feat: add Update Changelogs workflow with auto-changelog v6 --checkDeps by cryptodev-2s · Pull Request #8443 · MetaMask/core

cryptodev-2s · 2026-04-13T21:20:20Z

Explanation

Adds an Update Changelogs workflow that uses @metamask/auto-changelog v6's --checkDeps --fix feature to automatically validate and fix missing dependency bump changelog entries.

Triggers:

Automatic: When a release PR (release/* branch) is opened targeting main
On-demand: Comment @metamaskbot update-changelogs on any non-fork PR

What it does:

Detects and skips fork PRs (security)
Checks out the PR head branch
Runs changelog:validate --checkDeps --fix --currentPr <PR#> across all packages
Commits and pushes any CHANGELOG.md fixes back to the PR branch
Comments on the PR with the result

Security:

Fork PRs are blocked via isCrossRepository check
All dynamic values use environment variables (no ${{ }} in run: blocks)
SHA-based checkout with branch name switch for release branch detection

References

Use example Release/913.0.0 cryptodev-2s/core#5

Checklist

I've updated the test suite for new or updated code as appropriate
I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
I've communicated my changes to consumers by updating changelogs for packages I've changed
I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

Note

Medium Risk
Adds CI automation that runs with contents: write and can push commits to PR branches and post/minimize comments, so misconfiguration could affect contributor branches or spam PRs; code changes are limited to GitHub workflow logic.

Overview
Adds a new Update Changelogs workflow that, for non-fork PRs, detects release PRs (or a @metamaskbot update-changelogs comment), runs yarn changelog:validate --checkDeps --fix from the PR’s merge-base, and auto-commits/pushes any **/CHANGELOG.md fixes back to the PR branch with a status comment (minimizing prior bot comments).

Makes release detection configurable by introducing a commit-starts-with input to the check-release composite action and wiring both check-release and the is-release job in main.yml to use ${{ vars.RELEASE_COMMIT_PREFIX }} instead of a hardcoded prefix list.

^{Reviewed by Cursor Bugbot for commit c6e02fe. Bugbot is set up for automated code reviews on this repo. Configure here.}

- Add --checkDeps to validate-changelog.sh to catch missing dep entries - Add --checkDeps --fix to update-changelog.sh to auto-generate dep entries - Add fix-changelogs workflow to auto-fix changelogs on release branches

- --checkDeps/--fix are validate-only flags, revert from update-changelog.sh - Skip --checkDeps on main branch to avoid "HEAD is same as base" error - Workflow uses validate --checkDeps --fix with PR number for auto-fixing

@metamaskbot

Keep dependency bump validation opt-in via @metamaskbot check-deps only.

- Add missing --checkDeps flag to validate step - Fix shell quoting bug in fork detection - Narrow git add to **/CHANGELOG.md only - Report validation failures in PR comment instead of swallowing them - Use chore: prefix for automated commit message

- Add concurrency group to prevent racing on duplicate triggers - Add if: always() to comment step so users always get feedback - Add comment explaining branch checkout purpose - Remove -A flag from git add (only staging tracked CHANGELOG.md files) - Improve step name and commit message for clarity

- Add pull_request opened trigger for release/* branches targeting main - Use github.event.issue.number || github.event.pull_request.number for both triggers - Conditionally show reaction only for comment triggers

@metamaskbot

- Rename file from fix-changelogs.yml to update-changelogs.yml - Update workflow name, job names, and concurrency group - Rename bot command to @metamaskbot update-changelogs

- Add git fetch before branch checkout (shallow clone has no branch refs) - Handle partial fix case: report remaining errors when fixes are pushed - Handle skipped steps: detect when earlier steps fail and report accurately - Rename job ID from fix-changelogs to update-changelogs for consistency

Shallow clone with fetch-depth: 1 doesn't include origin/main, causing --checkDeps to fail with "could not resolve base branch".

