feat: add require-pr-numbers flag for changelog generation #181

Qbandev · 2025-12-03T11:48:10Z

What is the current state of things and why does it need to change?

Currently, auto-changelog includes all commits in the changelog regardless of whether they went through a PR review process. Direct commits without PR numbers should be excluded to ensure all changelog entries represent reviewed and approved changes.

Additionally, the changelog generation was inconsistent between platforms (extension vs mobile), using different tool versions and flags.

What is the solution your changes offer and how does it work?

This PR standardizes changelog generation for both platforms:

Always uses --requirePrNumbers - Filters out direct commits without PR numbers by default
Standardizes to @metamask/auto-changelog@5.3.0 - Both platforms use the same version with consistent flags

Changes:

File	Change
`update-release-changelog.sh`	Always use `--requirePrNumbers` flag
`create-platform-release-pr.sh`	Always use `--requirePrNumbers` flag
`package.json` / `yarn.lock`	Updated to `@metamask/auto-changelog@^5.3.0`

Simplified command (used for both platforms):

yarn auto-changelog update --rc \
    --repo "${GITHUB_REPOSITORY_URL}" \
    --currentVersion "${VERSION}" \
    --autoCategorize \
    --useChangelogEntry \
    --useShortPrLink \
    --requirePrNumbers

Pull request overview

This PR adds a new require-pr-numbers flag to changelog generation actions, enabling filtering of commits without PR numbers to ensure all changelog entries represent reviewed changes. This is important for projects following strict PR-based workflows where direct commits should be excluded from changelogs.

Key changes:

Added require-pr-numbers input parameter (default: false) to both update-release-changelog and create-release-pr actions
Modified shell scripts to conditionally add --requirePrNumbers flag when enabled
Added merge logic in checkout_or_create_branch() to sync changelog branch with release branch updates

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

File	Description
`.github/actions/update-release-changelog/action.yml`	Added `require-pr-numbers` input and passed it to the shell script
`.github/actions/create-release-pr/action.yml`	Added `require-pr-numbers` input and passed it to the shell script
`.github/scripts/update-release-changelog.sh`	Added parameter handling, conditional flag addition, and new merge logic in `checkout_or_create_branch()`
`.github/scripts/create-platform-release-pr.sh`	Added parameter handling and conditional flag addition for changelog generation

Comments suppressed due to low confidence (2)

.github/scripts/update-release-changelog.sh:226

Using eval with a dynamically constructed command string poses a security risk if any of the variables contain special characters or malicious input. While GITHUB_REPOSITORY_URL and VERSION are likely controlled, this pattern is generally discouraged.

Consider using an array to build the command and execute it directly:

CHANGELOG_CMD=(yarn auto-changelog update --rc --repo "${GITHUB_REPOSITORY_URL}" --currentVersion "${VERSION}" --autoCategorize --useChangelogEntry --useShortPrLink)

if [[ "${REQUIRE_PR_NUMBERS}" == "true" ]]; then
    CHANGELOG_CMD+=(--requirePrNumbers)
fi

"${CHANGELOG_CMD[@]}"

This approach is safer and more maintainable.

    CHANGELOG_CMD="yarn auto-changelog update --rc --repo \"${GITHUB_REPOSITORY_URL}\" --currentVersion \"${VERSION}\" --autoCategorize --useChangelogEntry --useShortPrLink"

    # Add --requirePrNumbers flag if enabled
    if [[ "${REQUIRE_PR_NUMBERS}" == "true" ]]; then
        CHANGELOG_CMD="${CHANGELOG_CMD} --requirePrNumbers"
    fi

    eval "${CHANGELOG_CMD}"

.github/scripts/create-platform-release-pr.sh:362

Using eval with a dynamically constructed command string poses a security risk if any of the variables contain special characters or malicious input. While the variables are likely controlled in this context, this pattern is generally discouraged.

Consider using an array to build the command and execute it directly:

CHANGELOG_CMD=(yarn auto-changelog update --rc --repo "${GITHUB_REPOSITORY_URL}" --currentVersion "${new_version}" --autoCategorize --useChangelogEntry --useShortPrLink)

if [[ "${REQUIRE_PR_NUMBERS}" == "true" ]]; then
    CHANGELOG_CMD+=(--requirePrNumbers)
fi

"${CHANGELOG_CMD[@]}"

This approach is safer and more maintainable.

