic request to one of three fixed provider
API endpoints, using a repository-configured model. The model receives
isolated release-note input and no callable tools. The trusted helper
reads that prepared input, writes the draft output, and sends the
request using only the selected provider key; the output is structurally
validated and the release snapshot is rechecked before the draft is
published. Privileged curation changes use a short-lived installation
token minted from the existing organization-membership GitHub App, while
workflow feedback and refreshed check runs use the scoped
`GITHUB_TOKEN`. Manual commands require repository write access.
## Required repository setup
- Ensure the installed organization-membership GitHub App credentials
are available as repository secrets `ORG_MEMBERSHIP_APP_CLIENT_ID` and
`ORG_MEMBERSHIP_APP_PRIVATE_KEY`, and that the App grants read/write
access to contents, issues, and pull requests.
- Add repository variables `DCODE_RELEASE_BOT_LOGIN` and
`DCODE_RELEASE_BOT_ID` for the installed App's `<app-slug>[bot]`
identity.
- Configure the `release-dcode` environment without required reviewers
or other deployment approval rules. Set `DCODE_RELEASE_MODEL` to an
`openai:<model>`, `anthropic:<model>`, or `google_genai:<model>` value,
and add the matching provider API key as an environment secret
(`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, or `GOOGLE_API_KEY`).
- Add the literal `curated release notes` job name to `main`'s required
status checks. Without it, failures are visible but do not block a stale
or unapplied release PR from merging.
The release guide includes the exact identity lookup and setup
instructions.
Mason Daugherty