Changelog

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Audit 0.4.1 · source sha 0448e87653f9 · 14 Oct 2026Report an issue or request a re-scan

• Publisheraaronjmars GitHub organizationOwner of the repository this skill is read from
• Source folderaaronjmars/aeon/skills/changelogThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict0448e87653f9A new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Generate a user-facing changelog from recent commits/PRs across watched repos - write it in-repo (Keep a Changelog format) or open a cross-repo changelog PR on a docs/marketing repo.

---
name: changelog
description: Generate a user-facing changelog from recent commits/PRs across watched repos - write it in-repo (Keep a Changelog format) or open a cross-repo changelog PR on a docs/marketing repo.
metadata:
  title: Changelog
  category: dev
  var: ""
  tags:
    - dev
    - content
    - build
  mode: write
  commits: true
  permissions:
    - contents:write
    - pull-requests:write
  requires:
    - GH_GLOBAL?
---
<!-- autoresearch: variation B — sharper output: Keep a Changelog categories, breaking-change surfacing, plain-English rewrites, noise filtering -->

> **${var}** — Selects the mode and target:
> - **empty** → in-repo changelog across every repo in `memory/watched-repos.md`.
> - **`owner/repo`** (bare slug) → in-repo changelog for that single repo only.
> - **`push-to:owner/website-repo`** → cross-repo mode: publish the product's merged PRs as a changelog PR on `owner/website-repo` (product repo comes from `memory/docs-sync.md`).
> - **`owner/product->owner/website`** (arrow form) → cross-repo mode with both product and website repos given explicitly.

## Why this skill exists

A changelog is not a commit log. Raw commit dumps grouped by conventional prefix are the noise anti-pattern — users can't tell what matters. This skill produces a [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)-style summary: categorized, plain-English, breaking changes surfaced, internal churn filtered out. It runs in two modes: **in-repo** (write the article into this repo) or **push-to** (open a changelog PR on a separate marketing/docs website repo).

---

## 0. Preamble — read memory and parse the selector

Read `memory/MEMORY.md` and the last 3 days of `memory/logs/` for context (prior runs, known issues). Before notifying, drop anything already reported in that window.

Parse `${var}` to pick the branch:

| `${var}` | Branch | Target |
|----------|--------|--------|
| empty | **A — in-repo** | all repos in `memory/watched-repos.md` |
| `owner/repo` (no `push-to:`, no `->`) | **A — in-repo** | only that repo |
| `push-to:owner/website-repo` | **B — push-to** | website = `owner/website-repo`; product = config `product_repo` |
| `owner/product->owner/website` | **B — push-to** | product = `owner/product`; website = `owner/website` |

Disambiguation: a `push-to:` prefix **or** a `->` arrow selects Branch B; anything else (empty or a bare `owner/repo`) selects Branch A. Then jump to the matching branch below.

---

# Branch A — in-repo changelog

Writes a categorized changelog article into this repo. No cross-repo PR; `GH_GLOBAL` is not needed here.

## A.Config

Reads repos from `memory/watched-repos.md`. If the file doesn't exist, abort and notify: "changelog: `memory/watched-repos.md` missing — nothing to scan." Do not create it silently.

```markdown
# memory/watched-repos.md
- owner/repo
- another-owner/another-repo
```

If `${var}` is set to a bare `owner/repo`, scan only that repo (skip the file list).

### A.1. Pick the scan set

- If `${var}` is a bare `owner/repo`, scan only `${var}`.
- Otherwise, read `memory/watched-repos.md` and parse `- owner/repo` lines.
- If the list is empty, notify "changelog: no repos configured" and exit cleanly.

### A.2. Fetch commits and merged PRs per repo

For each repo, isolate failures — one broken repo must not kill the run. Track status in a `sources` dict (`repo → ok|empty|fail`).

Compute `SINCE` as UTC 7 days ago:
```bash
SINCE=$(date -u -d '7 days ago' +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v-7d +%Y-%m-%dT%H:%M:%SZ)
```

Detect the default branch (don't assume `main`):
```bash
BRANCH=$(gh repo view owner/repo --json defaultBranchRef --jq '.defaultBranchRef.name')
```

Fetch commits on the default branch since `SINCE`:
```bash
gh api -X GET "repos/owner/repo/commits" -f sha="$BRANCH" -f since="$SINCE" --paginate \
  --jq '.[] | {sha: .sha, short: .sha[0:7], message: .commit.message, author: (.author.login // .commit.author.name), date: .commit.author.date, url: .html_url}'
```

Also fetch merged PRs in the window — PR titles/bodies are usually cleaner than raw commit messages:
```bash
gh pr list --repo owner/repo --state merged --limit 100 \
  --search "merged:>=$SINCE" \
  --json number,title,body,mergedAt,author,url,labels
```

**Network note:** `gh` uses `GITHUB_TOKEN` internally and works in a GitHub Actions run. If `gh` fails, log `fail` for that repo and continue — do not fall back to WebFetch (public API is rate-limited and adds noise).

### A.3. Filter noise

Exclude before classifying:
- Bot authors: `dependabot[bot]`, `renovate[bot]`, `claude[bot]`, `github-actions[bot]`.
- Merge commits where the underlying PR commits are already included (dedupe by PR number).
- Revert commits paired with the reverted commit in the same window (collapse both into a single "Reverted: X" Fixed entry, or drop if trivial).
- Pure auto-generated commits: "Update submodule", "Bump version to X", release-bot tags.

Keep a per-repo count of filtered commits for the footer ("N internal/bot commits hidden").

### A.4. Classify into Keep a Changelog categories

Do **not** use Features/Fixes/Docs/Chores — those are for developers. Use:

| Category | Use for |
|----------|---------|
| **⚠️ Breaking** | `feat!:` / `fix!:` / any commit whose body contains `BREAKING CHANGE:`. Also any removed public API. |
| **Added** | New user-visible features (typically `feat:` without `!`). |
| **Changed** | Modifications to existing functionality users will notice (behaviour, UX, defaults). |
| **Fixed** | Bug fixes users care about (`fix:` only if the bug was observable). |
| **Security** | `security:` prefix, `CVE-`, dependency bumps flagged as security, or commits touching auth/crypto with obvious security framing. |
| **Internal** | Everything else (`chore`, `ci`, `build`, `test`, `refactor`, `style`, `docs` unless docs are user-facing). Show only a one-line count, not full entries. |

`Deprecated` and `Removed` categories: include only if genuine

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

1. 2026-10-14
   ✓SAFE B 89 / 100

   first audit · source 0448e87653f9

Questions about Changelog

• github.com/aaronjmars/aeon/tree/main/skills/changelog — the audited source at commit 0448e87653f9 and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology