Prepare the 2026.9.30 release, with notes from the changelog

The changelog's first section becomes 2026.9.30 and gains the phase 1 and 2
changes: re-export updates, one copy per message, the Sieve rename,
timeouts, scoped certificate checks, resilient and bounded imports, batched
export with progress, and the predictive dry run.

The tag build now takes each release's notes from its version's section of
CHANGELOG.md, followed by the line about the binaries, so the release and
the announcement made from it say what changed. A version with no section
falls back to that line alone.

.github/workflows/ci.yml

@@ -158,20 +158,30 @@ jobs:
       - run: |
           (cd dist && sha256sum ./*.tar.gz | sed 's| \./| |' > SHA256SUMS)
           cat dist/SHA256SUMS
+      # The release notes are this version's section of CHANGELOG.md, so the
+      # release, and the announcement made from it, say what changed.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          sparse-checkout: CHANGELOG.md
+          sparse-checkout-cone-mode: false
       - env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
         run: |
           set -euo pipefail
           API="$GITEA_URL/api/v1/repos/$GITHUB_REPOSITORY"
           auth=(-H "Authorization: token $GITEA_TOKEN")
+          files="Binaries for linux/amd64 and linux/arm64. Verify with SHA256SUMS."
+          notes="$(awk -v v="${TAG#v}" 'index($0, "## [" v "]") == 1 {f = 1; next}
+                                         f && (/^## / || /^---$/) {exit}
+                                         f' CHANGELOG.md | sed -e '/./,$!d')"
+          if [ -n "$notes" ]; then notes="$notes"$'\n\n'"$files"; else notes="$files"; fi
           # Reuse the Release if the tag already has one (a re-run), else make a
           # draft of our own.
           created=0
           id="$(curl -fsS "${auth[@]}" "$API/releases/tags/$TAG" 2>/dev/null | jq -r '.id // empty' || true)"
           if [ -z "$id" ]; then
             id="$(curl -fsS "${auth[@]}" -H 'Content-Type: application/json' \
-                  -d "$(jq -n --arg t "$TAG" '{tag_name:$t, name:$t, draft:true,
+                  -d "$(jq -n --arg t "$TAG" --arg b "$notes" '{tag_name:$t, name:$t, draft:true, body:$b}')" \
-                        body:"Binaries for linux/amd64 and linux/arm64. Verify with SHA256SUMS."}')" \
                   "$API/releases" | jq -r '.id // empty')"
             [ -n "$id" ] || { echo "::error::could not create the release"; exit 1; }
             created=1

CHANGELOG.md

@@ -3,7 +3,9 @@
 All notable changes to this project are recorded here. Versions are dates:
 release `v2026.9.30` is version `2026.9.30`.
 
-## [Unreleased] -- 2026.9.30
+## [2026.9.30] -- 2026-09-30
+
+The first release of inbuxa-migrate.
 
 ### Changed
 - Renamed to inbuxa-migrate: the binary, the crate, and the credential
@@ -17,6 +19,34 @@ release `v2026.9.30` is version `2026.9.30`.
 - Released as Linux archives for amd64 and arm64 on the Gitea release page,
   with `SHA256SUMS`. The npm, Homebrew, shell and PowerShell installers and
   the MSI are gone.
+- A second export brings matched items up to date instead of skipping them:
+  flags and folders on mail, changed contacts and events, and edited Sieve
+  scripts.
+- A message filed in several folders is written once, in every one of them,
+  and a resumed export adds any folder it was still missing.
+- Sieve scripts from a Stalwart server keep working on inbuxa: their
+  `vnd.stalwart.*` extension names are renamed to inbuxa's, each rename is
+  logged, and a script that can't be activated fails the export instead of
+  leaving filtering quietly off.
+- `--allow-invalid-certs` covers only the server named with `--url`. Microsoft
+  and Google sign-in are always verified.
+- Export imports mail in batches, uploads in parallel within the target's
+  limits, and prints progress: count, rate and time left.
+- `export --dry-run` predicts what would fail -- messages over the target's
+  upload limit, objects over its request limit, Sieve scripts it would reject
+  -- lists what would be created, updated and skipped, and exits as the real
+  run would.
+
+### Fixed
+- Every connection times out instead of waiting forever on a dropped link,
+  and a timeout is retried like any other transient error.
+- An interrupted IMAP or Maildir import keeps what it wrote, and a message
+  that can't be read is recorded and skipped rather than ending the folder.
+- IMAP and EWS imports hold a bounded amount in memory, in batches capped by
+  size as well as count.
+- The archive is created readable by its owner only, and an existing archive
+  others can read is reported.
+- A dry run no longer writes to the target's address books.
 
 ---