Release notes are committed into the git repo, in the RELEASE-NOTES file, and distributed as part of the release tarballs.
We don't consider the "github releases" feature to be safe enough. Anyone with write permissions on the git repo can edit existing "releases" or create new ones, so compromisin...