Keep release notes focused on CLI behavior

Author: lelia

CHANGELOG.md

@@ -2,22 +2,6 @@
 
 ## 2.12.1
 
-### Changed
-
-- Ruff linting and formatting are enforced on every pull request and push to
-  `main`, covering Python source, tests, hooks, and developer scripts. The
-  repository is formatted with a 120-character line length.
-- Contributors can install Ruff pre-commit hooks with `make hooks` and run the
-  same checks as CI with `make lint`. Hooks apply safe lint fixes and formatting;
-  changed files must be reviewed and staged before committing again. Local and
-  CI checks use the same locked Ruff version.
-- New functions are subject to complexity limits of 12 independent paths and
-  eight arguments. Existing exceptions are marked individually, and obsolete
-  suppressions fail lint checks.
-- Build tooling matches the project's Hatch and Hatchling pins. Local action
-  references are corrected across package, preview, release, and dependency
-  review workflows.
-
 ### Fixed
 
 - Configuration debug output masks credential fields, including nested plugin
@@ -35,8 +19,6 @@
 - Configuration warnings and errors use the CLI's configured logger.
 - Manifest links use the configured source-control type, including when a Socket
   organization slug contains a source-control provider's name.
-- Release scripts accept both single- and double-quoted version declarations.
-  CI and documentation changes alone do not require a package version bump.
 
 ## 2.12.0
 

CONTRIBUTING.md

@@ -88,6 +88,21 @@ and validates the distributions, smoke-tests the wheel, and uploads the
 distributions as workflow artifacts. It does not publish a package or Docker
 image.
 
+## Build tooling and release notes
+
+Keep the Hatch and Hatchling pins in `.github/actions/setup-hatch/action.yml`
+aligned with the `dev` extra and build backend in `pyproject.toml`.
+
+The `Version Check` workflow enforces release-version checks for changes to
+`socketsecurity/`, `pyproject.toml`, or `uv.lock`. A pull request can share
+`main`'s unreleased version. CI and documentation changes alone do not require
+a package version bump. Version extraction accepts single- and double-quoted
+`__version__` declarations.
+
+Keep changelog entries short and focused on observable CLI, dashboard, or scan
+log behavior. Document contributor setup and CI policies in this guide, and
+describe workflow implementation changes in the pull request description.
+
 ## Publishing pull request previews
 
 Preview publication is intentionally opt-in. Only request previews for code