generate-intelligence-changelog.yml

name: Generate Intelligence Changelog

on:
  workflow_dispatch:
    inputs:
      previous_commit:
        description: 'Previous commit SHA (default: HEAD~1)'
        required: false
        default: 'HEAD~1'
      current_commit:
        description: 'Current commit SHA (default: HEAD)'
        required: false
        default: 'HEAD'

permissions:
  contents: read

jobs:
  generate-changelog:
    runs-on: ubuntu-latest
    
    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: Checkout repository
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        fetch-depth: 0  # Fetch full history for git diff
    
    - name: Run Intelligence Changelog Generator
      run: |
        cd $GITHUB_WORKSPACE
        bash .github/scripts/generate-intelligence-changelog.sh \
          ${{ github.event.inputs.previous_commit }} \
          ${{ github.event.inputs.current_commit }} > changelog-output.txt
      
    - name: Upload Changelog Report
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: intelligence-changelog-report
        path: changelog-output.txt
        retention-days: 30