- Use fetch-depth: 0 so git merge-base can find common ancestor with main - Hide previous bot comments on rerun to reduce noise - Add emoji to comment messages for clarity

- Add --paginate to handle PRs with many comments - Use precise emoji-anchored regex to match only this workflow's comments - Add continue-on-error so comment hiding doesn't block core workflow

Use patroll-managed PAT so commits pushed by this workflow trigger subsequent CI workflows (GITHUB_TOKEN commits don't trigger workflows). Depends on: MetaMask/patroll#75

…OCTOU' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Mrtenz · 2026-04-20T12:39:48Z

+inputs:
+  commit-starts-with:
+    description: "Validate that the release commit starts with a string in this comma-separated list. Use '[version]' to refer to the current release version."
+    required: true


Actions don't have access to vars directly.

Mrtenz · 2026-04-20T12:40:24Z

+          set -euo pipefail
+
+          MERGE_BASE=$(git merge-base HEAD "refs/remotes/origin/$BASE_REF")
+          echo "merge-base=$MERGE_BASE" >> "$GITHUB_OUTPUT"


Merge base is needed to determine the before commit for action-is-release.

Interesting. auto-changelog also takes a "before" commit via a --from option. If this is not given it will calculate its own merge base: https://github.com/MetaMask/auto-changelog/blob/902c1f9b54dd3c61f938475400da46ac1cb04e4c/src/get-dependency-changes.ts#L198. So now we have two places that perform this step (in two different ways). Maybe we should capture the result of this step and pass it to auto-changelog via --from so that we're using the same approach?

Makes sense!

Mrtenz · 2026-04-20T12:40:39Z

+        run: |
+          git fetch --no-tags origin "$PR_HEAD_SHA"
+          git fetch --no-tags origin "$PR_BASE_REF"
+          git checkout --detach "$PR_HEAD_SHA"


Recommended by CodeQL.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ccae16b. Configure here.}

mcmire

This workflow is surprisingly complicated, but it does all make sense. I just had two more comments.

mcmire · 2026-04-20T13:37:21Z

+          set -euo pipefail
+
+          MERGE_BASE=$(git merge-base HEAD "refs/remotes/origin/$BASE_REF")
+          echo "merge-base=$MERGE_BASE" >> "$GITHUB_OUTPUT"


Interesting. auto-changelog also takes a "before" commit via a --from option. If this is not given it will calculate its own merge base: https://github.com/MetaMask/auto-changelog/blob/902c1f9b54dd3c61f938475400da46ac1cb04e4c/src/get-dependency-changes.ts#L198. So now we have two places that perform this step (in two different ways). Maybe we should capture the result of this step and pass it to auto-changelog via --from so that we're using the same approach?

Mrtenz · 2026-04-20T13:51:03Z

This workflow is surprisingly complicated, but it does all make sense. I just had two more comments.

@mcmire It definitely gets a lot more complicated because we need to support running it when opening a pull request and when leaving a comment. I rewrote some bash scripts to use github-script since (at least to me) it's more readable. Other than that, I'm not sure if it can be simplified further.

mcmire

LGTM!

) ## Explanation `@metamaskbot update-changelogs` never worked outside release PRs. MetaMask#8443 documented it as working on any non fork PR, but shipped both comment jobs gated on `is-release == 'true'`, so commenting on a normal PR did nothing. This makes the comment trigger actually work. | Job | Before | After | Why | | --- | --- | --- | --- | | `react-to-comment` | `is-release == 'true' && issue_comment` | `issue_comment` | react to every command comment, not just ones on release PRs | | `update-changelogs` | `is-release == 'true'` | `is-release == 'true' \|\| issue_comment` | run on demand on any PR, while release PRs keep running automatically | Release PR behavior is unchanged. Opening a non release PR still triggers nothing automatically, you have to ask for it. Fork PRs are still skipped. Also documented the command in `docs/processes/updating-changelogs.md`, since it was undiscoverable. ## References Related to MetaMask#8443 ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate - [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [ ] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them  --- > [!NOTE] > **Low Risk** > CI workflow condition changes and documentation only; no runtime application or security-sensitive logic. > > **Overview** > Fixes **`@metamaskbot update-changelogs`** so it works on ordinary PRs, not only release PRs. Previously both comment-related jobs required `is-release == 'true'`, so commenting on a non-release PR did nothing despite earlier docs implying it should work. > > **`react-to-comment`** now runs on any `issue_comment` (drops the release check) so the bot can 👍 every command comment. **`update-changelogs`** runs when the PR is a release **or** when triggered via `issue_comment`, preserving automatic updates on release PRs while enabling on-demand runs elsewhere. Fork PRs remain unsupported per existing behavior. > > Adds a **Generating changelog entries for dependency bumps** section in `docs/processes/updating-changelogs.md` describing the comment flow, timing, and limitations. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit d1d8705. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

cryptodev-2s requested a review from a team as a code owner April 13, 2026 21:20

github-advanced-security Bot found potential problems Apr 13, 2026

View reviewed changes

Comment thread .github/workflows/fix-changelogs.yml Fixed

cursor Bot reviewed Apr 13, 2026

View reviewed changes

Comment thread .github/workflows/fix-changelogs.yml Outdated

Comment thread .github/workflows/fix-changelogs.yml Outdated

cursor Bot reviewed Apr 13, 2026

View reviewed changes

Comment thread .github/workflows/fix-changelogs.yml Outdated

Comment thread .github/workflows/update-changelogs.yml Outdated

cursor Bot reviewed Apr 13, 2026

View reviewed changes

Comment thread .github/workflows/update-changelogs.yml Outdated

Comment thread .github/workflows/update-changelogs.yml Outdated

cursor Bot reviewed Apr 13, 2026

View reviewed changes

Comment thread .github/workflows/update-changelogs.yml Outdated

cursor Bot reviewed Apr 14, 2026

View reviewed changes

Comment thread .github/workflows/update-changelogs.yml Outdated

cryptodev-2s changed the title ~~feat: adopt auto-changelog v6 --checkDeps for dependency bump validation~~ feat: add Update Changelogs workflow with auto-changelog v6 --checkDeps Apr 14, 2026

cryptodev-2s added 15 commits April 14, 2026 15:58

fix: correct --checkDeps usage and handle main branch

a83983a

- --checkDeps/--fix are validate-only flags, revert from update-changelog.sh - Skip --checkDeps on main branch to avoid "HEAD is same as base" error - Workflow uses validate --checkDeps --fix with PR number for auto-fixing

fix: trigger fix-changelogs via @metamaskbot check-deps PR comment

02fd302

revert: remove --checkDeps from validate-changelog.sh

14d0298

Keep dependency bump validation opt-in via @metamaskbot check-deps only.

fix: use env vars to prevent code injection in fix-changelogs workflow

9c0924f

fix: skip fix-changelogs workflow on fork PRs

f3192c6

fix: remove unnecessary yarn changelog:update step

b6cf542

fix: move reaction step first and report push failures in comment

b516c86

fix: remove unnecessary checkout from fork detection job

455620a

feat: auto-trigger fix-changelogs on release PR open

9069a65

- Add pull_request opened trigger for release/* branches targeting main - Use github.event.issue.number || github.event.pull_request.number for both triggers - Conditionally show reaction only for comment triggers

fix: rename workflow to update-changelogs

5a137b1

- Rename file from fix-changelogs.yml to update-changelogs.yml - Update workflow name, job names, and concurrency group - Rename bot command to @metamaskbot update-changelogs

fix: add job timeout and defensive git add separator

61a4b9e

cryptodev-2s force-pushed the feat/auto-changelog-check-deps branch from 772928a to f4aabbb Compare April 14, 2026 13:58

cursor Bot reviewed Apr 14, 2026

View reviewed changes

Comment thread .github/workflows/update-changelogs.yml Outdated

cryptodev-2s added 3 commits April 15, 2026 12:33

fix: fetch origin/main for --checkDeps base branch comparison

e8bd7be

Shallow clone with fetch-depth: 1 doesn't include origin/main, causing --checkDeps to fail with "could not resolve base branch".

fix: use full git history and hide previous bot comments

30eec0c

- Use fetch-depth: 0 so git merge-base can find common ancestor with main - Hide previous bot comments on rerun to reduce noise - Add emoji to comment messages for clarity

fix: improve bot comment hiding reliability

b20f53e

- Add --paginate to handle PRs with many comments - Use precise emoji-anchored regex to match only this workflow's comments - Add continue-on-error so comment hiding doesn't block core workflow

cursor Bot reviewed Apr 15, 2026

View reviewed changes

Comment thread .github/workflows/update-changelogs.yml Outdated

feat: use CHANGELOG_UPDATE_TOKEN for git push to trigger CI

29a5a04

Use patroll-managed PAT so commits pushed by this workflow trigger subsequent CI workflows (GITHUB_TOKEN commits don't trigger workflows). Depends on: MetaMask/patroll#75

cursor Bot reviewed Apr 16, 2026

View reviewed changes

Comment thread .github/workflows/update-changelogs.yml Outdated

Address feedback, simplify workflow

f0ea391

github-advanced-security Bot found potential problems Apr 20, 2026

View reviewed changes

Comment thread .github/workflows/update-changelogs.yml Fixed

cursor Bot reviewed Apr 20, 2026

View reviewed changes

Comment thread .github/workflows/update-changelogs.yml Outdated

Comment thread .github/workflows/update-changelogs.yml Outdated

Mrtenz and others added 3 commits April 20, 2026 12:14

Add release check

219277f

Fix RELEASE_COMMIT_PREFIX var

7fc7da9

Potential fix for pull request finding 'CodeQL / Untrusted Checkout T…

d307b94

…OCTOU' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

cursor Bot reviewed Apr 20, 2026

View reviewed changes

Comment thread .github/workflows/update-changelogs.yml

Comment thread .github/workflows/update-changelogs.yml Outdated

Mrtenz added 3 commits April 20, 2026 12:30

Fix PR head SHA logic

34f945b

Fix more PR head SHA logic

3295258

Update is-release step in main workflow

1cf4de8

cursor Bot reviewed Apr 20, 2026

View reviewed changes

Comment thread .github/workflows/update-changelogs.yml Outdated

Mrtenz added 2 commits April 20, 2026 13:24

Separate is-fork again

4f7aeb0

More fixes

ccae16b

github-advanced-security Bot found potential problems Apr 20, 2026

View reviewed changes

Comment thread .github/workflows/update-changelogs.yml Dismissed

Comment thread .github/workflows/update-changelogs.yml Dismissed

Mrtenz reviewed Apr 20, 2026

View reviewed changes

cursor Bot reviewed Apr 20, 2026

View reviewed changes

Comment thread .github/workflows/update-changelogs.yml

mcmire reviewed Apr 20, 2026

View reviewed changes

Provide merge base to auto-changelog

c6e02fe

mcmire approved these changes Apr 21, 2026

View reviewed changes

Mrtenz added this pull request to the merge queue Apr 22, 2026

Merged via the queue into main with commit 5801bc0 Apr 22, 2026
350 checks passed

Mrtenz deleted the feat/auto-changelog-check-deps branch April 22, 2026 14:09

cryptodev-2s mentioned this pull request Sep 2, 2026

ci: run update-changelogs on comment for non-release PRs #10077

Merged

1 of 4 tasks

mcmire mentioned this pull request Sep 29, 2026

Logging bumped internal dependencies for packages included in a release is painful to do manually and is often forgotten MetaMask/create-release-branch#108

Closed

Conversation

cryptodev-2s commented Apr 13, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation

References

Checklist

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mrtenz Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Mrtenz Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

mcmire Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Mrtenz Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Mrtenz Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mcmire left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mcmire Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Mrtenz commented Apr 20, 2026

Uh oh!

mcmire left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

cryptodev-2s commented Apr 13, 2026 •

edited by cursor Bot

Loading