ci: generate artifacthub.io/changes at packaging time

.github/scripts/artifacthub_changes.py

@@ -8,6 +8,11 @@
 
 ArtifactHub expects the annotation to describe only the changes introduced by
 this chart version, so the previous contents are replaced, not appended to.
+
+Run at packaging time, against a checkout of the release tag, and the result is
+never committed: ArtifactHub reads the annotation from the packaged tarball it
+fetches through index.yaml, so CHANGELOG.md stays the single source of truth and
+nothing has to race release-please's force-push of the release branch.
 """
 
 from __future__ import annotations

.github/workflows/release-please.yaml

@@ -18,11 +18,6 @@ jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
-      # The annotation sync below works on a real tree, not through the API.
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
       - uses: googleapis/release-please-action@v5
         id: release
         with:
@@ -38,14 +33,9 @@ jobs:
           # chart-releaser is retired.
           skip-github-release: true
 
-      # release-please renders release notes only as Markdown, so the
-      # artifacthub.io/changes annotation has to be generated separately and
-      # committed onto the release PR before it is merged. Runs on every
-      # invocation: release-please force-pushes its branch whenever it
-      # regenerates the PR, which would otherwise discard the annotation commit.
-      - name: Sync artifacthub.io/changes
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
-          TARGET_BRANCH: main
-        run: .github/scripts/sync-artifacthub-changes.sh
+      # No artifacthub.io/changes step here on purpose. The annotation is
+      # generated from CHANGELOG.md when the chart is packaged, not committed
+      # onto the release PR: a commit here would race release-please's own
+      # force-push of the branch, and it would make hand edits to the annotation
+      # depend on being the last change before the merge. See
+      # .github/scripts/artifacthub_changes.py.

charts/graylog/Chart.yaml

@@ -35,32 +35,12 @@ annotations:
       platforms:
         - linux/amd64
         - linux/arm64
-  # Changelog
+  # Changelog. Left empty on purpose: it is generated from CHANGELOG.md when the
+  # chart is packaged for a release, so the published chart always matches the
+  # release notes. Edit CHANGELOG.md on the release PR to change what ArtifactHub
+  # shows; entries written here are replaced at packaging and never published.
+  # The key itself must stay - packaging fails without it.
   artifacthub.io/changes: |
-    - kind: added
-      description: "add LICENSE"
-      links:
-        - name: "Create LICENSE"
-          url: "https://github.com/Graylog2/graylog-helm/pull/59"
-    - kind: added
-      description: "Support for official MongoDB Kubernetes Operator"
-      links:
-        - name: "Replace bitnami/mongodb dependency"
-          url: "https://github.com/Graylog2/graylog-helm/issues/48"
-        - name: "Use MongoDB Kubernetes Operator"
-          url: "https://github.com/Graylog2/graylog-helm/pull/55"
-    - kind: changed
-      description: "Bump appVersion to '7.0'"
-    - kind: fixed
-      description: "Forwarder ingress TLS condition"
-      links:
-        - name: "fix: forwarder TLS condition"
-          url: "https://github.com/Graylog2/graylog-helm/pull/60"
-    - kind: removed
-      description: "Remove global size preset value"
-      links:
-        - name: "Remove global size preset"
-          url: "https://github.com/Graylog2/graylog-helm/pull/56"
   artifacthub.io/containsSecurityUpdates: "true"
 # This is the chart version.
 version: 1.0.0