Skip to content

chore(changelog): one fragment file per entry in changelog.d/, collected at release (LAB-6153) #80

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
27Bslash6 merged 4 commits into from
Sep 28, 2026
Merged

chore(changelog): one fragment file per entry in changelog.d/, collected at release (LAB-6153) #80

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
454f239
chore(changelog): one fragment file per entry in changelog.d/, collec…
27Bslash6 Sep 28, 2026
1431e36
chore(changelog): move pre-fragment Unreleased entries into a fragmen…
27Bslash6 Sep 28, 2026
2e4ff08
chore(changelog): replace scriv with a verbatim collect script; scriv…
27Bslash6 Sep 28, 2026
9babfca
test(changelog): repo dry run targets the next unreleased version and…
27Bslash6 Sep 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions .github/workflows/verify.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,3 +79,29 @@ jobs:
run: |
python3 tools/test_check_version_floors.py
python3 tools/check-version-floors.py

# Includes a dry run of the next release against the real CHANGELOG.md and
# changelog.d/, so a fragment or marker that would break it fails here first.
- name: Changelog collect (stdlib only)
run: python3 tools/test_changelog_collect.py

# Every PR that added its entry under the shared `## [Unreleased]` heading
# conflicted with every other open PR that did the same. Entries go in
# changelog.d/ (one file each); only a release/* branch rewrites CHANGELOG.md.
changelog-fragments:
name: CHANGELOG.md is edited only by releases
if: github.event_name == 'pull_request' && !startsWith(github.head_ref, 'release/')

@kodus-27b kodus-27b Bot Sep 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

kody code-review Bug medium

Authorization bypass in changelog-fragments job condition: the release exemption checks only github.head_ref, which the PR author controls, including on forks where the base repo's branch rules do not apply. When a contributor opens a PR from a fork branch named release/fix that edits CHANGELOG.md directly, the job is skipped, and because a skipped job reports as passing, the required check does not block the merge. Fix: also require github.event.pull_request.head.repo.full_name == github.repository so the exemption applies only to branches in this repository.

if: github.event_name == 'pull_request' && !(startsWith(github.head_ref, 'release/') && github.event.pull_request.head.repo.full_name == github.repository)
Prompt for LLM 

File .github/workflows/verify.yml:

Line 88:

Authorization bypass in changelog-fragments job condition: the release exemption checks only `github.head_ref`, which the PR author controls, including on forks where the base repo's branch rules do not apply. When a contributor opens a PR from a fork branch named `release/fix` that edits `CHANGELOG.md` directly, the job is skipped, and because a skipped job reports as passing, the required check does not block the merge. Fix: also require `github.event.pull_request.head.repo.full_name == github.repository` so the exemption applies only to branches in this repository.

Suggested Code:

if: github.event_name == 'pull_request' && !(startsWith(github.head_ref, 'release/') && github.event.pull_request.head.repo.full_name == github.repository)

Talk to Kody by mentioning @kody

Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.

​

​

runs-on: ubuntu-latest
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
fetch-depth: 2
persist-credentials: false

- name: Changelog entries are fragments in changelog.d/
run: |
# HEAD is GitHub's test merge of the PR into its base, so HEAD^1 is the base tip.
if ! git diff --quiet HEAD^1 HEAD -- CHANGELOG.md; then
echo "::error file=CHANGELOG.md::Put the entry in a new file under changelog.d/ instead (see changelog.d/README.md). CHANGELOG.md changes only on a release/* branch."
exit 1
fi
Loading
Loading