WIP: Add release-notes generator script and update release docs

content/docs/releases/release-notes/.spelling

@@ -0,0 +1,3 @@
+v1.18.0
+v1.18.1
+v1.18.2

content/docs/releases/release-notes/release-notes-1.18.md

@@ -164,24 +164,26 @@ Read [Annotated Ingress resource: Copy annotations to the Certificate](../../usa
 As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved.
 
 A special thanks to:
-
-- [`@terinjokes`](https://github.com/terinjokes)
-- [`@solidDoWant`](https://github.com/solidDoWant)
-- [`@k0da`](https://github.com/k0da)
-- [`@ali-hamza-noor`](https://github.com/ali-hamza-noor)
-- [`@tareksha`](https://github.com/tareksha)
+{/* BEGIN contributors */}
+- [`@LukeCarrier`](https://github.com/LukeCarrier)
+- [`@NicholasBlaskey`](https://github.com/NicholasBlaskey)
 - [`@ThatsIvan`](https://github.com/ThatsIvan)
-- [`@jsoref`](https://github.com/jsoref)
+- [`@ali-hamza-noor`](https://github.com/ali-hamza-noor)
+- [`@cuinix`](https://github.com/cuinix)
+- [`@hjoshi123`](https://github.com/hjoshi123)
 - [`@jcpunk`](https://github.com/jcpunk)
-- [`@teslaedison`](https://github.com/teslaedison)
-- [`@NicholasBlaskey`](https://github.com/NicholasBlaskey)
-- [`@sspreitzer`](https://github.com/sspreitzer)
-- [`@tsaarni`](https://github.com/tsaarni)
 - [`@johnjcool`](https://github.com/johnjcool)
-- [`@LukeCarrier`](https://github.com/LukeCarrier)
+- [`@jsoref`](https://github.com/jsoref)
+- [`@k0da`](https://github.com/k0da)
+- [`@solidDoWant`](https://github.com/solidDoWant)
+- [`@sspreitzer`](https://github.com/sspreitzer)
+- [`@tareksha`](https://github.com/tareksha)
+- [`@terinjokes`](https://github.com/terinjokes)
+- [`@teslaedison`](https://github.com/teslaedison)
 - [`@tobiasbp`](https://github.com/tobiasbp)
+- [`@tsaarni`](https://github.com/tsaarni)
 - [`@vehagn`](https://github.com/vehagn)
-- [`@cuinix`](https://github.com/cuinix)
+{/* END contributors */}
 
 for their contributions, comments and support!
 
@@ -202,6 +204,7 @@ And finally, thanks to the cert-manager steering committee for their feedback in
 - [@TrilokGeer](https://github.com/TrilokGeer)
 
 
+{/* BEGIN changelog v1.18.2 */}
 ## `v1.18.2`
 
 We fixed a bug in the CSR's name constraints construction (only applies if you have enabled the `NameConstraints` feature gate).
@@ -217,6 +220,8 @@ Changes since `v1.18.1`:
 [#7833]: https://github.com/cert-manager/cert-manager/issues/7833
 [#7837]: https://github.com/cert-manager/cert-manager/issues/7837
 
+{/* END changelog v1.18.2 */}
+{/* BEGIN changelog v1.18.1 */}
 ## `v1.18.1`
 
 We have added a new feature gate `ACMEHTTP01IngressPathTypeExact`, to allow
@@ -244,6 +249,8 @@ Changes since `v1.18.0`:
 
 - Use the latest version of ingress-nginx in E2E tests to ensure compatibility ([`#7807`](https://github.com/cert-manager/cert-manager/pull/7807), [`@wallrj`](https://github.com/wallrj))
 
+{/* END changelog v1.18.1 */}
+{/* BEGIN changelog v1.18.0 */}
 ## `v1.18.0`
 
 Changes since `v1.17.2`:
@@ -297,3 +304,4 @@ Changes since `v1.17.2`:
 - Update kind images to include the Kubernetes 1.33 node image ([`#7787`](https://github.com/cert-manager/cert-manager/pull/7787), [`@wallrj`](https://github.com/wallrj))
 - Upgrade Go to `v1.24.4` ([`#7785`](https://github.com/cert-manager/cert-manager/pull/7785), [`@wallrj`](https://github.com/wallrj))
 - Use `slices.Contains` to simplify code ([`#7753`](https://github.com/cert-manager/cert-manager/pull/7753), [`@cuinix`](https://github.com/cuinix))
+{/* END changelog v1.18.0 */}

make/02_mod.mk

@@ -39,6 +39,20 @@ dev: vendor
 ## @category Development
 check: vendor
 
+CERT_MANAGER_VERSION ?= $(shell jq -r '.cert_manager_latest_version' < content/docs/variables.json)
+
+.PHONY: generate-release-notes
+## Generate release notes for the version specified in CERT_MANAGER_VERSION.
+## CERT_MANAGER_VERSION defaults to the latest version as defined in
+## content/docs/variables.json
+##
+## @category Development
+generate-release-notes:
+	cd ./scripts/release-notes \
+	&& go run . \
+		--release-notes-dir ../../content/docs/releases/release-notes \
+		--release-version $(CERT_MANAGER_VERSION)
+
 ##########
 # NodeJS #
 ##########
@@ -64,4 +78,4 @@ $(DOWNLOAD_DIR)/tools/npm@$(NPM_VERSION)_%: | $(bin_dir)/scratch/node@$(NPM_VERS
 	$(LN) $(CURDIR)/$(bin_dir)/scratch/node@$(NODE_VERSION)_$*/bin/npm $@
 
