Make 1.0.0 read as one release, with the changelog as its notes (#19)

Two things about what 1.0.0 will say when the tag is recut.

**The changelog named a release that does not exist.** `#16` landed its
entry under `## Unreleased` while every other change sits under `##
1.0.0`, and nothing has shipped between them. The entry moves into
1.0.0's Fixed list, rewritten in the shape the rest of that list uses:
the bolded symptom first, then what changed.

**The release notes were the commit list.** `attach-sbom` created the
GitHub Release with `--generate-notes`, so the notes on the release page
were the pull requests it contained rather than the entry written for
it. It now takes the changelog's section for the tag's version, and
fails if there is none, which `RELEASING.md` already required of a
releaser.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Signed-off-by: Manush Murali <manushm@nvidia.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Manushpm8

.github/workflows/publish.yml

@@ -179,6 +179,20 @@ jobs:
           cyclonedx-py environment --of JSON --validate -o dist/sbom.cyclonedx.json
           python -c "import json,sys; d=json.load(open('dist/sbom.cyclonedx.json')); names={c['name'] for c in d.get('components', [])}; missing={'structured-data-models-client','structured-data-models-api','structured-data-models-pql','structured-data-models-connectors','structured-data-models-relational-engine'} - names; print(f'{len(names)} components'); sys.exit(f'SBOM missing {sorted(missing)}' if missing else 0)"
 
+      - name: Take the release notes from the changelog
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          awk -v v="$version" '
+            { line = $0; sub(/[ \t\r]+$/, "", line) }
+            line == "## " v || index(line, "## " v " - ") == 1 { inside = 1; next }
+            inside && /^## / { exit }
+            inside { print }
+          ' CHANGELOG.md > dist/notes.md
+          test -s dist/notes.md || {
+            echo "CHANGELOG.md has no '## $version' entry" >&2
+            exit 1
+          }
+
       - uses: actions/upload-artifact@v7
         with:
           name: distributions
@@ -198,7 +212,7 @@ jobs:
 
       # The SBOM is a release asset, not something to upload to the index.
       - name: Keep only the distributions
-        run: rm -f dist/sbom.cyclonedx.json
+        run: rm -f dist/sbom.cyclonedx.json dist/notes.md
 
       - name: Publish with Trusted Publishing and attest the artifacts
         uses: pypa/gh-action-pypi-publish@release/v1
@@ -237,7 +251,7 @@ jobs:
               --repo "$GITHUB_REPOSITORY" \
               --title "$GITHUB_REF_NAME" \
               --verify-tag \
-              --generate-notes
+              --notes-file dist/notes.md
           fi
           gh release upload "$GITHUB_REF_NAME" dist/sbom.cyclonedx.json \
             --repo "$GITHUB_REPOSITORY" --clobber

CHANGELOG.md

@@ -5,15 +5,7 @@ versioned by [semantic versioning](https://semver.org) as
 [`docs/reference/stability.md`](docs/reference/stability.md) defines it for
 these packages. All five distributions share one version and one entry.
 
-## Unreleased
-
-### Fixed
-
-- A `KumoRelational` request sends `inference.inference_config` only with the
-  options the caller set, and omits it otherwise. Sending the engine's defaults
-  on every request made SDM-backed deployments refuse every relational request.
-
-## 1.0.0 - 2026-10-06
+## 1.0.0 - 2026-10-08
 
 The first release. All five distributions declare `1.0.0` and are published
 together.
@@ -447,6 +439,8 @@ together.
   `Schema.from_source(DatabricksSource(...), {'m': '<metric view>'})` read its rows like a table's, and Databricks refuses that for a measure.
   The column look-up now reads the relation's type from `information_schema` too, so a metric view is refused before any row is read, with a `StructuredDataError` (`INVALID_REQUEST`) that says to use `source.semantic_model('<metric view>')`.
   The engine raises the new `MetricViewAsTableError`, a `ValueError`, pointing to `Graph.from_databricks_metric_view`.
+- **Every `KumoRelational` request carried the engine's default `inference_config`, which SDM-backed deployments refuse.**
+  The request now sends `inference.inference_config` with the options the caller set alone, and omits it when there are none.
 
 ### Behaviour worth knowing before you rely on it
 

RELEASING.md

@@ -71,9 +71,13 @@ the engine's `[tool.cibuildwheel]`), and then refuses to
 continue unless **all five** are present and agree with the tag. That check is
 not ceremony: `structured-data-models-client[relational]` pins the engine by exact version, so a
 release missing it publishes an extra nobody can install. It then generates the
-SBOM and uploads through PyPI Trusted Publishing with PEP 740 attestations.
-Finally it creates the GitHub Release for the tag and attaches the SBOM to it,
-so the dependency inventory outlives the ninety days an Actions artifact gets.
+SBOM, and takes the release's notes from the changelog's entry for that
+version, refusing a tag that has none: notes that read like a diff are fixable
+afterwards and a distribution on PyPI is not, so both happen before anything is
+uploaded. It uploads through PyPI Trusted Publishing with PEP 740 attestations,
+then creates the GitHub Release for the tag with those notes and attaches the
+SBOM to it, so the dependency inventory outlives the ninety days an Actions
+artifact gets.
 
 **There is no PyPI token.** Publishing authenticates with the workflow's OIDC
 identity, which is why the `publish` job is the only one holding `id-token: