name: Changelog Guard

# Repo-specific PR check (in addition to the reusable ci.yaml). Enforces that
# CHANGELOG.md drives versioning correctly: a changelog edit must be a clean
# SemVer bump above the latest tag, and the in-package copy must stay in sync.
on:
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  guard:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          fetch-tags: true

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Validate CHANGELOG + version bump
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
          if git diff --name-only "$BASE_SHA" HEAD | grep -qx 'CHANGELOG.md'; then
            CHANGELOG_CHANGED=true
          else
            CHANGELOG_CHANGED=false
          fi
          PREV_TAG=$(git tag -l 'v*' --sort=-v:refname | head -1)
          echo "CHANGELOG changed in PR: $CHANGELOG_CHANGED | latest tag: ${PREV_TAG:-none}"
          CHANGELOG_CHANGED="$CHANGELOG_CHANGED" PREV_TAG="$PREV_TAG" \
            python scripts/check_changelog.py