Release notes are committed into the git repo, in the RELEASE-NOTES file, and distributed as part of the release tarballs. We don't consider the "github releases" feature to be safe enough. Anyone with write permissions on the git repo can edit existing "releases" or create new ones, so compromising a single account or blackmailing a single person would be sufficient to put malicious binaries there. In contrast, the electrum(.)org website is set up to be safe from single-account compromise. (see "Website and release security" at https://electrum.org/#about )