Add CI guard to prevent direct CHANGELOG.md modifications#4713
Merged
shreyas-goenka merged 1 commit intomainfrom Mar 12, 2026
Merged
Add CI guard to prevent direct CHANGELOG.md modifications#4713shreyas-goenka merged 1 commit intomainfrom
shreyas-goenka merged 1 commit intomainfrom
Conversation
shreyas-goenka
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
shreyas-goenka
force-pushed
the
changelog-guard
branch
from
db8e277 to
9f8cba5
Compare
shreyas-goenka
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Collaborator
|
Commit: ca6cdde
16 interesting tests: 7 SKIP, 6 RECOVERED, 3 flaky
Top 20 slowest tests (at least 2 minutes):
|
The release tagging workflow (tagging.py) uses CHANGELOG.md entries to detect pending releases. If a PR adds a release entry directly to CHANGELOG.md, recovery mode incorrectly tags the wrong commit. This guard fails PRs that modify CHANGELOG.md, with a break-glass override via the 'override-changelog-guard' label. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
shreyas-goenka
force-pushed
the
changelog-guard
branch
from
9f8cba5 to
ca6cdde
Compare
shreyas-goenka
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
shreyas-goenka
requested review from
andrewnester,
anton-107,
denik,
pietern and
simonfaltum
as code owners
pietern
approved these changes
Mar 12, 2026
Contributor
pietern
left a comment
pietern
left a comment
There was a problem hiding this comment.
Did you confirm the tests in the PR summary?
Contributor
Author
|
The workflow worked as expected on this PR: #4717. We don't need to test that this workflow does NOT trigger on releases, since it's trigger is defined to be PR only. |
pietern
reviewed
Mar 12, 2026
Contributor
pietern
left a comment
pietern
left a comment
There was a problem hiding this comment.
@shreyas-goenka I was thinking about the label override.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CHANGELOG.mddirectlyoverride-changelog-guardlabelProblem
PR #4675 directly modified
CHANGELOG.md, which caused the release tagging workflow (tagging.py) to incorrectly detect a pending release. This resulted in a broken v0.293.0 release where recovery mode tagged the wrong commit.The root cause is that
tagging.pyusesCHANGELOG.mdentries to detect pending releases. When a PR adds a release entry directly toCHANGELOG.md(rather than going through the standard release flow viaNEXT_CHANGELOG.md), the tagging logic gets confused.Solution
A lightweight CI guard that:
CHANGELOG.mdCHANGELOG.mdis managed by the release workflowoverride-changelog-guardlabel to the PRTest plan
CHANGELOG.mdCHANGELOG.mdoverride-changelog-guardlabel allows the PR to pass🤖 Generated with Claude Code