sync-release-notes.yml

name: Sync Release Notes

# Manual-only trigger — automated changelog sync is handled by the Release workflow.
# Use this to re-sync CHANGELOG.md from GitHub releases at any time.
on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  sync-release-notes:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      
    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
      with:
        egress-policy: audit

    - name: Checkout code
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        fetch-depth: 0
        
    - name: Setup Node.js
      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
      with:
        node-version: '20.x'
        
    - name: Sync GitHub release notes to CHANGELOG.md
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: node scripts/sync-changelog.js
        
    - name: Check for changes
      id: changes
      run: |
        if git diff --quiet CHANGELOG.md; then
          echo "changed=false" >> "$GITHUB_OUTPUT"
          echo "No changes detected in CHANGELOG.md"
        else
          echo "changed=true" >> "$GITHUB_OUTPUT"
          echo "Changes detected in CHANGELOG.md"
        fi

    - name: Create Pull Request
      if: steps.changes.outputs.changed == 'true'
      uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
      with:
        branch: update-changelog
        title: "docs: sync CHANGELOG.md with GitHub release notes"
        body: |
          Automatically syncs CHANGELOG.md with the latest GitHub release notes.
          
          Triggered by: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        commit-message: "docs: sync CHANGELOG.md with GitHub release notes"
        
    - name: Summary
      run: |
        if [ "${{ steps.changes.outputs.changed }}" == "true" ]; then
          echo "✅ A PR has been created to update CHANGELOG.md with GitHub release notes"
        else
          echo "ℹ️ CHANGELOG.md was already up to date with GitHub release notes"
        fi