feat: add Update Changelogs workflow with auto-changelog v6 --checkDeps#8443
Open
cryptodev-2s wants to merge 22 commits intomainfrom
Open
feat: add Update Changelogs workflow with auto-changelog v6 --checkDeps#8443cryptodev-2s wants to merge 22 commits intomainfrom
cryptodev-2s wants to merge 22 commits intomainfrom
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
cryptodev-2s
changed the title
- Add --checkDeps to validate-changelog.sh to catch missing dep entries - Add --checkDeps --fix to update-changelog.sh to auto-generate dep entries - Add fix-changelogs workflow to auto-fix changelogs on release branches
- --checkDeps/--fix are validate-only flags, revert from update-changelog.sh - Skip --checkDeps on main branch to avoid "HEAD is same as base" error - Workflow uses validate --checkDeps --fix with PR number for auto-fixing
Keep dependency bump validation opt-in via @metamaskbot check-deps only.
- Add missing --checkDeps flag to validate step - Fix shell quoting bug in fork detection - Narrow git add to **/CHANGELOG.md only - Report validation failures in PR comment instead of swallowing them - Use chore: prefix for automated commit message
- Add concurrency group to prevent racing on duplicate triggers - Add if: always() to comment step so users always get feedback - Add comment explaining branch checkout purpose - Remove -A flag from git add (only staging tracked CHANGELOG.md files) - Improve step name and commit message for clarity
- Add pull_request opened trigger for release/* branches targeting main - Use github.event.issue.number || github.event.pull_request.number for both triggers - Conditionally show reaction only for comment triggers
- Rename file from fix-changelogs.yml to update-changelogs.yml - Update workflow name, job names, and concurrency group - Rename bot command to @metamaskbot update-changelogs
- Add git fetch before branch checkout (shallow clone has no branch refs) - Handle partial fix case: report remaining errors when fixes are pushed - Handle skipped steps: detect when earlier steps fail and report accurately - Rename job ID from fix-changelogs to update-changelogs for consistency
cryptodev-2s
force-pushed
the
feat/auto-changelog-check-deps
branch
from
772928a to
f4aabbb
Compare
Shallow clone with fetch-depth: 1 doesn't include origin/main, causing --checkDeps to fail with "could not resolve base branch".
- Use fetch-depth: 0 so git merge-base can find common ancestor with main - Hide previous bot comments on rerun to reduce noise - Add emoji to comment messages for clarity
- Add --paginate to handle PRs with many comments - Use precise emoji-anchored regex to match only this workflow's comments - Add continue-on-error so comment hiding doesn't block core workflow
Use patroll-managed PAT so commits pushed by this workflow trigger subsequent CI workflows (GITHUB_TOKEN commits don't trigger workflows). Depends on: MetaMask/patroll#75
MetaMask/action-checkout-and-setup doesn't accept a token input, so the PAT was silently ignored. Use actions/checkout with the PAT first, then gh pr checkout, then action-checkout-and-setup for node/yarn setup (it skips checkout if .git already exists).
Comment on lines
+93
to
+102
| - name: Validate and fix dependency bump entries | ||
| id: validate | ||
| run: > | ||
| yarn workspaces foreach --all --no-private --parallel --interlaced --verbose | ||
| run changelog:validate --checkDeps --fix --currentPr "$PR_NUMBER" | ||
| continue-on-error: true | ||
| env: | ||
| PR_NUMBER: ${{ github.event.issue.number || github.event.pull_request.number }} | ||
|
|
||
| - name: Commit and push if changed |
Contributor
Author
There was a problem hiding this comment.
Mitigated by the is-fork-pull-request job which checks isCrossRepository before the update-changelogs job runs. The job only executes when IS_FORK == 'false', preventing untrusted fork code from being checked out with the PAT. This is the same pattern used by the update-lavamoat-policies workflow in metamask-extension.
- Remove unused "Get PR head ref" step (gh pr checkout handles it) - Simplify comment-hiding regex to ^(✅|⚠️ |❌) to match all 6 variants - Set GITHUB_TOKEN and PR_NUMBER at job level to reduce repetition - Remove per-step env overrides that are now inherited
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 0959ecc. Configure here.
| - name: Commit and push if changed | ||
| id: commit | ||
| run: | | ||
| if git diff --quiet; then |
There was a problem hiding this comment.
Unscoped git diff mismatches scoped git add path
Medium Severity
git diff --quiet checks ALL tracked files for changes, but git add -- '**/CHANGELOG.md' only stages changelog files. If a preceding step (e.g., yarn install via action-checkout-and-setup) modifies any other tracked file like yarn.lock, the diff detects changes, but nothing gets staged, so git commit fails. This produces a misleading "❌ Failed to push changelog fixes" comment when no changelog fixes were actually needed. The diff check needs to be scoped to the same pathspec: git diff --quiet -- '**/CHANGELOG.md'.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 0959ecc. Configure here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Explanation
Adds an Update Changelogs workflow that uses
@metamask/auto-changelogv6's--checkDeps --fixfeature to automatically validate and fix missing dependency bump changelog entries.Triggers:
release/*branch) is opened targetingmain@metamaskbot update-changelogson any non-fork PRWhat it does:
changelog:validate --checkDeps --fix --currentPr <PR#>across all packagesSecurity:
isCrossRepositorycheck${{ }}inrun:blocks)References
N/A
Checklist
Note
Medium Risk
Adds a new GitHub Actions workflow that runs with write permissions and a PAT to push commits back to PR branches, so misconfiguration could cause unwanted automated commits/comments or workflow churn.
Overview
Adds a new
Update ChangelogsGitHub Actions workflow that can be triggered onrelease/*PR open events and via an@metamaskbot update-changelogsPR comment.The workflow skips fork PRs, checks out the PR branch, runs
changelog:validate --checkDeps --fixacross workspaces, auto-commits/pushes anyCHANGELOG.mdfixes, and posts (and minimizes prior) status comments on the PR.Reviewed by Cursor Bugbot for commit 0959ecc. Bugbot is set up for automated code reviews on this repo. Configure here.