protect-released-changelog.yml

# This action against that any PR targeting the main branch touches released
# sections in CHANGELOG file. If change to released CHANGELOG is required, like
# doing a release, add the \"Unlock Released Changelog\" label to disable this action.

name: Protect released changelog

on:
  pull_request:
    types: [opened, synchronize, reopened, labeled, unlabeled]
    branches:
      - main
jobs:
  protect-released-changelog:
    runs-on: ubuntu-latest
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'Unlock Released Changelog')}}

    steps:
      - uses: actions/checkout@v4

      - name: Check the released changelog
        run: |
          FILE="CHANGELOG.md"
          TEMP_DIR=$(mktemp -d)
          echo "Temp folder: $TEMP_DIR"

          # Only the latest commit of the feature branch is available
          # automatically. To diff with the base branch, we need to
          # fetch that too (and we only need its latest commit).
          git fetch origin ${{ github.base_ref }} --depth=1
          
          # Checkout the previous version on the base branch of the changelog to tmpfolder
          git --work-tree="$TEMP_DIR" checkout FETCH_HEAD $FILE
          
          PREVIOUS_FILE="$TEMP_DIR/$FILE"
          CURRENT_FILE="$FILE"
          PREVIOUS_LOCKED_FILE="$TEMP_DIR/previous_locked_section.md"
          CURRENT_LOCKED_FILE="$TEMP_DIR/current_locked_section.md"
          
          # Extract sections excluding '## [Unreleased]' from the previous version
          awk '/^## \[Unreleased\]/ {flag=0} /^## \[/ && !/^## \[Unreleased\]/ {flag=1} /^\<!-- Reference link --\>/ {flag=0} flag' "$PREVIOUS_FILE" > "$PREVIOUS_LOCKED_FILE"
          
          # Extract sections excluding '## [Unreleased]' from the current version
          awk '/^## \[Unreleased\]/ {flag=0} /^## \[/ && !/^## \[Unreleased\]/ {flag=1} /^\<!-- Reference link --\>/ {flag=0} flag' "$CURRENT_FILE" > "$CURRENT_LOCKED_FILE"
          
          # Compare the unchanged sections
          if ! diff -q "$PREVIOUS_LOCKED_FILE" "$CURRENT_LOCKED_FILE"; then
            echo "Error: The released sections of the changelog file have been modified."
            diff "$PREVIOUS_LOCKED_FILE" "$CURRENT_LOCKED_FILE"
            rm -rf "$TEMP_DIR"
            false
          fi
          
          rm -rf "$TEMP_DIR"
          echo "The released sections remain unchanged."