    CHANGELOG_CMD="yarn auto-changelog update --rc --repo \"${GITHUB_REPOSITORY_URL}\" --currentVersion \"${new_version}\" --autoCategorize --useChangelogEntry --useShortPrLink"

    # Add --requirePrNumbers flag if enabled
    if [[ "${REQUIRE_PR_NUMBERS}" == "true" ]]; then
        CHANGELOG_CMD="${CHANGELOG_CMD} --requirePrNumbers"
    fi

    eval "${CHANGELOG_CMD}"

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

.github/scripts/update-release-changelog.sh

.github/scripts/create-platform-release-pr.sh

.github/scripts/update-release-changelog.sh

.github/scripts/create-platform-release-pr.sh

- Replace eval with direct command execution for security - Add platform-specific logic to create-platform-release-pr.sh (extension uses yarn, mobile uses npx with pinned version) - Clarify documentation that require_pr_numbers is ignored for mobile - Add detailed comment explaining merge logic rationale in update-release-changelog.sh (intentionally different from create-platform-release-pr.sh)

Update to use the published version with --requirePrNumbers support.

socket-security · 2025-12-03T13:58:01Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@metamask/auto-changelog@5.2.0 ⏵ 5.3.0	⁺¹		⁺¹	⁺²

View full report

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

.github/scripts/update-release-changelog.sh

- Fix typo: 'heckout_or_create_branch' -> 'checkout_or_create_branch' - Improve merge conflict handling: reset to HEAD (pre-merge state) instead of release branch to preserve existing changelog content - Add clearer logging for merge conflict scenario Note: Code duplication suggestion skipped (nitpick, over-engineering)

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Consolidate changelog generation for both extension and mobile platforms to use yarn auto-changelog. - Remove redundant merge logic in update-release-changelog.sh to simplify the process. - Ensure consistent handling of the --requirePrNumbers flag across scripts for improved clarity and functionality.

Qbandev · 2025-12-03T14:53:08Z

bugbot run

.github/scripts/update-release-changelog.sh

- Fix bug: ${new_version} -> ${VERSION} in update-release-changelog.sh - Add trailing newline to package.json for Prettier compliance

Qbandev · 2025-12-03T15:02:04Z

bugbot run

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

.github/scripts/update-release-changelog.sh

Standardize changelog generation for both platforms. The require-pr-numbers flag can now be used for both extension and mobile, though it's currently only enabled for extension.

Qbandev · 2025-12-03T15:13:00Z

bugbot run

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

cursor

✅ Bugbot reviewed your changes and found no bugs!

gauthierpetetin

I'm tempted to say we don't even need a parameter for it, we can just assume we'll always call yarn auto-changelog update with --requirePrNumbers flag. That should simplify the code.

Qbandev · 2025-12-03T15:30:37Z

I'm tempted to say we don't even need a parameter for it, we can just assume we'll always call yarn auto-changelog update with --requirePrNumbers flag. That should simplify the code.

If @Gudahtt and mobile team agree, no problem from my side.

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Remove conditional require-pr-numbers parameter and always apply the --requirePrNumbers flag to filter out direct commits. This simplifies the code as both extension and mobile teams have agreed to use this behavior by default.

Qbandev · 2025-12-03T17:18:57Z

bugbot run

Copilot

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

cursor

✅ Bugbot reviewed your changes and found no bugs!

## **Description** This PR updates the changelog workflows to use the new `@metamask/auto-changelog@5.3.0` which always filters out direct commits without PR numbers. This ensures all changelog entries represent reviewed and approved changes. **Changes:** - Update `@metamask/auto-changelog` from `^5.1.0` to `^5.3.0` - Update workflows to use `github-tools@v1.1.2` which includes the `--requirePrNumbers` flag enabled by default The `--requirePrNumbers` flag is now always applied by default in github-tools, so no additional configuration is needed. [![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/38520?quickstart=1) ## **Changelog** CHANGELOG entry: null ## **Related issues** - ✅ [MetaMask/auto-changelog#253](MetaMask/auto-changelog#253) - Merged - ✅ [MetaMask/github-tools#181](MetaMask/github-tools#181) - Merged and released as v1.1.2 ## **Manual testing steps** 1. Tested on [consensys-test/metamask-extension-test](https://github.com/consensys-test/metamask-extension-test) with `release/1100.0.0` 2. Verified PR commits are included in changelog 3. Verified direct commits are excluded from changelog 4. See [generated changelog](https://github.com/consensys-test/metamask-extension-test/blob/release/1100.0.0-Changelog/CHANGELOG.md) ## **Screenshots/Recordings** ### **Before** Direct commits without PR numbers would appear in the changelog. ### **After** Only commits with PR numbers (representing reviewed changes) appear in the changelog. ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Extension Coding Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I've included tests if applicable - [x] I've documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [ ] I've applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

