Move changelog generation automation to server repo (#38113)

Automatic Merge

.github/workflows/generate-changelog.yml

@@ -0,0 +1,130 @@
+name: Generate Changelog
+
+on:
+  workflow_dispatch:
+    inputs:
+      milestone:
+        description: 'Milestone title in the server repo (e.g. v11.9.0)'
+        required: true
+        type: string
+      version:
+        description: 'Version label for changelog entry (e.g. v11.9.0)'
+        required: true
+        type: string
+      server_repos:
+        description: 'Comma-separated repos to pull PRs from'
+        required: true
+        default: 'mattermost/mattermost,mattermost/enterprise'
+        type: string
+      release_type:
+        description: 'Release type: "feature" (default) or "esr" (Extended Support Release)'
+        required: false
+        default: 'feature'
+        type: choice
+        options:
+          - feature
+          - esr
+      release_date:
+        description: 'Release day date (e.g. 2026-07-16) — defaults to today if omitted'
+        required: false
+        type: string
+      go_version:
+        description: 'Go version used in this release (e.g. go1.26.4) — if omitted, the previous version is read from the changelog and reused'
+        required: false
+        type: string
+      blog_post_url:
+        description: 'Blog post URL for the Improvements section — if omitted, auto-constructed from version (e.g. https://mattermost.com/blog/mattermost-v11-9-is-now-available/)'
+        required: false
+        type: string
+
+jobs:
+  generate-changelog:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+
+    steps:
+      # App 1: Read-only access to mattermost/mattermost and mattermost/enterprise.
+      # Used by the Python script to fetch merged PRs and their release notes.
+      # The built-in GITHUB_TOKEN is not sufficient because mattermost/enterprise
+      # is a separate private repository.
+      # Credentials needed in Settings → Secrets and variables → Actions:
+      #   CHANGELOG_READ_CLIENT_ID   (variable)  — Client ID from the mattermost+enterprise GitHub App
+      #   CHANGELOG_READ_PRIVATE_KEY (secret)    — Private key from the mattermost+enterprise GitHub App
+      - name: Get read token (source repos)
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        id: readToken
+        with:
+          client-id: ${{ vars.CHANGELOG_READ_CLIENT_ID }}
+          private-key: ${{ secrets.CHANGELOG_READ_PRIVATE_KEY }}
+          owner: mattermost
+
+      # App 2: Read/write access to this repo (mattermost/mattermost).
+      # Used to check out the repo, push the changelog branch, and open the PR.
+      # NOTE: the built-in GITHUB_TOKEN could technically do this now that the changelog
+      # lives in this repo, but PRs opened with GITHUB_TOKEN do not trigger other
+      # workflows — so CI would not run on the generated changelog PR. Using a GitHub
+      # App token keeps CI working and preserves the bot identity used for the CLA
+      # exemption.
+      # Credentials needed in Settings → Secrets and variables → Actions:
+      #   CHANGELOG_WRITE_CLIENT_ID   (variable) — Client ID from the write GitHub App
+      #   CHANGELOG_WRITE_PRIVATE_KEY (secret)   — Private key from the write GitHub App
+      - name: Get write token (this repo)
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        id: writeToken
+        with:
+          client-id: ${{ vars.CHANGELOG_WRITE_CLIENT_ID }}
+          private-key: ${{ secrets.CHANGELOG_WRITE_PRIVATE_KEY }}
+          owner: mattermost
+
+      - name: Checkout repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          token: ${{ steps.writeToken.outputs.token }}
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.11'
+
+      - name: Install dependencies
+        run: pip install requests anthropic
+
+      - name: Generate changelog
+        env:
+          GITHUB_TOKEN: ${{ steps.readToken.outputs.token }} # Read-only token for fetching PRs from source repos
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} # Enables AI categorization and formatting — add under Settings → Secrets and variables → Actions
+          MILESTONE: ${{ inputs.milestone }}
+          VERSION: ${{ inputs.version }}
+          REPOS: ${{ inputs.server_repos }}
+          RELEASE_TYPE: ${{ inputs.release_type }}
+          RELEASE_DATE: ${{ inputs.release_date }}
+          GO_VERSION: ${{ inputs.go_version }}
+          BLOG_POST_URL: ${{ inputs.blog_post_url }}
+          CHANGELOG_PATH: docs/main/product-overview/mattermost-v11-changelog.mdx
+        run: python .github/scripts/generate_changelog.py
+
+      - name: Create Pull Request
+        env:
+          GH_TOKEN: ${{ steps.writeToken.outputs.token }}
+          VERSION: ${{ inputs.version }}
+          MILESTONE: ${{ inputs.milestone }}
+          SERVER_REPOS: ${{ inputs.server_repos }}
+          COMMIT_USER_NAME: ${{ vars.CHANGELOG_GIT_USERNAME }}
+          COMMIT_USER_EMAIL: ${{ vars.CHANGELOG_GIT_EMAIL }}
+          CHANGELOG_FILE: docs/main/product-overview/mattermost-v11-changelog.mdx
+        run: |
+          git config user.name "$COMMIT_USER_NAME"
+          git config user.email "$COMMIT_USER_EMAIL"
+          git checkout -b "changelog/$VERSION"
+          git add "$CHANGELOG_FILE"
+          git diff --staged --quiet && echo "No changes to commit" && exit 0
+          git commit -m "docs: add changelog for $VERSION"
+          git push origin "changelog/$VERSION" --force
+          gh pr create \
+            --repo mattermost/mattermost \
+            --title "$VERSION Changelog" \
+            --body "Auto-generated changelog for milestone \`$MILESTONE\` from \`$SERVER_REPOS\`." \
+            --base master \
+            --head "changelog/$VERSION"