Remove broken changelog generation from release and add AGENTS.md

.github/workflows/release.yaml

@@ -6,8 +6,7 @@ on:
       - "*.*.*"
 
 permissions:
-  # Needed by the update_changelog job to git-push CHANGELOG.md back to main.
-  contents: write
+  contents: read
   # Required by google-github-actions/auth for workload identity federation.
   id-token: write
 
@@ -189,35 +188,3 @@ jobs:
             echo "- \`${IMG_US_PROD}:v${TAG}-python39\`"
             echo "- \`${IMG_US_PROD}:v${TAG}-slim\`"
           } >> "$GITHUB_STEP_SUMMARY"
-
-  update_changelog:
-    name: Update Changelog
-    runs-on: ubuntu-latest
-    needs: build
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: main
-
-      - uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: "3.3"
-
-      - name: Install changelog generator
-        run: gem install github_changelog_generator
-
-      - name: Update CHANGELOG.md
-        env:
-          CHANGELOG_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          github_changelog_generator -u Scalr -p runner --output CHANGELOG.md
-          git add CHANGELOG.md
-          if [ ! -n "$(git status -s)" ]; then
-            echo "NOTHING TO COMMIT"
-          else
-            git config user.name "${GITHUB_ACTOR}"
-            git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
-            git commit -m "Update CHANGELOG.md"
-            git push --no-verify
-          fi

AGENTS.md

@@ -0,0 +1,37 @@
+# runner
+
+`scalr/runner` runs Terraform and OpenTofu tasks, including tasks in the self-hosted Scalr agent. Docker Hub variants: `full`, `python39`, `slim`.
+
+## Changelog
+
+Update [CHANGELOG.md](CHANGELOG.md) during development for changes that affect image users:
+
+- Include changes to the base image, Python, CLI tools, system packages, variants, tags, runtime behavior, and bundled software security.
+- Skip CI, registry mirrors, repository tools, documentation, and refactors that leave the image unchanged.
+
+Describe the effect on users.
+
+### Format
+
+- Add entries to the top release section. If its git tag exists, start the next version.
+- Heading: `## [X.Y.Z](https://github.com/Scalr/runner/tree/X.Y.Z) (Unreleased)`.
+- End each section with a compare link: `[Full Changelog](https://github.com/Scalr/runner/compare/<previous>...X.Y.Z)`.
+- Use sections in this order: `Added`, `Changed`, `Deprecated`, `Removed`, `Fixed`, `Security`. Omit empty sections.
+- Show upgrades as `old → new`. Keep upstream version prefixes, such as `v1.37.1`.
+- List CLI upgrades under `Updated CLI tools to latest versions:` as nested bullets.
+- Include the image reference and pinned snapshot digest for base image changes.
+- For patched or custom-built dependencies, name what was patched and the patched versions.
+
+## Release
+
+The git tag sets the version. Use `X.Y.Z` without a `v` prefix.
+
+1. Merge release changes into `main`. Add required changelog entries under `(Unreleased)`.
+2. Open a PR to replace `Unreleased` with today's date (`YYYY-MM-DD`). Check that the heading and compare link match the release version.
+3. After the PR merges, tag its merge commit on `main` and push the tag: `git tag X.Y.Z <merge-commit>` and `git push origin X.Y.Z`.
+
+The tag runs [release.yaml](.github/workflows/release.yaml) to publish all variants to Docker Hub and GAR mirrors. GAR also gets `v`-prefixed aliases.
+
+## Markdown Style
+
+Write in [Simplified Technical English](https://www.asd-ste100.org/) (ASD-STE100). Use short sentences, simple words, active voice and one meaning for each word.

CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog
 
-## [0.6.0](https://github.com/Scalr/runner/tree/0.6.0) (Unreleased)
+## [0.6.0](https://github.com/Scalr/runner/tree/0.6.0) (2026-10-08)
 
 ### Changed
 - Updated Python: 3.14.6 → 3.14.8

bump-versions.py

@@ -21,8 +21,8 @@
 import sys
 import urllib.error
 import urllib.request
+from collections.abc import Callable
 from pathlib import Path
-from typing import Callable
 
 VERSIONS_FILE = Path("versions.json")
 README_FILE = Path("README.md")
@@ -111,7 +111,9 @@ def read_versions(section: str = SECTION_DEFAULT) -> dict[str, str]:
 def write_value(key: str, value: str, section: str = SECTION_DEFAULT) -> None:
     """Update or append KEY in the given top-level variable and rewrite the file."""
     data = _load()
-    data.setdefault("variable", {}).setdefault(section, {}).setdefault("default", {})[key] = value
+    data.setdefault("variable", {}).setdefault(section, {}).setdefault("default", {})[
+        key
+    ] = value
     _dump(data)
 
 
@@ -279,7 +281,9 @@ def refresh_kubectl_shas(version: str) -> None:
     )
 
 
-def refresh_python_shas(version: str, release: str, section: str = SECTION_DEFAULT) -> None:
+def refresh_python_shas(
+    version: str, release: str, section: str = SECTION_DEFAULT
+) -> None:
     sums = (
         "https://github.com/astral-sh/python-build-standalone/releases/download/"
         f"{release}/SHA256SUMS"
@@ -475,7 +479,9 @@ def main() -> int:
     cur_r39 = vs39.get("PYTHON_RELEASE", "")
     lat_v39, lat_r39 = get_latest_python39_info()
     if not (lat_v39 and lat_r39):
-        log.warning("python39: no 3.9 build found in recent python-build-standalone releases; skipping")
+        log.warning(
+            "python39: no 3.9 build found in recent python-build-standalone releases; skipping"
+        )
     else:
         py39_changed = False
         if cur_v39 != lat_v39: