👷 ci(changelog): self-healing changelog-sync workflow - #180
Merged
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
konih
marked this pull request as ready for review
July 31, 2026 11:19
…kollect) Regenerates CHANGELOG.md on push to main and commits it back, so rebase/squash SHA drift self-heals instead of needing a manual `task changelog:write`. Soft-fails (non-blocking) until the operator installs the GitHub App + sets CHANGELOG_SYNC_GITHUB_APP_ID/PRIVATE_KEY secrets + adds the App as a protect-main bypass actor.
…ntil activated The create-github-app-token step hard-fails on an empty app-id, so pre-activation the workflow would red on every push to main (contradicting the header's 'soft-fails' claim). Add a tiny `gate` job that resolves CHANGELOG_SYNC_GITHUB_APP_ID presence into an output; `sync` now runs only when set (needs+if), and is SKIPPED cleanly (green) otherwise. This lets the workflow merge inert and activate later via secrets, with no red runs on main.
…thubactions:S8264)
SonarCloud flagged the workflow-level `contents: read` (S8264, MAJOR) on the new file,
failing the PR's new-code security rating (C). Move to a deny-all baseline (`permissions: {}`)
with per-job opt-in: `gate` gets none (reads a secret only), `sync` keeps contents:write.
Also tightens OpenSSF Token-Permissions.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Ports kollect's
changelog-sync.yamlto MKurator. On every push tomainit runstask changelog:writeand, ifCHANGELOG.mddrifted, commits the regenerated file back via a GitHub App.Why
cliff.tomlembeds each commit's{{ commit.id }}(SHA). Rebase/squash merges mint a new SHA the pre-mergeCHANGELOG.mdcan't predict, soCHANGELOG.mddrifts onmainafter any user-facing (feat/fix/perf/refactor) merge. Today that's fixed by hand withtask changelog:write+ adocs(changelog)commit. This automates it. (docs/test/chore/ci/build/style/merge commits are cliff-skipped and never drift.)A local pre-commit hook cannot do this — the merge SHA doesn't exist until after merge — which is exactly why kollect solves it in CI.
Safety / loop guards
paths-ignore: CHANGELOG.md+[skip ci]on the sync commit → no self-retrigger.:memo: docs(changelog): …is cliff-skipped (gitmoji stripped →^docsskip), so it never re-drifts the changelog.contents: writescoped to thesyncjob only.Operator activation required (workflow no-ops until then)
platformrelay/MKuratorthat can push tomain(kollect uses org Integration App ID 4389790 — same App can be installed here).protect-mainruleset bypass actor (bypass_mode: always).github-actions[bot]/GITHUB_TOKENcannot bypass a ruleset — only a User/Team/Role/Integration can.CHANGELOG_SYNC_GITHUB_APP_ID,CHANGELOG_SYNC_GITHUB_APP_PRIVATE_KEY(App private-key PEM).Validated locally:
yaml.safe_loadOK,actionlintclean, action pins match repo conventions (checkout v7.0.1, arduino/setup-task v3.0.0).