Add CHANGELOG.md modification check and warning comment

[mario-campos]

This PR adds a PR check for non-release/mergeback/update-bundle PRs. The check posts a sticky PR comment if CHANGELOG.md has been modified in the PR, warning the author to instead direct their change to a change-note.

Risk assessment

For internal use only. Please select the risk level of this change:

• Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Workflow types:

• N/A

Products:

• N/A

Environments:

• Testing/None - This change does not impact any CodeQL workflows in production.

How did/will you validate this change?

• None - I am not validating these changes.

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

• Development/testing only - This change cannot cause any failures in production.

How will you know if something goes wrong after this change is released?

• N/A

Are there any special considerations for merging or releasing this change?

• No special considerations - This change can be merged at any time.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Consider adding a changelog entry for this change.
• Confirm the readme and docs have been updated if necessary.

[mbg]

Couple of initial comments on this draft. I like that this is taking advantage of the setup that the existing fetch-base provides.

I haven't checked if the changelog-check step behaves as expected yet either. One thing I did note though related to it is that the fetch-base step is skipped if github.event.pull_request.user.login != 'dependabot[bot]'. That isn't new in this PR (and we probably shouldn't address it here), but it might be better to check github.triggering_actor instead of github.event.pull_request.user.login. The justification in the comment is that Dependabot doesn't have permission, but it is possible for us to push commits to Dependabot PR branches or re-run workflows on it.

Also agree that it would be good to not spam the comment and instead replace an existing one. It's fairly easy to do that with gh or in a script by leaving a comment (<!-- some distinct marker -->) in the comment that's posted and then looking for that.

[Copilot]

🟡 Changes recommended

Shell command substitution currently prevents warning creation, and comment lifecycle and exclusion logic need correction.

3 open findings

• Stale warning persists when changelog changes are reverted · New
• Title-only exemption suppresses warnings for ordinary pull requests · New
• Unescaped backticks trigger command substitution and fail the warning step · New

What changed in this PR

Adds a PR check that warns contributors to use change notes instead of editing CHANGELOG.md directly.

Changes:

• Detects CHANGELOG.md modifications.
• Adds a sticky warning comment with automation exclusions.
• Consolidates PR comment posting into one job.

File	Description
.github/​workflows/​pr-checks.yml	Detects changelog edits and posts PR warnings.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[mario-campos]

@copilot Are there unresolved findings?

[Copilot]

@copilot Are there unresolved findings?

Yes—one valid finding remains: the warning step is gated on changelog-changed == 'true', so if a later commit reverts the CHANGELOG.md change, the step never runs and the existing warning comment stays stale. It should also run when the file is unchanged and remove any existing marker comment. The shell backticks are escaped, and the automation exclusion checks now include branch criteria.

[Copilot]

🟢 Approval recommended

The workflow correctly handles comment creation, deduplication, cleanup, and automation exemptions.

0 open findings

3 resolved since last review

• Unescaped backticks trigger command substitution and fail the warning step
• Title-only exemption suppresses warnings for ordinary pull requests
• Stale warning persists when changelog changes are reverted

🧠 Review effort: Balanced

[mbg]

Thanks for changing this to move away from pulling in another action and also moving the step that posts or updates the comment out of other-checks and into (now) post-pr-comments.

I added a few more comments, but the main one is about avoiding more, lengthy-ish shell scripts. It shouldn't be hard to implement in TS in pr-checks and I have included some relevant pointers in my detailed comment about this.

[mbg]

I am not keen on adding more shell scripts in workflow steps beyond very short ones, and this one is now a bit long with the $CHANGED check added as well.

Can you turn this into a new script in pr-checks instead? We already have a couple of helpers in api-client.ts there. See sync-checks.ts or update-release-branch.ts for examples of scripts that use the API there.

The script doesn't even have to be all that specific to this. The "create-or-update-comment" pattern is probably useful in a few different places.