feat: add release-notes shared workflows for one-file consumer onboarding - #313
Merged
Conversation
…ding Introduce two reusable `workflow_call` workflows that centralise all release-notes automation logic so consumer repos only need to supply triggers and inputs: * `.github/workflows/release-notes.yml` — single workflow covering the three event gates (PR validate, push sync, release bundle). Replaces the four separate `changelog-validate` / `changelog-upload` / `changelog-bundle` calls that existing repos wire up individually. Inputs: `config`, `bundle-on-release` (default false), and `require-changelog-file` (default false) which gates `evaluate-pr` with `--require-changelog-file` when enabled. The sync job always uploads `changelog,amend` artifact types; `--strip-title-prefix` is always on. Depends on the new CLI commands shipped in elastic/docs-builder#3978 (shipped via the `edge` image). * `.github/workflows/release-notes-changelog-file.yml` — companion `workflow_call` workflow (adapted from `changelog-submit.yml`) for repos that maintain a changelog file. Consumer repos call this from a `workflow_run` trigger that fires when their release-notes workflow completes. Keeps the same preflight/generate/apply jobs and the `comment-only` input; adds `id-token: write` to the apply job. Supporting action updates (backward-compatible, no breaking changes): * `changelog/upload/action.yml` — add `artifact-type` input (default `changelog`) so callers can pass `changelog,amend` explicitly rather than relying on the hardcoded value. * `changelog/bundle-upload/action.yml` — add `bundle-path` as alias for `output` so the release-notes workflow can pass the plan step's `output_path` output directly. * `changelog/bundle-create/action.yml` — add `output-path` as alias for `output`; when provided, skip the internal plan step and use the pre-resolved path. The existing `changelog-*.yml` workflows are left intact as shims. Co-Authored-By: Claude <noreply@anthropic.com>
actionlint flagged two direct inline uses of untrusted context values in the Evaluate PR step: - github.event.pull_request.title - github.head_ref Both are moved to environment variables (PR_TITLE, HEAD_REF) per the GitHub security guidance on script injection attacks. Also regenerates changelog/upload/README.md via the action-readme hook, which was out of date after the artifact-type input was added to the upload action. Co-Authored-By: Claude <noreply@anthropic.com>
All inline template expansions in run: steps moved to env: vars (actionlint), actions/checkout pinned to SHA with persist-credentials: false (zizmor), aws-actions/configure-aws-credentials pinned to d979d5b (zizmor blanket policy). Co-Authored-By: Claude <noreply@anthropic.com>
…ease vs bundle bundle --plan already resolves the mode from changelog.yml (no profiles → gh-release, profiles present → bundle). Gating the two execution paths on steps.plan.outputs.mode eliminates the caller-supplied mode: input, the find-based gh-release output discovery (F1/A2), the output-path alias, and the outer plan step in release-notes.yml. github-token already defaults to github.token so callers need not pass it explicitly. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Onboarding a new repo to release-notes automation currently requires four separate workflow files in the consumer repo (
changelog-validate,changelog-upload,changelog-bundle, and aworkflow_runshim forchangelog-submit). This is error-prone and any one of the four can be misconfigured silently.This PR centralises all logic in docs-actions so a consumer repo needs one file (
release-notes.ymlcaller) to get PR validation, push sync, and optional release bundling — and a second file for the changelog-file submit flow if the repo maintains a changelog file.What
New reusable workflows:
.github/workflows/release-notes.yml— singleworkflow_callcovering three event gates:pull_request: runschangelog validate-labels; optionally runschangelog evaluate-pr --require-changelog-filewhenrequire-changelog-file: truepush: uploadschangelog,amendartifact types to S3 via thechangelog/uploadactionrelease(opt-in viabundle-on-release: true): plans and creates a bundle, then uploads to S3.github/workflows/release-notes-changelog-file.yml—workflow_callwrapper (adapted fromchangelog-submit.yml) for repos with a changelog file. Consumer calls this from aworkflow_runtrigger. Same preflight/generate/apply jobs; addsid-token: writeto apply.Backward-compatible action updates:
changelog/upload/action.yml: addartifact-typeinput (default:changelog) — existing callers are unaffectedchangelog/bundle-upload/action.yml: addbundle-pathalias foroutputchangelog/bundle-create/action.yml: addoutput-pathalias foroutput; skip internal plan step when pre-resolved path is suppliedThe existing
changelog-*.ymlworkflows are not modified and remain as shims.Dependency
Requires the new CLI commands in elastic/docs-builder#3978 (
changelog validate-labels,--require-changelog-fileonevaluate-pr,--artifact-type amend,bundle --planmodeoutput). The workflows useversion: edgewhich will pick up that branch's image once merged.Test plan
release-notes.ymlvalidate job runs on a PR with/withoutrequire-changelog-filechangelog,amendon pushrelease-notes-changelog-file.ymlpreflight/generate/apply chain works from aworkflow_runcallerchangelog-validate.yml/changelog-upload.ymlare unaffected🤖 Generated with Claude Code