feat(framework): credit GitHub contributors in generated release notes

Start by reading release-please-config.json and .github/workflows/ci.yml, then compare the generated v5.10.0 release. Trace where root and component release notes are produced and run the existing tests before changing behavior. Done means human PR authors are credited once per applicable release, bots are excluded, and repeated generation remains unchanged.

Problem

Release Please lists changes, pull requests and commits, but the generated GitHub releases do not credit the people behind them by GitHub handle.

The current v5.10.0 release contains no @handle mentions.

Scope

• After release-please creates the releases, a CI step appends each changelog line's commit author as (@handle) (Symfony-style), in every GitHub release of the cycle: root and each component. A component credits only the authors of its own commits.
• main accepts only merge commits (ruleset allowed_merge_methods: ["merge"]), so a promote can be neither squashed nor rebased. The release PR switches from --squash --admin to --merge --admin; a hotfix/* lands as a merge commit.

Findings

Verified in a throwaway sandbox repository (since deleted) and against this repository, read-only.

• release-please's native include-commit-authors credits nobody in 17.11.2, the latest release: parseConventionalCommits drops the commit author. Upstream bug googleapis/release-please#2761, fix googleapis/release-please#2892 still open. Hence the post-processing step.
• changelog-type: github is rejected: it reads the whole range between tags, which is wrong for component releases.
• A prototype of the step, run twice on the sandbox's releases, credited every line and changed nothing the second time. A read-only dry run over v5.10.0 credited all 44 lines, including those ending in , closes #….
• On the last 60 PRs merged into next, the squash commit's author is the PR author (55/55 humans), even when someone else merges.
• Editing a release fires release: edited; back-merge.yml listens only to published, so crediting does not re-run it.
• Under a merge-only ruleset, a bypass actor in pull_request mode (the live mode for aidd-bot and team admin) still cannot squash, even with --admin. The current --squash --admin release merge would therefore be refused: the release PR must move to --merge before the live ruleset changes.
• A release PR merged as a merge commit is tagged normally (sandbox, and #135 / v4.1.0 here). commitlint ignores Merge pull request … subjects. Back-merge and a second cycle work unchanged.
• A squashed promote makes release-please report "No user facing commits found": the week's entries vanish from the notes without any signal.

Acceptance criteria

• Every changelog line that links a commit, in every GitHub release of a cycle, ends with its commit author's @handle, or the author's name when no account resolves.
• A component release credits only authors of commits in that component.
• Re-running the step changes nothing.
• Tests cover multiple contributors, a repeated contributor, a bot, a closes #N line, a line without a SHA, and an already-credited line.
• main refuses squash and rebase merges; .github/rulesets/main.json and the live ruleset agree.
• The release PR merges with --merge --admin, is tagged, and back-merge still folds main into next.
• The live ruleset changes only after one release has merged with --merge.
• Each guard ships with a test that fails when the guard is removed.

Accepted tradeoffs

• Per-line credit only: no contributor section, no deduplication.
• The maintainer is credited like everyone else; (@dependabot[bot]) appears on dependency lines.
• Only the GitHub releases carry handles; CHANGELOG.md and the release PR body do not.
• A multi-author PR credits its author only; Co-authored-by: trailers are ignored.
• A hotfix/* lands as a merge commit instead of a squash.
• Bullets under ⚠ BREAKING CHANGES link no commit and stay uncredited; the same commit is credited on its own line in its section.

Follow-up

• Once googleapis/release-please#2892 ships in a pinned release-please-action: turn on include-commit-authors, delete the post-processing step and its script, and check a release still credits every line.

Prior art in this repo

• release-please-config.json
• .github/workflows/ci.yml
• .github/workflows/promote.yml
• .github/rulesets/main.json
• Release v5.10.0.
• Brief and plan: aidd_docs/tasks/2026_09/2026_09_23_credit-contributors-release-notes/

Out of scope

• Rewriting Git history.
• Other forms of contribution (issues, reviews, discussions).
• A contributor section or recap list.
• A weekly shout-out on overall contribution (separate issue).
• Manually maintained changelogs.