changelog: stricter preview workflow (#5898)

## Changes

1. Run validation during changelog-preview
2. Formatting of the preview

## Why

1. So a misplaced file (e.g. `.nextchanges/my-change.md`) fails the
workflow
2. To show the rendered markdown in the action summary

## Tests

- Added bad file (bc8526f),
https://github.com/databricks/cli/actions/runs/29205073987?pr=5898
- Added good file (3308219),
https://github.com/databricks/cli/actions/runs/29205217338

Author: janniklasrose

.github/workflows/changelog-preview.yml

@@ -1,8 +1,9 @@
 name: Changelog Preview
 
 # Renders the CHANGELOG.md section the next release would generate from this
-# PR's .nextchanges/ fragments, so reviewers can see the result (in this check's
-# logs / summary) without cutting a release.
+# PR's .nextchanges/ fragments into this check's job summary, so reviewers see
+# the rendered changelog without cutting a release. Fails the check if a
+# fragment is misplaced (so it can't be silently skipped by the renderer).
 #
 # Uses `pull_request` with a read-only token: it renders the PR's own
 # .nextchanges/ content and never needs write credentials.
@@ -30,16 +31,25 @@ jobs:
         with:
           version: "0.8.9"
 
+      # Fail the check on a misplaced/unexpected file under .nextchanges/ so it
+      # can't slip through as a silently-skipped (unrendered) fragment.
+      - name: Validate .nextchanges placement
+        run: uv run tools/validate_nextchanges.py
+
       - name: Render changelog preview
         run: |-
+          # Render into a variable first so a renderer error fails this step
+          # (rather than being swallowed by a pipe), then emit the .md directly
+          # into the job summary so GitHub renders it as the changelog.
+          preview=$(uv run --locked internal/genkit/release_tagging.py --preview)
           {
-            echo '### Changelog preview'
+            echo '## Changelog preview'
+            echo ''
+            echo 'This is a preview of what the next release would add to CHANGELOG.md based on `.nextchanges/`.'
             echo ''
-            echo "What the next release would add to CHANGELOG.md from this PR's .nextchanges/:"
+            echo '_NOTE: the date and version are computed at release time._'
             echo ''
-            echo '```markdown'
-            uv run --locked internal/genkit/release_tagging.py --preview
-            echo '```'
+            echo '---'
             echo ''
-            echo '_Preview only — the date and version are computed at release time._'
-          } | tee "$GITHUB_STEP_SUMMARY"
+            echo "$preview"
+          } >> "$GITHUB_STEP_SUMMARY"

Taskfile.yml

@@ -295,6 +295,9 @@ tasks:
   changelog-preview:
     desc: Print the CHANGELOG.md section the next release would add from .nextchanges/
     cmds:
+      # Validate placement first so a misplaced fragment fails loudly instead of
+      # being silently skipped by the renderer (see validate_nextchanges.py).
+      - task: check-changelog
       - "uv run --locked internal/genkit/release_tagging.py --preview"
 
   deadcode: