Base directory for this skill: /Users/soph/Work/entire/devenv/git-sync/.claude/skills/changelog

Changelog Generation

Generate a changelog entry for a new release by analyzing merged PRs since the last tag.

Parameters

The user provides:

Version number -- e.g., 0.5.3
Additional PRs -- optionally, PRs not yet merged that should be included

Step 1: Gather Data

Find the previous release tag: git tag --sort=-version:refname | head -1
List all merge commits since that tag: git log <tag>..HEAD --merges --format='%s' | grep -v "Merge branch"
Get PR details with: gh pr list --state merged --base main --search "merged:><tag-date>" --json number,title,author --limit 50
List contributors: git log <tag>..HEAD --format='%an' --no-merges | sort | uniq -c | sort -rn

Step 2: Identify External Contributors

To determine if a contributor is external, check for an @entire.io email:

If they have an @entire.io email anywhere in git history, they are internal. Only list external contributors in the Thanks section.

Also check the memory file at memory/project_team_members.md for known internal/external mappings.

Step 3: Write the Entry

Insert the new version section at the top of CHANGELOG.md, after the header and before the previous version.

Format

Follow the existing style in CHANGELOG.md exactly:

Style Rules

Sections: Added, Changed, Fixed, Housekeeping, Thanks. Omit empty sections.
Each bullet: starts with a dash, concise description, PR link(s) at the end
Group related PRs into a single bullet when they're part of the same feature/fix
Work-in-progress features: call out explicitly, e.g., "Feature X (work in progress): ..."
Known limitations: note inline, e.g., "Note: subagent tracking is not yet supported due to..."
Thanks section: only external contributors. Name what they contributed specifically.
Dependency bumps: group into a single Housekeeping bullet unless a bump fixes a notable bug
PR links: always use full URL format [#N](https://github.com/entireio/git-sync/pull/N)
No trailing period on bullet items
Date: use the current date in YYYY-MM-DD format

Categorization Guide

Added: new features, new commands, new agent integrations, new CI workflows
Changed: behavior changes, API changes, UX changes, migrations
Fixed: bug fixes, E2E fixes, agent-specific fixes
Housekeeping: dependency bumps, docs, refactors, CI improvements, test improvements

1w ago·7m·24 calls

Cut [0.9.0] - 2026-08-28 in CHANGELOG.md. Only that file changed.

What was already there: the Unreleased section held 13 Security bullets and 2 Added bullets, none of them with PR links. Renamed the heading and back-filled all 16 links.

Two PRs were missing entirely:

#104 — golang.org/x/crypto → v0.54.0, closing 13 Dependabot alerts (7 critical), all in its SSH implementation. Added as the first Security bullet, grouped with the other two bumps.
#105 — go-git/go-billy pre-release bump for protocol v2 fetch work (Paulo Gomes). New Housekeeping section, matching how 0.8.0 and 0.5.0 file go-git bumps.

Link mapping — the eleven code-level security bullets came from six PRs, not the three the branch names suggest:

PRs	Entries
#106	go-git alpha.5, Go 1.26.6, `Vulnerability Scan` workflow
#107	packfile header allocation, SSH shell quoting, URL redaction, advertisement bounds, commit-graph spill cap, workflow `permissions`
#108	host-bound credentials
#109	ref-name validation
#110	streaming object limit
#111	terminal-control sanitization, TLS-verify derivation
#112	build provenance
#114	`SyncPolicy.AllowEmptySource`

#110 and #111 aren't in the merge-commit list — they were squash-merged, so the git log --merges sweep the skill prescribes misses them; I cross-checked against gh pr list and traced internal/sanitize/ and ErrObjectLimit back to their commits. The permissions: contents: read bullet belongs to #107, not the provenance PR — #112 only touched release.yml and README.md.

No Thanks section: the three contributors (Stefan Haubold, Andrea Nodari, Paulo Gomes) all have @entire.io addresses in git history, so all internal.

The AllowEmptySource entry spans six paragraphs; its link sits at the end of the last one, per the "PR link at the end of the bullet" convention. Worth a look before tagging — the security bullets are unusually long for this changelog, and if you'd rather they were compressed for the release notes, say the word.

Compressed. The Security section went from 13,585 to 10,178 characters (−25%), 15 bullets in, 15 out, every PR link preserved in the same order.

The bullets now sit inside the changelog's existing range rather than above it:

	median words	mean	longest
Security, before	148	168	297
Security, now	97	94	148
0.8.0, for reference	72	81	154

What I cut: design justification and test detail — why per-fetch beats cumulative accounting in full, the stdlib's host:443→host:9999 redirect quirk, RawObjectWriter being the choke point, the README's optimistic memory claim, regression tests asserting against a real /bin/sh, the <source url redacted> → <url redacted> placeholder rename, and the two extra sanitize carriers (BranchPlan.Reason, unpack status).

What I kept: for each entry, the defect, what an attacker gets, and the fix — plus the concrete numbers that let a reader judge exposure (128 TiB declared object → fatal error: out of memory, git@host:~a;id/repo.git executing id as the SSH user, 12 called vulnerabilities → 0, the CVE-ish advisory IDs). On a security release those are the lines someone actually needs to decide whether they were affected, so they stayed even where the surrounding prose went.

Three bullets I left essentially alone — the commit-graph spill cap, the workflow permissions note, and the provenance entry — were already at or below the house median.

Validation run over the section: 15 bullets, balanced backticks and bold markers, every bullet ending in a well-formed ([#N](url)) with no period before the link, and the rejected\rok refs/heads/main example still a literal backslash-r rather than an actual control character.

The SyncPolicy.AllowEmptySource entry under Added is untouched and is now by far the longest thing in the release — six paragraphs, ~900 words. It's a new public API with real caveats, so length is more defensible there, but say the word if you want it brought down too.

Fixed. go-git is now named once, on the Security bullet, citing both PRs:

The Housekeeping section is gone — #105 was its only entry, and once the go-git bump lives in Security there's nothing left to put there. All ten merged PRs (104–112, 114) are still cited, so nothing lost attribution.

I dropped #105's transport.AdvertiseRefs protocol-version detail in the merge. It was test-only churn in our own in-memory smart-HTTP servers, and prior releases documented go-git bumps as bare one-liners without their API churn, so it didn't earn a line.

Section is now two headings — Security (15 bullets) and Added (2) — which is the accurate shape for this release: security hardening plus SyncPolicy.AllowEmptySource.