gha: enforce CHANGELOG.md entries for PRs

Each release requires going through the list of PRs and trying to parse
out what a reasonable changelog entry is (possibly ~6 months after the
patch was last discussed and merged), which makes preparing release
notes quite time-consuming.

Given that the moment when the patch is merged is when the information
about the imapct of a patch is most apparent to the author and
reviewers, it seems prudent to require that every PR have a CHANGELOG.md
change. Trivial patches can just add a dummy entry in the changelog (in
future, we can expand this script to skip over commits that have some
special tag to avoid the need for dummy entries).

Signed-off-by: Aleksa Sarai <[email protected]>

Author: cyphar

.github/workflows/changelog.yml

@@ -0,0 +1,24 @@
+name: changelog
+on:
+  pull_request:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        fetch-depth: 0
+    - name: git fetch ${{ github.ref }}
+      run: |-
+        git fetch origin ${{ github.ref }}
+        git tag GITHUB_REF FETCH_HEAD
+    - name: git fetch ${{ github.base_ref }}
+      run: |-
+        git fetch origin ${{ github.base_ref }}
+        git tag GITHUB_BASE_REF FETCH_HEAD
+    - name: check that CHANGELOG.md has an entry
+      run: >-
+        git diff --name-only GITHUB_BASE_REF...GITHUB_REF         \
+          | grep CHANGELOG.md                                     \
+          || { echo "Every PR must have a CHANGELOG.md change."; exit 1; }