fix(ci): extract release notes and patch body via GitHub API

.github/workflows/release.yml

@@ -29,15 +29,23 @@ jobs:
 
       - name: Generate release notes
         run: |
-          VERSION="${{ github.ref_name }}"
-          VERSION="${VERSION#v}"
-          awk -v ver="$VERSION" '$0 ~ "^## \\[" ver "\\]" {c++; if(c>1)exit; if(c==1){next}} c>0' CHANGELOG.md | tail -c +2 > /tmp/release-notes.txt
+          awk '/^## \[Unreleased\]/{skip=1; next} /^## \[/{skip=0; c++; if(c>1)exit; if(c==1)next} !skip && c>0' CHANGELOG.md | tail -c +2 > /tmp/release-notes.txt
 
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser
           version: latest
-          args: release --clean --release-notes /tmp/release-notes.txt
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Update release body
+        run: |
+          BODY=$(cat /tmp/release-notes.txt)
+          FOOTER=$'\n\n---\n\nReleased by [GoReleaser](https://github.com/goreleaser/goreleaser).'
+          RELEASE_ID=$(gh api "repos/${{ github.repository }}/releases/tags/${{ github.ref_name }}" --jq '.id')
+          gh api "repos/${{ github.repository }}/releases/${RELEASE_ID}" \
+            -X PATCH -f body="${BODY}${FOOTER}"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

CHANGELOG.md

@@ -7,19 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- Release notes extraction now correctly stops at the next version boundary instead of dumping the entire CHANGELOG to EOF
+
 ## [2.4.0] - 2026-05-15
 
 ### Added
+
 - `--no-update-check` flag on `kairo version` to skip GitHub API calls
 - Windows ANSI support detection via Virtual Terminal Processing
 
 ### Changed
+
 - CLI commands now propagate the Cobra command context to child operations and TUI interactions instead of using `context.Background()`, enabling proper cancellation on Ctrl+C
 - Config loading in `delete` and `list` commands now uses the config cache for consistency
 - Root command decomposed into `runRoot`, `loadRootConfig`, and `dispatchExecution` for maintainability
 - Removed `DecryptSecrets` (string return) in favor of `DecryptSecretsBytes` with `ClearMemory` to allow secure memory clearing of decrypted key material
 
 ### Fixed
+
 - Release CI now extracts the versioned section from CHANGELOG.md matching the tag, instead of using the `[Unreleased]` section which may be empty
 - Temp auth directory no longer leaks on error paths — cleanup now runs before `os.Exit`
 - Hyphens in custom provider names no longer produce invalid environment variable names (e.g., `MY-PROVIDER_API_KEY` → `MY_PROVIDER_API_KEY`)