 # Export the node bin dir so npm can work
-export PATH := $(CURDIR)/$(bin_dir)/scratch/node@$(NODE_VERSION)_$(HOST_OS)_$(HOST_ARCH)/bin:$(PATH)
+export PATH := $(CURDIR)/$(bin_dir)/scratch/node@$(NODE_VERSION)_$(HOST_OS)_$(HOST_ARCH)/bin:$(PATH)

package.json

@@ -24,7 +24,7 @@
     "check:eslint": "eslint .",
     "check:stylelint": "stylelint **/*.scss",
     "check:links": "find content/docs -type f -name '*.md' | xargs markdown-link-check --quiet --config markdown-link-check.json 2>&1 | awk -v RS=FILE: '/ERROR/{f=1; print RS $0} END{exit f}' # Split into records based on the word FILE and print only records containing word ERROR",
-    "check:spelling": "FORCE_COLOR=1 mdspell --report --en-us --ignore-numbers --ignore-acronyms 'content/**/*.md' 'content/**/*.html' '_layouts/*.html' '_includes/*.html' '*.html' '!**/api-docs.md' '!content/*docs/policy/approval/approver-policy/api-reference.md' '!content/*docs/trust/trust-manager/api-reference.md' # Force color output in mdspell. # See https://github.com/lukeapage/node-markdown-spellcheck/issues/36#issuecomment-482649408 ",
+    "check:spelling": "FORCE_COLOR=1 mdspell --target-relative --report --en-us --ignore-numbers --ignore-acronyms 'content/**/*.md' 'content/**/*.html' '_layouts/*.html' '_includes/*.html' '*.html' '!**/api-docs.md' '!content/*docs/policy/approval/approver-policy/api-reference.md' '!content/*docs/trust/trust-manager/api-reference.md' # Force color output in mdspell. # See https://github.com/lukeapage/node-markdown-spellcheck/issues/36#issuecomment-482649408 ",
     "check:markdown": "remark --rc-path .remarkrc --frail --quiet content/"
   },
   "lint-staged": {

scripts/release-notes/README.md

@@ -0,0 +1,101 @@
+# Release Notes Generator
+
+> This tool generates and maintains cert-manager release notes. It gathers
+> changelog entries via the `k8s.io/release` notes tooling, renders a changelog
+> snippet, and updates a templated Markdown release-notes file.
+
+
+### Quick overview
+
+-   **Purpose:** generate and update the website release-notes page for cert-manager.
+-   **Location:** `scripts/release-notes`.
+-   **Language:** Go.
+
+### Requirements
+
+-   Go 1.25+.
+-   Network access to GitHub. A token reduces API rate limits.
+-   Optional: the `gh` CLI to obtain a token (`gh auth token`).
+
+### Install / run locally
+
+1.  Change to the tool directory.
+
+```bash
+cd scripts/release-notes
+```
+
+1.  Run one-off using `go run`:
+
+```bash
+go run . \
+  --release-version v1.19.0 \
+  --release-notes-dir ../content/docs/release \
+```
+
+1.  Build the binary:
+
+```bash
+go build -o release-notes .
+./release-notes --help
+```
+
+### Basic usage
+
+-   Required flags:
+    -   `--release-version` : the release tag (must be a valid semver, leading `v` expected).
+-   Useful flags:
+    -   `--end-rev` (set to the release branch if the release version tag has not yet been created: `release-1.19`)
+    -   `--release-notes-dir` (default: `.`)
+    -   `--github-org` and `--github-repo` (defaults: `cert-manager` / `cert-manager`)
+
+### What the tool does
+
+1.  Validates and canonicalizes `--release-version`.
+2.  Uses `k8s.io/release/pkg/notes` to gather categorized notes and render Markdown.
+3.  Ensures a release-notes file exists (creates from a template if missing).
+4.  Updates the release-notes file:
+    -   Replaces the `maintainers`, `steerers`, and `contributors` sections.
+    -   Inserts or replaces a versioned changelog section delimited by markers.
+    -   Replaces prerelease sections for the same MAJOR.MINOR.PATCH when appropriate.
+5.  Writes updates atomically (writes a `.new` temp file and renames it).
+
+### Release-notes file markers / format
+
+-   Unversioned (bootstrap) changelog:
+    -   `{/* BEGIN changelog */}` and `{/* END changelog */}`
+-   Versioned changelog:
+    -   `{/* BEGIN changelog vX.Y.Z */}` … `{/* END changelog vX.Y.Z */}`
+-   Keep each marker on its own line and use `LF` line endings when possible.
+
+### Semver / prerelease handling
+
+-   When inserting a final release (e.g., `v1.2.3`), the tool will replace earlier prerelease sections (e.g., `v1.2.3-beta.1`) for the same MAJOR.MINOR.PATCH.
+
+### Troubleshooting & tips
+
+-   If you see `invalid release version` errors:
+    -   Ensure you pass a leading `v`, e.g. `v1.19.0`.
+-   If changelog sections are not detected:
+    -   Verify markers are in the expected form and on separate lines.
+    -   Normalize line endings to `LF`.
+-   For GitHub API rate limits:
+    -   Export `GITHUB_TOKEN` or use `export GITHUB_TOKEN=$(gh auth token)` before running.
+
+### Testing
+
+-   Run unit tests:
+
+```bash
+cd scripts/release-notes
+go test ./...
+```
+
+### Contributing / development notes
+
+-   The tool leverages `k8s.io/release/pkg/notes`. If you change changelog markers or templates, update regexes in `main.go` and add tests for edge cases (CRLF vs LF, prerelease replacement).
+
+### License & contact
+
+-   See the repository root for license information.
+-   For questions or bugs, open an issue or contact the maintainer in the repo.