add pr validation for changelog to catch errors BEFORE releasegen runs

.github/workflows/releasegen.yml

@@ -56,8 +56,9 @@ jobs:
           GITHUB_REF_NAME: ${{ github.event.inputs.branch || github.ref_name }}
           MANUAL_VERSION: ${{ github.event.inputs.version || '' }}
           REASON: ${{ github.event.inputs.reason || '' }}
-          CUSTOM_CHANGE_TYPES: |
-            Documentation:patch
+          # Repo-shape options (custom_change_types, exclude_dirs, ...) live
+          # in .releasegen.yaml at the repo root so this workflow does not
+          # have to keep them in sync with the validate workflow.
         run: |
           go build -trimpath -ldflags "-s -w" -o release-gen ./cmd/releasegen
           # releasegen prints the self-release version on stdout (and only

.github/workflows/validate.yml

@@ -0,0 +1,30 @@
+name: Validate Changelog
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
+        with:
+          go-version: '1.26'
+
+      - name: Validate changelogs
+        # While releasegen is dogfooding itself, build and run from source.
+        # External consumers can use the published image instead:
+        #   docker run --rm -v "$(pwd):/workspace" \
+        #     ghcr.io/c2fo/releasegen:latest validate --repo-root /workspace
+        run: |
+          go build -trimpath -ldflags "-s -w" -o release-gen ./cmd/releasegen
+          ./release-gen validate

.golangci.yml

@@ -106,11 +106,13 @@ linters:
         - -ST1022
         - all
     tagliatelle:
-      # The JSON run-summary (see internal/runner) is a stable, snake_case
-      # output contract consumed by downstream workflow steps.
+      # The JSON run-summary (see internal/runner) and the `.releasegen.yaml`
+      # user config (see internal/config) are stable, snake_case output and
+      # input contracts consumed by users and downstream workflow steps.
       case:
         rules:
           json: snake
+          yaml: snake
     unparam:
       check-exported: false
   exclusions:

.prenup.yaml

@@ -16,6 +16,10 @@ tasks:
     default_selected: true
     command: env -u GIT_INDEX_FILE -u GIT_INDEX_LOCK golangci-lint run --new-from-rev HEAD --max-same-issues 0 ./...
     per_module: true
-  - name: Check for changes in CHANGELOG.md
+  - name: Validate CHANGELOG.md
     default_selected: true
-    command: /bin/bash {{.repo_root}}/.github/workflows/scripts/changelog.sh
+    # Dogfoods releasegen's own validate subcommand: parses every
+    # [Unreleased] section AND (per .releasegen.yaml's validate block)
+    # requires a new entry for any module whose non-CHANGELOG files
+    # changed vs origin/main. Replaces the legacy changelog.sh script.
+    command: go run {{.repo_root}}/cmd/releasegen validate --repo-root {{.repo_root}}

.releasegen.yaml

@@ -0,0 +1,14 @@
+# ReleaseGen configuration for releasegen itself.
+#
+# Per-repo, rarely-changing options live here so the validate workflow and the
+# release workflow read them from a single source. Per-invocation values
+# (GITHUB_TOKEN, MANUAL_VERSION, etc.) stay in the workflow env / CLI flags.
+
+custom_change_types:
+  Documentation: patch
+
+validate:
+  # Require every PR that touches non-CHANGELOG files to also add at least
+  # one entry under [Unreleased]. Folds the historical ensure_changelog
+  # check into releasegen so contributors get one error report per CI run.
+  require_changelog_entry: true

CHANGELOG.md

@@ -6,6 +6,34 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Added
+- New `releasegen validate` subcommand. Parses every `## [Unreleased]` section
+  in the repository and reports **every** malformed heading it finds — both
+  across files and within a single file — in a single batched report. Detects
+  `### Changed` / `### Removed` without the `BREAKING CHANGE` marker as well
+  as any heading not declared in `custom_change_types`, naming the offending
+  heading in each error. Needs no GitHub token, performs no I/O beyond reads,
+  and exits `0` on success / `2` on any validation failure — intended as a
+  required PR-time check before the release workflow.
+- New `.releasegen.yaml` (also `.releasegen.yml`) config file at the repo root.
+  Supports `custom_change_types`, `exclude_dirs`, a `validate:` block (see
+  below), and the advanced `self_release_module` / `self_release_repo`
+  overrides. Precedence is flags > env > file > built-in defaults; unknown
+  keys cause a configuration error so typos surface early. Both `validate`
+  and the existing release path read it, so repo-shape options no longer
+  have to be duplicated across workflows.
+- New optional `--require-changelog-entry` mode for `releasegen validate`
+  (also exposed as `validate.require_changelog_entry: true` in
+  `.releasegen.yaml` and `RELEASEGEN_REQUIRE_CHANGELOG_ENTRY=true` in the
+  environment). When enabled, validate fails any PR whose non-`CHANGELOG.md`
+  files changed vs the base ref but whose `[Unreleased]` section gained no
+  new lines. Modules are scoped by where `CHANGELOG.md` lives, with the
+  root changelog catching every file not claimed by a submodule changelog.
+  The base ref is configurable via `--base-ref` / `RELEASEGEN_BASE_REF` /
+  `validate.base_ref` and defaults to `origin/$GITHUB_BASE_REF` on GitHub
+  Actions pull-request runs, else `origin/main`. Subsumes the prior
+  external `ensure_changelog` workflow, which has been removed from this
+  repository in favor of the validate-driven check.
 
 ## [[v1.1.1](https://github.com/C2FO/releasegen/releases/tag/v1.1.1)] - 2026-06-18
 ### Documentation