ci: fix the changelog automation, adopt git-checkout, normalise org refs - #3
Merged
Conversation
Prepares this repository for required_signatures, which is the last setting keeping branch protection non-uniform across the action repos. Enabling signatures here without this change would break a working automation rather than fix a broken one: a runner has no signing key, so `git commit` produces an unsigned commit, and a PR containing one is blocked outright - GitHub evaluates the PR's commits before a merge strategy is chosen, so --squash does not rescue it. Commits created through GitHub's API are signed with its web-flow key. --rebase becomes --squash for the same reason: GitHub cannot sign a rebase merge. Identical to the change already proven on conventional-validator, release-notes and conventional-changelog, all three of which now complete full unattended cycles. Co-Authored-By: Claude <309050497+MrDClaudeBot@users.noreply.github.com>
Dogfoods the org's own checkout action across all six workflows, leaving no actions/checkout in the set. changelog.yml gains fetch-tags: true as part of the swap. It was safe only because actions/checkout implies tags at fetch-depth 0; git-checkout appends --no-tags regardless of depth. Without the added line this migration would reintroduce the bug that produced a v0.1.0 release notes file on conventional-validator. release.yml already passed fetch-tags explicitly and changes in name only. Co-Authored-By: Claude <309050497+MrDClaudeBot@users.noreply.github.com>
The repositories moved to the lite-actions org but the workflows and README still referenced the previous owner, working only through GitHub's rename redirect. release-notes is now published to the Marketplace under lite-actions, so the canonical names are settled and the redirect is no longer something to build on. Covers the five workflow references plus the README's action and reusable-workflow examples. Co-Authored-By: Claude <309050497+MrDClaudeBot@users.noreply.github.com>
action.yml still credited the previous owner. The author field is shown on the Marketplace listing, matching the change already made to release-notes. The CODEOWNERS entry keeps @mrdoodles - that is a GitHub username, not an owner reference. Co-Authored-By: Claude <309050497+MrDClaudeBot@users.noreply.github.com>
MrDClaudeBot
approved these changes
Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings
rust-releasein line with the other three action repos. Four commits, each self-contained.1. Signed commit + squash
This repo is the last one where
required_signaturesis still off — the only remaining gap in the branch-protection matrix. Enabling it without this change would break a working automation rather than fix a broken one, which is why the ordering is inverted here compared to the other repos.A runner has no signing key, so
git commitproduces an unsigned commit, and a PR containing one is blocked outright — GitHub evaluates the PR's commits before a merge strategy is chosen, so--squashdoesn't rescue it. Switched to GraphQLcreateCommitOnBranch, which GitHub signs with its web-flow key.--rebase→--squashfor the same reason: GitHub cannot sign a rebase merge.Proven on
conventional-validator,release-notesandconventional-changelog, all three now completing full unattended cycles.2.
actions/checkout→lite-actions/git-checkoutAll six workflows.
changelog.ymlgainsfetch-tags: trueas part of the swap — it was safe only becauseactions/checkoutimplies tags atfetch-depth: 0, andgit-checkoutappends--no-tagsregardless of depth. Without it this migration would reintroduce thev0.1.0bug seen onconventional-validator.3–4. Org references
Five workflow references, the README's action and reusable-workflow examples, and
action.yml's author field move frommrdoodles/*tolite-actions/*. These worked only through GitHub's rename redirect; withrelease-notesnow published to the Marketplace underlite-actions, the canonical names are settled.CODEOWNERSkeeps@mrdoodles— that's a username, not an owner reference.After merging
The merge triggers
changelog.yml, which is the test. Its last run was 2026-08-04 and failed withAuto merge is not allowed for this repository— since fixed org-wide, so it hasn't run since.Once a cycle completes,
required_signaturescan be enabled here, making branch protection uniform across all five repos for the first time.🤖 Generated with Claude Code