Conversation
There was a problem hiding this comment.
Pull request overview
Adds a GitHub Actions workflow that generates and commits CHANGELOG.md when a release is published.
Changes:
- Introduces
.github/workflows/changelog.ymlto run onrelease.published - Generates
CHANGELOG.mdvia a third-party changelog generator action - Commits and pushes the updated changelog back to the repository
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| ref: master |
There was a problem hiding this comment.
This repository appears to use main (per PR metadata/diff context), but the workflow checks out master. This will fail in repos without a master branch and also risks pushing the changelog to the wrong branch. Consider checking out the default branch (e.g., ref: ${{ github.event.repository.default_branch }}) or explicitly main if that’s the intended target.
| ref: master | |
| ref: ${{ github.event.repository.default_branch }} |
.github/workflows/changelog.yml
Outdated
| - name: Generate changelog | ||
| uses: janheinrichmerker/action-github-changelog-generator@v2.4 | ||
| with: | ||
| token: ${{ secrets.CHANGELOG_GITHUB_TOKEN }} |
There was a problem hiding this comment.
Requiring a custom secret token can make this workflow fail in environments where CHANGELOG_GITHUB_TOKEN isn’t configured. If elevated permissions aren’t required, prefer the built-in token (e.g., ${{ github.token }} / ${{ secrets.GITHUB_TOKEN }}) and rely on permissions: contents: write for pushing.
| token: ${{ secrets.CHANGELOG_GITHUB_TOKEN }} | |
| token: ${{ github.token }} |
| fetch-depth: 0 | ||
|
|
||
| - name: Generate changelog | ||
| uses: janheinrichmerker/action-github-changelog-generator@v2.4 |
There was a problem hiding this comment.
For supply-chain hardening, third-party GitHub Actions should be pinned to a full commit SHA rather than a mutable tag (like v2.4). Pinning reduces the risk of unexpected changes if the tag is moved.
| uses: janheinrichmerker/action-github-changelog-generator@v2.4 | |
| uses: janheinrichmerker/action-github-changelog-generator@0123456789abcdef0123456789abcdef01234567 # v2.4 |
Changes: