chore: keep project changelogs current

[Isthimius]

Summary

• remove the caller-facing -Unreleased switch from Generate-Project-Changelogs.ps1
• bootstrap missing/empty project changelogs from full tagged history plus the current unreleased range
• replace a previously generated leading [Unreleased] section on repeat runs
• preserve release behavior by using -Tag to freeze the current range into the requested version
• add a dedicated master workflow that refreshes per-project changelogs after non-changelog pushes
• keep the normal CI workflow read-only and ignore generated project changelog-only changes
• update script documentation for the new behavior

Automation safeguards

• changelog-only pushes are ignored
• workflow writes use narrowly scoped contents: write
• runs are concurrency-grouped on master
• a stale push retries once by resetting to current origin/master and regenerating

Notes

The root repository CHANGELOG.md remains release-driven by release.ps1; the automatic workflow maintains the independent per-project changelogs only.

[Copilot]

🔵 Needs a closer look

It introduces an automated workflow that writes back to master, which warrants final human review to confirm branch protection/permissions and prevent unintended automation loops.

Pull request overview

This PR updates the project-changelog automation so per-project CHANGELOG.md files stay current on master without requiring a manual -Unreleased switch, while keeping release-time behavior intact via -Tag.

Changes:

• Simplifies Generate-Project-Changelogs.ps1 by removing -Unreleased and making “refresh current range” the default, with safe temp-file writes and regeneration of an existing leading [Unreleased] section.
• Updates the release flow to rely on -Tag (instead of -Unreleased) to freeze the current range into the release version.
• Adds a dedicated changelog-master workflow that regenerates and commits per-project changelogs on master, and updates CI path filters to ignore changelog-only pushes/PR updates.

File summaries

File	Description
Tooling/scripts/release.ps1	Stops passing -Unreleased and relies on -Tag for release-time project changelog stamping.
Tooling/scripts/README.md	Updates documentation to reflect the new default behavior and the new master workflow.
Tooling/scripts/Generate-Project-Changelogs.ps1	Implements “bootstrap full history if missing/empty” and “refresh/replace leading [Unreleased]” logic with safe temp-file writes.
.github/workflows/ci-master.yml	Ignores **/CHANGELOG.md so CI doesn’t run on generated changelog-only changes.
.github/workflows/changelog-master.yml	New workflow that regenerates per-project changelogs on master and commits/pushes them with a retry on race.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The new workflow’s change allow-list/staging logic can still include the repository root CHANGELOG.md, which conflicts with the stated goal of keeping it release-driven and should be hardened before merging.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

.github/workflows/changelog-master.yml:230

• git add -- ':(glob)**/CHANGELOG.md' will stage the root CHANGELOG.md as well as per-project changelogs. Even with the allow-list tightened, it’s safer to explicitly exclude the root changelog so the job can never commit it.

          git add -- ':(glob)**/CHANGELOG.md'

• Files reviewed: 5/5 changed files
• Comments generated: 2
• Review effort level: Lite