## **Description** This PR updates the changelog workflows to use the new `@metamask/auto-changelog@5.3.0` which always filters out direct commits without PR numbers. This ensures all changelog entries represent reviewed and approved changes. **Changes:** - Update `@metamask/auto-changelog` from `^5.1.0` to `^5.3.0` - Update `update-release-changelog` workflow to use `github-tools@v1.1.2` The `--requirePrNumbers` flag is now always applied by default in github-tools, so no additional configuration is needed. This aligns `metamask-mobile` with `metamask-extension` for consistent changelog generation across platforms. ## **Changelog** CHANGELOG entry: null ## **Related issues** - Related to: [MetaMask/metamask-extension#38520](MetaMask/metamask-extension#38520) - ✅ [MetaMask/auto-changelog#253](MetaMask/auto-changelog#253) - Merged (v5.3.0) - ✅ [MetaMask/github-tools#181](MetaMask/github-tools#181) - Merged and released as v1.1.2 ## **Manual testing steps** ```gherkin Feature: Changelog generation with PR number filtering Scenario: Only PR commits appear in changelog Given a release branch exists When a commit with an associated PR is merged Then the changelog should include that commit When a direct commit without PR is pushed Then the changelog should NOT include that commit ``` Tested on [consensys-test/metamask-extension-test](https://github.com/consensys-test/metamask-extension-test) with `release/1100.0.0`: - [Generated changelog](https://github.com/consensys-test/metamask-extension-test/blob/release/1100.0.0-Changelog/CHANGELOG.md) ## **Screenshots/Recordings** ### **Before** Direct commits without PR numbers would appear in the changelog. ### **After** Only commits with PR numbers (representing reviewed changes) appear in the changelog. ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I've included tests if applicable - [x] I've documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [ ] I've applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

This PR updates the changelog workflows to use the new `@metamask/auto-changelog@5.3.0` which always filters out direct commits without PR numbers. This ensures all changelog entries represent reviewed and approved changes. **Changes:** - Update `@metamask/auto-changelog` from `^5.1.0` to `^5.3.0` - Update `update-release-changelog` workflow to use `github-tools@v1.1.2` The `--requirePrNumbers` flag is now always applied by default in github-tools, so no additional configuration is needed. This aligns `metamask-mobile` with `metamask-extension` for consistent changelog generation across platforms. CHANGELOG entry: null - Related to: [MetaMask/metamask-extension#38520](MetaMask/metamask-extension#38520) - ✅ [MetaMask/auto-changelog#253](MetaMask/auto-changelog#253) - Merged (v5.3.0) - ✅ [MetaMask/github-tools#181](MetaMask/github-tools#181) - Merged and released as v1.1.2 ```gherkin Feature: Changelog generation with PR number filtering Scenario: Only PR commits appear in changelog Given a release branch exists When a commit with an associated PR is merged Then the changelog should include that commit When a direct commit without PR is pushed Then the changelog should NOT include that commit ``` Tested on [consensys-test/metamask-extension-test](https://github.com/consensys-test/metamask-extension-test) with `release/1100.0.0`: - [Generated changelog](https://github.com/consensys-test/metamask-extension-test/blob/release/1100.0.0-Changelog/CHANGELOG.md) Direct commits without PR numbers would appear in the changelog. Only commits with PR numbers (representing reviewed changes) appear in the changelog. - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I've included tests if applicable - [x] I've documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [ ] I've applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Qbandev requested review from Mrtenz, XxdpavelxX and Copilot and removed request for XxdpavelxX and Copilot December 3, 2025 13:16

Copilot started reviewing on behalf of Qbandev December 3, 2025 13:17 View session

Copilot finished reviewing on behalf of Qbandev December 3, 2025 13:19

Copilot AI reviewed Dec 3, 2025

View reviewed changes

Qbandev mentioned this pull request Dec 3, 2025

feat: enable require-pr-numbers flag for changelog generation MetaMask/metamask-extension#38520

Merged

7 tasks

Qbandev added 2 commits December 3, 2025 14:47

chore: update @metamask/auto-changelog to ^5.3.0

f4175ef

Update to use the published version with --requirePrNumbers support.

