fix(release): consolidated CHANGELOG.md misses changesets without @autonomos/app

[aterrylu]

Problem

The consolidated root CHANGELOG.md — which becomes the GitHub Release body via scripts/release-notes.ts — was missing almost every change. The v0.3.0 release showed 1 entry (#208) instead of the ~21 changesets that fed it. nox-0x flagged this on #205 and again on #211; both shipped with it deferred.

Root cause

scripts/sync-changelog.ts promoted a single representative package (packages/app/CHANGELOG.md) into the root changelog, on the assumption that the changesets fixed group makes every package's CHANGELOG identical. It doesn't. The fixed group locks version numbers in lockstep, but @changesets/changelog-github writes each changeset's entry only into the CHANGELOG of the package(s) its frontmatter names. So every server-/dashboard-/core-/cli-only changeset landed in that package's CHANGELOG and was never read.

The smoking gun is still in the tree: root ## [0.2.0] is completely empty — that release's changesets named no @autonomos/app package at all.

flowchart TD
    subgraph CS["changeset version"]
        A["#208 lists @autonomos/app"] --> APP["packages/app/CHANGELOG.md"]
        B["#240 lists @autonomos/server"] --> SRV["packages/server/CHANGELOG.md"]
        C["#242 lists @autonomos/dashboard"] --> DASH["packages/dashboard/CHANGELOG.md"]
    end
    APP -->|"OLD: only source read"| ROOT["root CHANGELOG.md → Release body"]
    SRV -. "OLD: DROPPED" .-> X["(invisible)"]
    DASH -. "OLD: DROPPED" .-> X
    APP -->|"NEW: merge all"| ROOT
    SRV -->|"NEW: merge all"| ROOT
    DASH -->|"NEW: merge all"| ROOT

Loading

Solution

Rewrite sync-changelog.ts to merge every packages/*/CHANGELOG.md, deduplicate by PR (a PR seen in multiple packages collapses to one line, keeping the highest severity), and render one concise line per PR — the title pulled from the squash-merge commit subject (git log -1 --format=%s, trailing (#NNN) stripped), per Terry's preference for terse release bodies.

Output format:

### Minor Changes

- [#240](.../pull/240) `7c2f7f2` — fix(server): stop leaking host CLAUDE_CODE_* env into spawned agents

scripts/release-notes.ts is untouched — it faithfully extracts whatever section this writes; the bug was entirely upstream of it.

Hardening — the bug was itself a silent drop, so the fix is defensive

• Signature-anchored entry detection (- [#NNN] / - [`sha`]) so a multi-paragraph changeset body's prose or sub-bullets can't become phantom entries.
• Per-package contribution logging + a parsed-vs-consumed reconciliation warning that surfaces partial drops (the actual v0.3.0 shape — 1 of 21) in CI output. Empty (--empty) changesets are excluded from the count to avoid false alarms.
• Hard-fail (exit 1) when a release section comes out empty while real changesets were consumed this run — converts the silent drop into a loud CI failure.
• git error handlers now log instead of silently degrading the guardrail.

Testing

• scripts/sync-changelog.test.ts — 21 unit tests (pure functions; injected title-resolver so no git/fs needed). Covers: cross-package merge, multi-package PR dedup, severity tie-break, PR-ascending order, title extraction, phantom-bullet prevention, orphan-bullet skipping, --empty classification, and the full guardDecision matrix.
• Wired into CI: added scripts/*.test.ts to the make check tsx --test glob (Makefile). Test count in CI: 532 → 553.
• Full CI gate run locally (bunx biome check packages/ && make check): green.
• Real-world end-to-end: ran the actual script against fixtures referencing real merge SHAs — old behavior surfaced 1 PR, new surfaces all 4 across app/server/dashboard, with release-notes.ts extracting the section correctly. Verified the phantom-sub-bullet case produces no junk entry.

Why this matters now

This PR's own changeset is scoped to @autonomos/server (a non-app package) — so it's a live dogfood: under the old script it would have been dropped from v0.4.0's release body; under the new one (which main will carry once this merges) it must appear.

Risks & alternatives

• Risk: title resolution depends on the squash-merge convention (enforced on this repo) and a full-history checkout (release.yml / version.yml both use fetch-depth: 0). On a miss, it falls back to the changeset body, then (no description) (with a warning) — never a crash.
• Alternatives considered: generating from git log between tags (loses changeset-curated severity), parsing the changesets bot PR body (fragile, needs network at version time), reading raw .changeset/*.md pre-consumption (loses changelog-github's PR/author resolution). Merging the per-package CHANGELOGs keeps the curated data and needs no network.

🤖 Generated with Claude Code

[nox-0x]

Approving — the fix correctly merges every packages/*/CHANGELOG.md and dedupes by PR, with thoughtful guardrails (signature-anchored bullet detection, parsed-vs-consumed reconciliation, hard-fail on empty section when changesets were consumed). The pure/impure split makes the regression unit-testable, and the 21 tests cover the right paths. sync-changelog.ts runs inside version.yml which already sets fetch-depth: 0, so gitTitle will resolve. The PR's own changeset (@autonomos/server only) is a live dogfood — if the script is broken it would silently drop itself.

Minor follow-ups, not blocking:

• Tests don't exercise the Major severity path. Trivial to add.
• A single PR with multiple changesets of differing severities collapses to the highest one; the lower-severity note is dropped from the release body. Intentional per the dedup-by-PR design (per-package CHANGELOGs keep the full text), but worth a comment in dedupeEntries so a future reader doesn't try to "fix" it.
• The PR description claims release.yml uses fetch-depth: 0; it doesn't. Doesn't matter because release-notes.ts only reads CHANGELOG.md, but the description is slightly off.