From df9efcb87cbc1bd0530e43ff81534e6076a457a3 Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Tue, 3 Nov 2026 11:15:36 -0600 Subject: [PATCH 1/2] Warn about direct CHANGELOG.md changes in PR checks Split workflow activation from #4217 while keeping the comment action loaded from trusted main. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/pr-checks.yml | 75 ++++++++++++++++++++++++++++++++- 1 file changed, 73 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index 24564ecf42..0d79bf171c 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -95,6 +95,8 @@ jobs: contents: read runs-on: ubuntu-26.04 timeout-minutes: 10 + outputs: + changelog-modified: ${{ steps.changelog-check.outputs.modified }} concurrency: cancel-in-progress: ${{ github.event_name == 'pull_request' || false }} @@ -188,6 +190,20 @@ jobs: path: ${{ runner.temp }}/repo-size/ if-no-files-found: error + - name: Check for CHANGELOG.md changes + id: changelog-check + if: steps.fetch-base.outcome == 'success' + env: + BASE_SHA: ${{ steps.fetch-base.outputs.merge_base }} + HEAD_SHA: ${{ github.event.pull_request.head.sha }} + run: | + if ! git diff --exit-code --quiet "$BASE_SHA" "$HEAD_SHA" -- CHANGELOG.md; then + echo "CHANGELOG.md was modified in this PR." + echo "modified=true" >> "$GITHUB_OUTPUT" + else + echo "modified=false" >> "$GITHUB_OUTPUT" + fi + - name: "Backport: Check out base ref" id: checkout-base if: ${{ startsWith(github.head_ref, 'backport-') }} @@ -208,8 +224,8 @@ jobs: exit 1 fi - post-repo-size-comment: - name: Post repo size comment + post-pr-comments: + name: Post PR comments needs: other-checks # Keep write permissions isolated from the job that checks out and tests PR code. This job only # posts the candidate comment body produced by the read-only `pr-checks` job. @@ -229,6 +245,22 @@ jobs: group: check-repo-size-${{ github.event.pull_request.number }} steps: + - name: Checkout repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + # Check out main, not the PR's head, since this job runs with + # `pull-requests: write` permissions and must not execute untrusted code from the PR. + ref: main + + - name: Set up Node.js + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 + with: + node-version: 24 + cache: "npm" + + - name: Install dependencies + run: npm ci --workspace=pr-checks + - name: Download repo size comment uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: @@ -258,3 +290,42 @@ jobs: else echo "Skipping repo size comment because the delta is below the threshold and no sticky comment exists." fi + + - name: Post a warning about modifying CHANGELOG.md + # Release, backport, mergeback, and bundle-update PRs deliberately modify CHANGELOG.md, + # so skip comment management entirely for these automation flows. + if: >- + needs.other-checks.outputs.changelog-modified == 'true' && + !startsWith(github.event.pull_request.head.ref, 'update-v') && + !startsWith(github.event.pull_request.head.ref, 'backport-v') && + !startsWith(github.event.pull_request.head.ref, 'mergeback/') && + !startsWith(github.event.pull_request.head.ref, 'update-bundle/') + uses: ./.github/actions/post-comment + with: + marker: "post-comment:CHANGELOG.md" + body: | + ⚠️ `CHANGELOG.md` has been modified in this PR. Please do not modify `CHANGELOG.md` directly. + Instead, create a change-note file in `unreleased-change-notes/`. The `CHANGELOG.md` + file will be automatically generated from those change-notes. + See [`unreleased-change-notes/README.md`](https://github.com/github/codeql-action/blob/main/unreleased-change-notes/README.md) for more information. + token: ${{ secrets.GITHUB_TOKEN }} + + - name: Mark the CHANGELOG.md concern as resolved + if: >- + needs.other-checks.outputs.changelog-modified == 'false' && + !startsWith(github.event.pull_request.head.ref, 'update-v') && + !startsWith(github.event.pull_request.head.ref, 'backport-v') && + !startsWith(github.event.pull_request.head.ref, 'mergeback/') && + !startsWith(github.event.pull_request.head.ref, 'update-bundle/') + uses: ./.github/actions/post-comment + with: + marker: "post-comment:CHANGELOG.md" + update-only: true + body: | + ⚠️ `CHANGELOG.md` has been modified in this PR. Please do not modify `CHANGELOG.md` directly. + Instead, create a change-note file in `unreleased-change-notes/`. The `CHANGELOG.md` + file will be automatically generated from those change-notes. + See [`unreleased-change-notes/README.md`](https://github.com/github/codeql-action/blob/main/unreleased-change-notes/README.md) for more information. + + **Edit:** `CHANGELOG.md` is no longer modified in this PR. This concern is resolved. + token: ${{ secrets.GITHUB_TOKEN }} From 5c6d084d06f7785385ca9c3faf75bf373121c49b Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Tue, 3 Nov 2026 11:41:42 -0600 Subject: [PATCH 2/2] Install root dependencies for PR comment action Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/pr-checks.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index 0d79bf171c..ea3632b75c 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -259,7 +259,7 @@ jobs: cache: "npm" - name: Install dependencies - run: npm ci --workspace=pr-checks + run: npm ci --workspace=pr-checks --include-workspace-root - name: Download repo size comment uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2