fix(gptchangelog): attribute contributors inline per bullet instead of trailing list

[bedatty]

GitHub Actions Shared Workflows

---

Description

Previously the changelog ended with a generic Contributors: @a, @b list — the same information GitHub already shows on the release page, adding no value.

This PR changes the attribution model so each bullet point includes the @handle of the author inline:

Before:

Fixes:
- Ensure normalize_to_filter is a boolean, not a string, in extra_build.
- Prevent code injection via coverage_threshold interpolation.

Contributors: @bedatty, @gandalf-at-lerian

After:

Fixes:
- Ensure normalize_to_filter is a boolean, not a string, in extra_build. (@gandalf-at-lerian)
- Prevent code injection via coverage_threshold interpolation. (@bedatty)

Implementation:

• Replaces the two-pass approach (git log --oneline + separate SHA loop for contributors) with a single annotated pass: for each commit SHA, fetch the subject line and the GitHub author login, building COMMITS_ANNOTATED as "short-hash subject [@author]" lines
• Passes the annotated list to GPT with updated prompt rule 6: attach @handle(s) in parentheses at the end of each bullet; list all unique handles when a bullet groups multiple commits
• Removes the TEMP_COMMITS temp file and the USERNAMES_FILE temp file (no longer needed)

Type of Change

• feat: New workflow or new input/output/step in an existing workflow
• fix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)
• perf: Performance improvement (e.g. caching, parallelism, reduced steps)
• refactor: Internal restructuring with no behavior change
• docs: Documentation only (README, docs/, inline comments)
• ci: Changes to self-CI (workflows under .github/workflows/ that run on this repo)
• chore: Dependency bumps, config updates, maintenance
• test: Adding or updating tests
• BREAKING CHANGE: Callers must update their configuration after this PR

Breaking Changes

None. The changelog content format changes (richer attribution per item) but no inputs, outputs, or caller contracts change.

Testing

• YAML syntax validated locally
• Traced the annotated commit list build: SHA → git log -1 --format='%h %s' + GitHub API login → "abc1234 fix(x): desc [@author]"
• Verified the prompt correctly instructs GPT to attach handles inline
• Confirmed temp file cleanup is no longer needed (removed)

Summary by CodeRabbit

• Chores
  • Improved changelog generation by using more direct commit tracking.
  • Enhanced contributor attribution by attaching author handles to each commit entry when available.
  • Updated the generated prompt format to rely on per-commit author information, removing the need for a separate consolidated contributors summary step.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: ASSERTIVE

Plan: Pro

Run ID: d090e1df-b4de-4587-8ef4-1d5c50e617cf

📥 Commits

Reviewing files that changed from the base of the PR and between f1f8c00 and f885f60.

📒 Files selected for processing (1)

• src/changelog/gptchangelog/action.yml

---

Walkthrough

The action now gathers commit SHA, short hash, and subject data from a single git log pass, counts non-empty commit entries, annotates each commit with gh api author logins when present, and updates the GPT prompt to use the annotated commit lines.

Changes

GPT changelog commit attribution

Layer / File(s)	Summary
Commit data collection src/changelog/gptchangelog/action.yml	The per-app loop now collects SHA, short hash, and subject data from one git log invocation, counts non-empty entries from that output, and skips app ranges with no commits.
Commit attribution and prompt src/changelog/gptchangelog/action.yml	Each commit line is annotated with [@login] when gh api returns a non-bot author login, and the GPT prompt now consumes COMMITS_ANNOTATED instead of a consolidated contributors list.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: inline contributor attribution instead of a trailing list.
Description check	✅ Passed	The description covers the required sections and testing; only Related Issues remains incomplete.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/gptchangelog-inline-contributors

---

_{Comment @coderabbitai help to get the list of available commands.}

[lerian-studio]

🔍 Lint Analysis

Check	Files Scanned	Status
YAML Lint	1 file(s)	✅ success
Action Lint	no changes	⏭️ skipped
Pinned Actions	1 file(s)	✅ success
Markdown Link Check	no changes	⏭️ skipped
Spelling Check	1 file(s)	✅ success
Shell Check	1 file(s)	✅ success
README Check	1 file(s)	✅ success
Composite Schema	1 file(s)	✅ success
Deployment Matrix	no changes	⏭️ skipped

---

_{🔍 View full scan logs}

[lerian-studio]

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
PR Size	✅ success	no
Auto Labels	✅ success	no
PR Metadata	✅ success	no

---

_{🔍 View workflow run}

[lerian-studio]

🛡️ CodeQL Analysis Results

Languages analyzed: actions

✅ No security issues found.

---

_{🔍 View full scan logs | 🛡️ Security tab}

[coderabbitai]

Warning

CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.

Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.

👉 Steps to fix this

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/changelog/gptchangelog/action.yml`:
- Around line 282-295: The commit annotation loop in the changelog action is
doing an extra `git log -1` per SHA even though the subject can be captured when
`SHAS` is first collected. Update the initial SHA-gathering logic and
`COMMITS_ANNOTATED` building in `action.yml` so each record includes full SHA,
short hash, and subject from one local `git log` pass, then reuse that subject
inside the loop while keeping the `gh api` login lookup keyed by the full SHA.
This removes the redundant local subprocess per commit and preserves the
existing author-handle annotation behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 0af9daa4-c2a8-4a65-ba55-75c5bed3bb65

📥 Commits

Reviewing files that changed from the base of the PR and between 01e9326 and f1f8c00.

📒 Files selected for processing (1)

• src/changelog/gptchangelog/action.yml