[GitHub Actions] Fix empty changelog entries since v3.1.35 - #3800
Merged
Conversation
## Motivation for the change, related issues Every release since v3.1.34 has been published with empty `CHANGELOG.md` sections and "No changelog entries for this release." in the GitHub release body, even though merged PRs exist in every window. Follow-up on #3628. That PR tightened `update-changelog.yml` to an explicit per-job allowlist for least-privilege, granting `contents: write` and `issues: read` but not `pull-requests: read`. `packages/meta/src/changelog.ts` calls `octokit.issues.listForRepo` and filters with `pull.pull_request?.merged_at`. The issues endpoint strips the `pull_request` field when the token lacks `pull-requests` permission, so every PR is dropped and the script writes only the version headline. The v3.1.34 run still had `PullRequests: write` from the default token; v3.1.39's run shows `Contents: write`, `Issues: read`, `Metadata: read` only. ## Implementation details Add `pull-requests: read` to the job-level permissions in `.github/workflows/update-changelog.yml`. Minimum scope the changelog script needs. ## Testing Instructions (or ideally a Blueprint) 1. Trigger the `Release NPM packages` workflow manually (or wait for the Monday cron). 2. Wait for `Update CHANGELOG.md` to complete. 3. Verify the new section in `CHANGELOG.md` contains the merged PRs grouped by section instead of being empty. 4. Verify the GitHub release body posts those same entries instead of "No changelog entries for this release." Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
mho22
marked this pull request as ready for review
June 15, 2026 15:26
adamziel
added
[Type] Enhancement
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation for the change, related issues
Every release since v3.1.34 has been published with empty
CHANGELOG.mdsections and "No changelog entries for this release." in the GitHub release body, even though merged PRs exist in every window.Follow-up on #3628. That PR tightened
update-changelog.ymlto an explicit per-job allowlist for least-privilege, grantingcontents: writeandissues: readbut notpull-requests: read.packages/meta/src/changelog.tscallsoctokit.issues.listForRepoand filters withpull.pull_request?.merged_at. The issues endpoint strips thepull_requestfield when the token lackspull-requestspermission, so every PR is dropped and the script writes only the version headline. The v3.1.34 run still hadPullRequests: writefrom the default token; v3.1.39's run showsContents: write,Issues: read,Metadata: readonly.Implementation details
Add
pull-requests: readto the job-level permissions in.github/workflows/update-changelog.yml. Minimum scope the changelog script needs.Testing Instructions (or ideally a Blueprint)
Release NPM packagesworkflow manually (or wait for the Monday cron).Update CHANGELOG.mdto complete.CHANGELOG.mdcontains the merged PRs grouped by section instead of being empty.