Release-notes CLI: validate-labels, require-changelog-file, amend upload, on-release gaps

[Mpdreamz]

Seven concrete gaps blocked onboarding two playground repos to the release-notes pipeline. This closes all of them in the CLI layer and registers both repos in config/products.yml, so the forthcoming docs-actions shared workflows can be built on a solid foundation.

Affects: Release notes, CLI, Configuration

Why

The minimal (gh-release-driven) onboarding path was broken in at least three ways: changelog gh-release wrote its bundle to bundle.directory while bundle-create/action.yml searched ${OUTPUT:-docs/releases}/bundles, so the bundle was never found. No label-only validation workflow existed — even minimal repos had to adopt the full four-workflow validate/submit pair. And upload hardcoded --artifact-type changelog, so manual-override amend sidecars could never be pushed from main. The full path added two more gaps: nothing could require a changelog entry file on a PR, and validate-onboarding silently skipped on-release repos.

What

changelog validate-labels (new command)

A label-only gate safe for fork-triggered pull_request events. It resolves type and products from labels against pivot.types, pivot.products, and rules.create with no GitHub API access and no title resolution. Emits status (ok | no-label | skipped), type, products, label-table, and skip-labels. Exits non-zero only on no-label.

--require-changelog-file on evaluate-pr

Hard gate that fails the PR with missing-entry when no changelog entry file exists for the PR number and the flag is set. The flag is a workflow input — it belongs on the command line rather than in changelog.yml. It is fully detached from bot commit or comment behaviour, which release-notes-changelog-file.yml continues to own independently.

--artifact-type amend and comma-list support on upload

A new artifact type discovers *.amend-{N}.yaml sidecars in bundle.output_directory, excluding .amend-notes. The command now accepts a comma-separated list (changelog,amend) so sync can push entries and amends in one call — the fixed convention for the forthcoming release-notes.yml shared workflow. Syncing parent bundles from main is wrong for on-release repos; amends are what must travel.

bundle --plan mode output and output-path fix

The plan step now emits mode: gh-release when bundle.profiles is absent and resolves output_path from bundle.output_directory, letting bundle-create drop its find-based gh-release discovery entirely. changelog gh-release now prefers bundle.output_directory over bundle.directory for its output path, so writer and plan agree on one path.

validate-onboarding extended to on-release repos

The onboarding validator now checks products registered with features.release-notes: on-release in addition to prestage. On-release repos require release-notes.yml and changelog.yml; prestage repos keep the existing four-workflow check with a new-shape fallback for repos that have already migrated.

Out of scope: The docs-actions shared workflow (release-notes.yml, release-notes-changelog-file.yml) and the onboarding docs rewrite are separate PRs that depend on the edge image built from this branch. The elastic/docs-infra OIDC role PR and config/assembler.yml allowlist entry (D9, requires both repos to go public first) are also separate.

Verify

./build.sh unit-test
# All 1076 changelog tests pass; ProductFeaturesTests confirms both playground products load correctly

[github-actions]

Docs preview (local build)

Handbook preview: https://docs-v3-preview.elastic.dev/elastic/docs-builder/pull/3978/

Sample changed pages:

• docs/cli/changelog/cmd-validate-labels.md
• docs/cli/changelog/cmd-bundle.md
• docs/cli/changelog/cmd-evaluate-pr.md