docs: update CHANGELOG and CONTRIBUTING for v3.0.1 and hatch-vcs workflow

Author: sebdraven

CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.0.1] - 2026-08-04
+
+### Fixed
+
+- Project URLs pointed at the fork instead of `onyphe/pyonyphe`, so the PyPI
+  page linked to the wrong repository. Same for the GHCR image label and the
+  README badges and examples.
+
+### Changed
+
+- The version is now derived from the Git tag (`hatch-vcs`) instead of being
+  hardcoded in `pyproject.toml`. Tagging `v3.1.0rc1` now really produces a
+  `3.1.0rc1` pre-release; previously the tag name had no effect on the
+  published version.
+
 ## [3.0.0] - 2026-08-04
 
 Full rewrite against the current ONYPHE APIv2.

CONTRIBUTING.md

@@ -91,7 +91,17 @@ Never commit a real API key, not even in a fixture.
 
 ## Releasing
 
-1. Update `CHANGELOG.md` and the `version` field in `pyproject.toml`.
-2. Tag: `git tag vX.Y.Z && git push --tags`.
+1. Update `CHANGELOG.md`.
+2. Tag: `git tag vX.Y.Z && git push upstream vX.Y.Z`.
 3. `release.yml` runs the tests, builds, and publishes to PyPI through trusted
    publishing (OIDC — no token stored in the repository).
+
+The version is **not** written in `pyproject.toml`: `hatch-vcs` derives it from
+the tag. `v3.0.1` builds `3.0.1`, `v3.1.0rc1` builds a real pre-release. Two
+consequences worth remembering:
+
+- Every `checkout` in the workflows uses `fetch-depth: 0`. A shallow clone has
+  no tags, and the build would silently produce a bogus version.
+- The Docker build context excludes `.git`, so the version is injected through
+  the `HATCH_VCS_PRETEND_VERSION` build argument. A local `docker build`
+  without that argument produces `0.0.0.dev0`, which is expected.