changeset-check.yml

name: Changeset check

on:
  pull_request:
    branches: [develop, develop-auto]
    types: [opened, synchronize, reopened]

jobs:
  check-changeset:
    runs-on: ubuntu-latest
    # Dependabot PRs are pure dependency bumps that don't produce
    # user-facing changelog entries; requiring an empty changeset on
    # every weekly batch is friction-only. The full lint / typecheck /
    # test / build / docker-build / audit gate stack still runs on every
    # Dependabot PR, so behaviour and security regressions are caught
    # downstream. Tracked in #402.
    #
    # `github.event.pull_request.user.login` (PR author) instead of
    # `github.actor` (last pusher) — otherwise a maintainer running
    # `gh pr update-branch` to sync a Dependabot PR with develop
    # reverts the actor to themselves and re-arms this gate.
    if: github.event.pull_request.user.login != 'dependabot[bot]'
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - uses: oven-sh/setup-bun@v2

      - run: bun install --frozen-lockfile

      - name: Check for changeset
        run: |
          # Get list of changeset files added in this PR
          CHANGESETS=$(git diff --name-only origin/develop...HEAD -- '.changeset/*.md' | grep -v README.md || true)

          if [ -z "$CHANGESETS" ]; then
            echo "::error::This PR is missing a changeset. Run 'bun changeset' to create one."
            echo ""
            echo "If this change does not need a version bump (e.g., CI config, docs), add an empty changeset:"
            echo "  bun changeset --empty"
            exit 1
          fi

          echo "Changeset found: $CHANGESETS"