Add changelog feature#42
Merged
Merged
Conversation
📝 WalkthroughWalkthroughAdds a schema-validated changelog system: JSON Schema and components config, a Node.js build script with tests to render README/SUMMARY/public index, CODEOWNERS and GitHub Actions for rebuilds and reviewer commands, npm wiring, and initial changelog entries dated 2026-05-19. ChangesChangelog Management System
Sequence Diagram(s)sequenceDiagram
participant Reviewer
participant GitHubAPI
participant GHScript
participant ComponentRepo
participant ChangelogAction
Reviewer->>GitHubAPI: Comment with /regenerate or /skip
GitHubAPI->>GHScript: Parse comment
GHScript->>GitHubAPI: Extract component/tag from PR body
alt /regenerate command
GHScript->>ComponentRepo: Checkout component repo
ComponentRepo->>ChangelogAction: Run changelog action
ChangelogAction->>GitHubAPI: Generate & submit changelog
else /skip command
GHScript->>GitHubAPI: Find changelog file in PR
GitHubAPI->>GHScript: Return file SHA
GHScript->>GitHubAPI: Create file with ai_generated marker
end
GitHubAPI->>Reviewer: React with eyes emoji
Estimated Code Review Effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🧹 Nitpick comments (1)
changelog/2026/2026-05-19-web-v1-2-0.md (1)
15-29: ⚡ Quick winConsider adding a cross-reference to the backend release.
The Web v1.2.0 release displays the
estimated_feesfield introduced in Backend v1.1.0. Adding an explicit reference (e.g., "See also: Backend v1.1.0") at the end of this entry would help readers understand the full feature story across both components.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@changelog/2026/2026-05-19-web-v1-2-0.md` around lines 15 - 29, Add an explicit cross-reference to the backend release that introduced the estimated_fees field by appending a "See also" link at the end of this Web v1.2.0 entry; mention Backend v1.1.0 and point to the backend changelog filename (2026-05-19-backend-v1-1-0.md) so readers can follow the full feature story for estimated_fees (referencing the Web entry's mention of estimated_fees and the file name for Backend v1.1.0).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/changelog-build.yml:
- Around line 34-35: The workflow step uses a signed commit flag (`git commit -S
-m "chore(changelog): regenerate index"`) which will fail in CI without a GPG
signing key; update the step to create unsigned commits instead by removing the
`-S` flag (i.e., use `git commit -m ...`) or alternatively configure CI to
provide a signing key (set `user.signingkey` and enable commit signing) before
running `git commit -S`; also ensure the same change touches the `git push` line
so the unsigned commit is pushed when using the `git push` command.
- Around line 18-25: Replace the floating action tags with pinned commit SHAs
for both actions/checkout@v4 and actions/setup-node@v4 and add
persist-credentials: false to the checkout step; specifically update the
workflow steps that reference actions/checkout@v4 and actions/setup-node@v4 to
use their corresponding full SHA pins and modify the checkout step to include
persist-credentials: false (so credentials from the provided token are not left
available to subsequent steps).
In @.github/workflows/changelog-commands.yml:
- Around line 89-90: The workflow step that generates changelog frontmatter for
the `/skip` command currently writes an invalid field `component: placeholder`;
update the step that sets frontmatter (the step using BRANCH: ${{
steps.meta.outputs.branch }} and the other occurrence) to either remove the
`component` key entirely or set it to a schema-valid value (e.g., `component:
none` or another allowed enum), so the generated frontmatter conforms to
changelog validation; apply the same change to the second occurrence of the
frontmatter generation in this workflow.
- Around line 93-99: The file-selection logic using github.rest.pulls.listFiles
is unsafe because it can match changelog/README.md and may miss files due to
pagination; update the code that builds files (the call to
github.rest.pulls.listFiles and the variables files/target) to (1) paginate
properly (use github.paginate or loop with per_page & page) so all PR files are
retrieved, and (2) tighten the target selector to a stricter regex that excludes
README and matches changelog entry names only (for example require
/^changelog\/\d{4}-\d{2}-\d{2}.*\.md$/ or explicitly reject 'README.md') before
throwing the 'No changelog file' error.
