Add CHANGELOG.md modification check and warning comment

.github/actions/post-comment/action.yml

@@ -0,0 +1,41 @@
+name: "Post comment"
+description: "Create or update a sticky PR comment identified by a caller-provided marker."
+inputs:
+  marker:
+    description: >
+      Non-empty plain-text identifier for the comment. Use a unique, stable value
+      for each distinct comment; it is automatically wrapped in a hidden HTML comment.
+    required: true
+  body:
+    description: "Full comment markdown."
+    required: true
+  create-if-missing:
+    description: "Create a comment if no matching marker exists. Set to 'false' to update existing comments only."
+    required: false
+    default: "true"
+  issue-id:
+    description: >
+      The issue or pull request number to post/update the comment on.
+      Defaults to the current pull request if not provided.
+    required: false
+  token:
+    description: "The GitHub token to authenticate with."
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Post comment
+      shell: bash
+      env:
+        BODY: ${{ inputs.body }}
+        MARKER: ${{ inputs.marker }}
+        CREATE_IF_MISSING: ${{ inputs.create-if-missing == 'true' && '--create-if-missing' || '' }}
+        GH_TOKEN: ${{ inputs.token }}
+        ISSUE_ID: ${{ inputs.issue-id || github.event.pull_request.number }}
+      run: |
+        npx tsx ./pr-checks/post-comment.ts \
+          --body "$BODY" \
+          --marker "$MARKER" \
+          $CREATE_IF_MISSING \
+          --issue-id "$ISSUE_ID" \
+          --repository "$GITHUB_REPOSITORY"

.github/workflows/pr-checks.yml

@@ -92,6 +92,8 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    outputs:
+      changelog-modified: ${{ steps.changelog-check.outputs.modified }}
 
     concurrency:
       cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
@@ -181,6 +183,20 @@ jobs:
           path: ${{ runner.temp }}/repo-size/
           if-no-files-found: error
 
+      - name: Check for CHANGELOG.md changes
+        id: changelog-check
+        if: steps.fetch-base.outcome == 'success'
+        env:
+          BASE_SHA: ${{ steps.fetch-base.outputs.merge_base }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          if ! git diff --exit-code --quiet "$BASE_SHA" "$HEAD_SHA" -- CHANGELOG.md; then
+            echo "CHANGELOG.md was modified in this PR."
+            echo "modified=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "modified=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: "Backport: Check out base ref"
         id: checkout-base
         if: ${{ startsWith(github.head_ref, 'backport-') }}
@@ -201,8 +217,8 @@ jobs:
             exit 1
           fi
 
-  post-repo-size-comment:
-    name: Post repo size comment
+  post-pr-comments:
+    name: Post PR comments
     needs: other-checks
     # Keep write permissions isolated from the job that checks out and tests PR code. This job only
     # posts the candidate comment body produced by the read-only `pr-checks` job.
@@ -222,6 +238,22 @@ jobs:
       group: check-repo-size-${{ github.event.pull_request.number }}
 
     steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Check out main, not the PR's head, since this job runs with
+          # `pull-requests: write` permissions and must not execute untrusted code from the PR.
+          ref: main
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci --workspace=pr-checks
+
       - name: Download repo size comment
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -251,3 +283,42 @@ jobs:
           else
             echo "Skipping repo size comment because the delta is below the threshold and no sticky comment exists."
           fi
+
+      - name: Post a warning about modifying CHANGELOG.md
+        # Release, backport, mergeback, and bundle-update PRs deliberately modify CHANGELOG.md,
+        # so skip comment management entirely for these automation flows.
+        if: >-
+          needs.other-checks.outputs.changelog-modified == 'true' &&
+          !startsWith(github.event.pull_request.head.ref, 'update-v') &&
+          !startsWith(github.event.pull_request.head.ref, 'backport-v') &&
+          !startsWith(github.event.pull_request.head.ref, 'mergeback/') &&
+          !startsWith(github.event.pull_request.head.ref, 'update-bundle/')
+        uses: ./.github/actions/post-comment
+        with:
+          marker: "post-comment:CHANGELOG.md"
+          body: |
+            ⚠️ `CHANGELOG.md` has been modified in this PR. Please do not modify `CHANGELOG.md` directly.
+            Instead, create a change-note file in `unreleased-change-notes/`. The `CHANGELOG.md`
+            file will be automatically generated from those change-notes.
+            See [`unreleased-change-notes/README.md`](https://github.com/github/codeql-action/blob/main/unreleased-change-notes/README.md) for more information.
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Mark the CHANGELOG.md concern as resolved
+        if: >-
+          needs.other-checks.outputs.changelog-modified != 'true' &&
+          !startsWith(github.event.pull_request.head.ref, 'update-v') &&
+          !startsWith(github.event.pull_request.head.ref, 'backport-v') &&
+          !startsWith(github.event.pull_request.head.ref, 'mergeback/') &&
+          !startsWith(github.event.pull_request.head.ref, 'update-bundle/')
+        uses: ./.github/actions/post-comment
+        with:
+          marker: "post-comment:CHANGELOG.md"
+          create-if-missing: "false"
+          body: |
+            ⚠️ `CHANGELOG.md` has been modified in this PR. Please do not modify `CHANGELOG.md` directly.
+            Instead, create a change-note file in `unreleased-change-notes/`. The `CHANGELOG.md`
+            file will be automatically generated from those change-notes.
+            See [`unreleased-change-notes/README.md`](https://github.com/github/codeql-action/blob/main/unreleased-change-notes/README.md) for more information.
+
+            **Edit:** `CHANGELOG.md` is no longer modified in this PR. This concern is resolved.
+          token: ${{ secrets.GITHUB_TOKEN }}

pr-checks/api-client.ts

@@ -8,3 +8,14 @@ export function getApiClient(token: string): ApiClient {
   const opts = githubUtils.getOctokitOptions(token);
   return new githubUtils.GitHub(opts);
 }
+
+/** Resolves the GitHub API token to use, from `GH_TOKEN` or `GITHUB_TOKEN`. */
+export function resolveToken(env: NodeJS.ProcessEnv): string {
+  const token = env.GH_TOKEN?.trim() || env.GITHUB_TOKEN?.trim();
+  if (!token) {
+    throw new Error(
+      "Missing authentication token. Set GH_TOKEN or GITHUB_TOKEN.",
+    );
+  }
+  return token;
+}