chore: downgrade broken changelog maker, backfill entries #6

	# Copy into .github/workflows/ of the repo you want reviewed. One workflow,
	# two jobs: review computes with a read-only token, post holds the write
	# scopes. The README explains the security model.
	#
	# pull_request_target runs the base branch's workflow definition and action
	# pin (a PR cannot modify what executes here), and its token can post the
	# comment, including on Dependabot and fork PRs whose own token is read-only.
	# It is safe here because no PR code is ever checked out or executed: the
	# review job reads the PR's manifest bytes as git objects, and depsound's
	# parsers treat all of it as hostile data.
	name: depsound
	on:
	pull_request_target:

	permissions: {} # scopes are granted per job below

	jobs:
	review:
	runs-on: ubuntu-latest
	permissions:
	contents: read # diff the PR's manifests; this job never sees a write token
	steps:
	- uses: rvagg/depsound-action@ca2026afd4d1fd614f990784867e09da10b6faa8 # v0.3.0
	post:
	needs: review
	if: ${{ always() && needs.review.result != 'cancelled' }} # a failed review still posts its failure marker
	runs-on: ubuntu-latest
	permissions:
	pull-requests: write # upsert the sticky comment
	checks: write # set the neutral check
	actions: read # download the report artifact
	steps:
	- uses: rvagg/depsound-action/post@ca2026afd4d1fd614f990784867e09da10b6faa8 # v0.3.0

Navigation Menu