ci: add changelog lint to catch malformed CHANGELOG.md

.github/workflows/ci.yml

@@ -264,6 +264,7 @@ jobs:
         scripts:
           - lint
           - lint:tsc
+          - lint:changelog
           - format:check
           - audit:ci
           - test:depcheck

package.json

@@ -19,6 +19,8 @@
     "lint:fix": "NODE_OPTIONS='--max-old-space-size=12288' eslint '**/*.{js,ts,tsx}' --fix --cache && yarn messenger-action-types:generate",
     "lint:clean": "rm -f .eslintcache",
     "lint:tsc": "NODE_OPTIONS='--max-old-space-size=12288' tsc --project ./tsconfig.json",
+    "lint:changelog": "./scripts/lint-changelog.sh",
+    "lint:changelog:rc": "auto-changelog validate --rc --prettier --repo https://github.com/MetaMask/metamask-mobile",
     "format": "prettier '**/*.{js,ts,tsx,json}' --write",
     "format:check": "prettier '**/*.{js,ts,tsx,json}' --check",
     "format:check:changed": "git diff --name-only --diff-filter=ACM HEAD~1 | { grep -E '\\.(js|ts|tsx|json)$' || true; } | xargs --no-run-if-empty prettier --check",

scripts/lint-changelog.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Validates CHANGELOG.md with @metamask/auto-changelog, mirroring the pattern used
+# by metamask-extension (see .github/workflows/repository-health-checks.yml there).
+#
+# On release-oriented branches, `--rc` is added so validation also enforces that the
+# branch's current package.json version has a corresponding changelog section. This
+# is what should have caught the malformed '### **Before**' header that broke the
+# 8.3.0 -> 8.4.0 release-cut automation before it ever reached CI.
+#
+# Branch shapes treated as release-oriented:
+#   release/X.Y.Z, release/X.Y.Z-ota   (release branches, incl. OTA hotfixes)
+#   release-changelog/X.Y.Z[...]       (the changelog-generation working branch)
+#
+# package.json has no "repository" field, so --repo is passed explicitly.
+#
+# --prettier tells the validator to expect the changelog in Prettier-formatted
+# Markdown (blank line after headings), which matches this repo's existing
+# CHANGELOG.md style. Without it, validation would fail against a stricter,
+# denser canonical form (no blank line after headings) hardcoded in
+# @metamask/auto-changelog's stringifier, which would otherwise force
+# reformatting the entire file's history to pass.
+
+readonly REPO_URL='https://github.com/MetaMask/metamask-mobile'
+
+branch="${GITHUB_HEAD_REF:-}"
+if [[ -z "$branch" ]]; then
+  branch="${GITHUB_REF_NAME:-}"
+fi
+if [[ -z "$branch" ]]; then
+  branch="$(git branch --show-current 2>/dev/null || true)"
+fi
+
+rc_flag=()
+if [[ "$branch" =~ ^release/[0-9]+\.[0-9]+\.[0-9]+(-ota)?$ ]] || [[ "$branch" =~ ^release-changelog/[0-9]+\.[0-9]+\.[0-9]+ ]]; then
+  echo "Branch '${branch}' is release-oriented: validating with --rc"
+  rc_flag=(--rc)
+else
+  echo "Branch '${branch}' is not release-oriented: validating without --rc"
+fi
+
+yarn auto-changelog validate --repo "$REPO_URL" --prettier "${rc_flag[@]+"${rc_flag[@]}"}"