Qbandev requested a review from Copilot December 3, 2025 13:58

Copilot started reviewing on behalf of Qbandev December 3, 2025 13:58 View session

Copilot finished reviewing on behalf of Qbandev December 3, 2025 14:00

Copilot AI reviewed Dec 3, 2025

View reviewed changes

.github/scripts/update-release-changelog.sh Outdated Show resolved Hide resolved

.github/scripts/update-release-changelog.sh Outdated Show resolved Hide resolved

.github/scripts/update-release-changelog.sh Outdated Show resolved Hide resolved

Qbandev requested a review from Copilot December 3, 2025 14:30

Copilot started reviewing on behalf of Qbandev December 3, 2025 14:31 View session

Copilot finished reviewing on behalf of Qbandev December 3, 2025 14:33

Copilot AI reviewed Dec 3, 2025

View reviewed changes

cursor bot reviewed Dec 3, 2025

View reviewed changes

.github/scripts/update-release-changelog.sh Outdated Show resolved Hide resolved

.github/scripts/update-release-changelog.sh Outdated Show resolved Hide resolved

fix: correct variable name and fix package.json formatting

5d9ebe8

- Fix bug: ${new_version} -> ${VERSION} in update-release-changelog.sh - Add trailing newline to package.json for Prettier compliance

Qbandev requested a review from Copilot December 3, 2025 15:01

Copilot started reviewing on behalf of Qbandev December 3, 2025 15:02 View session

Copilot finished reviewing on behalf of Qbandev December 3, 2025 15:05

Copilot AI reviewed Dec 3, 2025

View reviewed changes

.github/scripts/update-release-changelog.sh Outdated Show resolved Hide resolved

Qbandev added 2 commits December 3, 2025 16:10

docs: remove platform-specific limitation from require_pr_numbers

7d838c7

Standardize changelog generation for both platforms. The require-pr-numbers flag can now be used for both extension and mobile, though it's currently only enabled for extension.

Merge branch 'main' into feat/auto-changelog-flag

65d9798

Qbandev requested a review from Copilot December 3, 2025 15:12

Copilot started reviewing on behalf of Qbandev December 3, 2025 15:13 View session

Copilot finished reviewing on behalf of Qbandev December 3, 2025 15:15

Copilot AI reviewed Dec 3, 2025

View reviewed changes

cursor bot reviewed Dec 3, 2025

View reviewed changes

gauthierpetetin reviewed Dec 3, 2025

View reviewed changes

Qbandev requested a review from Copilot December 3, 2025 15:30

Copilot started reviewing on behalf of Qbandev December 3, 2025 15:31 View session

Copilot finished reviewing on behalf of Qbandev December 3, 2025 15:32

Copilot AI reviewed Dec 3, 2025

View reviewed changes

refactor: always use --requirePrNumbers flag

f284967

Remove conditional require-pr-numbers parameter and always apply the --requirePrNumbers flag to filter out direct commits. This simplifies the code as both extension and mobile teams have agreed to use this behavior by default.

Qbandev requested a review from Copilot December 3, 2025 17:18

Copilot started reviewing on behalf of Qbandev December 3, 2025 17:19 View session

Copilot finished reviewing on behalf of Qbandev December 3, 2025 17:20

Copilot AI reviewed Dec 3, 2025

View reviewed changes

cursor bot reviewed Dec 3, 2025

View reviewed changes

gauthierpetetin approved these changes Dec 3, 2025

View reviewed changes

Qbandev merged commit df43731 into main Dec 3, 2025
27 checks passed

Qbandev deleted the feat/auto-changelog-flag branch December 3, 2025 17:50

Qbandev mentioned this pull request Dec 4, 2025

feat: enable require-pr-numbers flag for changelog generation MetaMask/metamask-mobile#23661

Merged

7 tasks

Uh oh!

feat: add require-pr-numbers flag for changelog generation #181

feat: add require-pr-numbers flag for changelog generation #181

Uh oh!

Conversation

Qbandev commented Dec 3, 2025 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What is the current state of things and why does it need to change?

What is the solution your changes offer and how does it work?

Related Links

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

socket-security bot commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Qbandev commented Dec 3, 2025

Uh oh!

Uh oh!

Uh oh!

Qbandev commented Dec 3, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Qbandev commented Dec 3, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

✅ Bugbot reviewed your changes and found no bugs!

Uh oh!

gauthierpetetin left a comment

Choose a reason for hiding this comment

Uh oh!

Qbandev commented Dec 3, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Qbandev commented Dec 3, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

✅ Bugbot reviewed your changes and found no bugs!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Qbandev commented Dec 3, 2025 •

edited by cursor bot

Loading

socket-security bot commented Dec 3, 2025 •

edited

Loading