- Line 19: Pin all GitHub Action references instead of floating refs: replace
actions/github-script@v7, actions/checkout@v4, and
gokite-ai/gha-actions/changelog@main with fixed tags or commit SHAs (e.g., a
specific vX.Y.Z or full SHA) to ensure reproducible runs, and in the
actions/checkout step that uses secrets.CHANGELOG_BOT_TOKEN set
persist-credentials: false to avoid leaving bot credentials on the runner;
update the checkout step (actions/checkout) to include persist-credentials:
false and change the other uses entries to pinned versions/SHAs.
In `@changelog/index.schema.json`:
- Line 18: The schema currently validates changelog dates with a regex pattern
that allows invalid calendar dates; update the JSON Schema entries for the
"date" and "corrected_at" properties to use "type": "string" combined with
"format": "date" (Ajv + ajv-formats will enforce real YYYY-MM-DD dates) instead
of the current "pattern" key so invalid dates like 2026-99-99 are rejected;
locate the "date" and "corrected_at" property definitions in the schema (symbols
"date" and "corrected_at") and replace the pattern-based validation with
format-based validation.
---
Nitpick comments:
In `@changelog/2026/2026-05-19-web-v1-2-0.md`:
- Around line 15-29: Add an explicit cross-reference to the backend release that
introduced the estimated_fees field by appending a "See also" link at the end of
this Web v1.2.0 entry; mention Backend v1.1.0 and point to the backend changelog
filename (2026-05-19-backend-v1-1-0.md) so readers can follow the full feature
story for estimated_fees (referencing the Web entry's mention of estimated_fees
and the file name for Backend v1.1.0).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 75b8e40d-9e26-4974-bbaa-51e1cf6297c0
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (17)
.github/CODEOWNERS.github/workflows/changelog-build.yml.github/workflows/changelog-commands.ymlSUMMARY.mdchangelog/2026/.gitkeepchangelog/2026/2026-05-19-backend-v1-1-0.mdchangelog/2026/2026-05-19-cli-v1-3-4.mdchangelog/2026/2026-05-19-skills-v0-9-1.mdchangelog/2026/2026-05-19-web-v1-2-0.mdchangelog/2027/.gitkeepchangelog/README.mdchangelog/components.ymlchangelog/index.schema.jsonpackage.jsonpublic/changelog/index.jsonscripts/build-changelog.mjsscripts/build-changelog.test.mjs
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/changelog-commands.yml (1)
8-12:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winAdd commenter authorization gating before executing reviewer commands.
Line 8 currently allows any commenter with a matching command string to trigger a job with write permissions and secret-backed steps. Restrict execution to trusted associations (for example: OWNER/MEMBER/COLLABORATOR) to prevent unauthorized
/regenerateor/skipruns.Suggested fix
if: | github.event.issue.pull_request != null && + contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association) && startsWith(github.event.issue.title, 'Changelog:') && (startsWith(github.event.comment.body, '/regenerate') || startsWith(github.event.comment.body, '/skip'))🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/changelog-commands.yml around lines 8 - 12, The workflow currently triggers on comment body commands but lacks an authorization check; update the if condition that contains github.event.issue.pull_request and the startsWith(github.event.comment.body, ...) checks to also require github.event.comment.author_association to be one of the trusted values (e.g., OWNER, MEMBER, COLLABORATOR). In practice, add a predicate like contains('OWNER,MEMBER,COLLABORATOR', github.event.comment.author_association) (or equivalent OR comparisons) alongside the existing startsWith checks so only authorized commenter associations can run the secret-backed steps.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/changelog-commands.yml:
- Around line 8-12: The workflow currently triggers on comment body commands but
lacks an authorization check; update the if condition that contains
github.event.issue.pull_request and the startsWith(github.event.comment.body,
...) checks to also require github.event.comment.author_association to be one of
the trusted values (e.g., OWNER, MEMBER, COLLABORATOR). In practice, add a
predicate like contains('OWNER,MEMBER,COLLABORATOR',
github.event.comment.author_association) (or equivalent OR comparisons)
alongside the existing startsWith checks so only authorized commenter
associations can run the secret-backed steps.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 00a9cceb-7dff-49ba-a67b-e09eee0b4a3c
📒 Files selected for processing (1)
.github/workflows/changelog-commands.yml
springzh
approved these changes
May 22, 2026
springzh
approved these changes
May 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Documentation
Tests
Chores