ci: validate all changelogs in a single run by Mrtenz · Pull Request #11199 · MetaMask/core

Mrtenz · 2026-10-29T12:50:42Z

Explanation

The validate-changelogs CI job ran changelog:validate once per package in a matrix, so it started one job per package. This adds a changelog:validate:all script that runs auto-changelog validate --all with the oxfmt formatter, and the job now calls that script instead.

References

Checklist

I've updated the test suite for new or updated code as appropriate
I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
I've communicated my changes to consumers by updating changelogs for packages I've changed
I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

Note

Low Risk
Changes are limited to release/changelog CI and devDependency scripts; runtime package code is untouched, though stricter or different v7 validation could surface new changelog failures in CI.

Overview
CI replaces the per-package matrix job with one Validate changelogs step that runs yarn changelog:validate:all (root script → scripts/validate-changelog.sh), so validation is no longer gated on changed package names or duplicated across many jobs.

Tooling: adds root changelog:validate:all and bumps @metamask/auto-changelog from ^6.2.1 to ^7.1.0 repo-wide. Each workspace’s changelog:validate now invokes validate-changelog.sh without a package-name argument; the script resolves the package from the current directory (root run validates all workspaces via --all or per-package when release-candidate rules apply).

^{Reviewed by Cursor Bugbot for commit 146b14d. Bugbot is set up for automated code reviews on this repo. Configure here.}

socket-security · 2026-10-29T12:51:26Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@metamask/auto-changelog@7.1.0

View full report

cursor

Stale Bugbot comment from a previous run.

cursor

Stale Bugbot comment from a previous run.

Add a `changelog:validate:all` script that runs `auto-changelog validate --all` with the `oxfmt` formatter. The `validate-changelogs` CI job now uses it instead of running `changelog:validate` once per package. Until a release supports `--all`, `@metamask/auto-changelog` resolves to a preview build that does.

Point the `@metamask/auto-changelog` resolution at the `7.0.1-preview-04c950b` preview build, which includes the latest `--all` validation changes for CI.

`auto-changelog validate --all` applies `--rc` to every package or to none, so release branches lost the per-package release candidate check. `changelog:validate:all` now runs `validate-changelog.sh --all`. The script validates all changelogs, then on `release/*` branches re-validates each bumped package with `--rc`. The decision moves into a new `resolve_rc_flag` function that the per-package path also uses, and it has tests.

Gudahtt

LGTM!

mcmire · 2026-11-02T18:03:33Z


-  if should_validate_as_release_candidate "${branch_name}" "${current_version}" "${base_version}"; then
-    yarn auto-changelog validate --formatter oxfmt --tag-prefix "${package_name}@" --rc "$@"
+  if [[ "$1" == "--all" ]]; then


Wondering if it would make more sense to look at package.json in the current directory, and if it has a workspaces field, we assume it's being run at the root, otherwise we assume it's being run for a package. Then we don't need to pass this script --all or a package name, it will know what to do based on where it is run. What do you think?

Strictly speaking, the package.json with workspaces doesn't have to be the root. But yes, maybe this makes more sense. 🤔

Done. The script is now a bit simplified, so scripts don't need to specify a package name anymore.

Wondering if we should upstream this to auto-changelog at some point?

Agreed. I had similar thoughts in the comment below.

mcmire · 2026-11-02T18:06:30Z

+
+    (
+      cd "${root_directory}/${location}"
+      yarn auto-changelog validate --formatter oxfmt --tag-prefix "${package_name}@" --rc "$@"


Looks like if we are on a release branch, auto-changelog is run twice, once with --all and another time with --rc. Is that correct? If so that seems odd 🤔

Yes. The problem is that we can't run --all with --rc, as we usually only release a subset of packages (so --rc wouldn't pass for the majority of them).

Since --all only takes 1-2 seconds in CI, I thought this was fine. But we can also change it to skip --all and only run the subset of packages in releases?

The RC flag should result in extra validation, but is still compatible with any validation performed without it. So.... it should be OK? Though running it twice is not ideal of course.

Hmm, it just seems inconsistent. It seems like if auto-changelog is now aware of project workspaces, it should have the ability to run validation on a subset of those workspaces too. I guess ensuring that the CLI is flexible is tricky though. I don't have any good ideas right now so I guess this is fine for now and we can improve it later.

The script now checks the current `package.json` for a `workspaces` field. At the root it validates every package. In a package it validates only that package, using the package's own `name` as the tag prefix. Callers no longer pass `--all` or a package name. On `release/*` branches it validates each package once and decides `--rc` per package. Before, it ran `--all` and then re-validated the bumped packages.

`validate-changelog.sh` now reads the package name from `package.json`, so every package's `changelog:validate` script calls it without arguments. Each package no longer needs a hard-coded name kept in sync.

cursor

Stale Bugbot comment from a previous run.

`changelog:validate` no longer passes the package name, but `changelog:update` still does. The constraint now expects each script's own form and no longer checks that both pass the same arguments.

mcmire · 2026-11-02T18:32:29Z

+
+  # `--all` applies `--rc` to every package or none, so it can only be used when
+  # no package is a release candidate.
+  if [[ ! "${branch_name}" =~ ^release/ ]]; then


Here we are just checking that the branch name starts with release/. But in should_validate_as_release_candidate we check for more than that. Should we be consistent and use the same logic here to determine whether we are running this on a release candidate?

Alternatively, since we already know whether we're on a release branch in main.yml, we could have validate-changelog.sh take an --rc option, and then have the workflow pass that option down. It would mean rearranging a few things but this way this script actually detects releases correctly (by delegating that logic elsewhere). I guess that might be out of scope here so what do you think?

I wonder if we should just start rejecting releases that are not on a release/ branch, since other parts of our workflows assume that too. But I can change that for now, yes.

I wonder if we should just start rejecting releases that are not on a release/ branch, since other parts of our workflows assume that too.

True. I guess that would make things easier.

`validate_all` used to check only the branch name, while the per-package `--rc` decision also checks for a version bump. It now calls `should_validate_as_release_candidate` for each package and runs a single `--all` only when none of them is a release candidate. The function reads the package versions itself, so the `^release/` check lives in one place. If the base version can't be resolved, the package is treated as not a release candidate. The tests now use real git history.

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 146b14d. Configure here.}

cursor · 2026-11-02T18:59:01Z

+  current_version="$(jq --raw-output '.version' package.json)"
+
+  local base_version
+  base_version="$(resolve_base_version)" || return 1


Release checks skipped on git errors

Medium Severity

should_validate_as_release_candidate now converts a resolve_base_version failure into a non-candidate result. validate_all then takes the --all path without --rc, so a release branch whose merge base cannot be resolved skips release-candidate checks and still succeeds.

Additional Locations (1)

scripts/validate-changelog.sh#L128-L131

^{Reviewed by Cursor Bugbot for commit 146b14d. Configure here.}

Not sure in which case the merge base cannot be resolved?

mcmire

LGTM.

## Explanation Releases `@metamask/perps-controller@22.1.1` (patch) so the fix from MetaMask#11160 can be consumed by `metamask-extension`. This version migrates the package's existing `Unreleased` entries into `22.1.1`: ### Changed - Bump `uuid` from `^14.0.0` to `^14.0.1` (MetaMask#11179) ### Fixed - Prevent HyperLiquid `userFills` from going silent after a WebSocket reconnect when an in-flight subscribe races with `restoreSubscriptions` (MetaMask#11160) ## Notes - Dependencies of `perps-controller` that have unreleased changes (`@metamask/base-controller`, `@metamask/controller-utils`, `@metamask/messenger`, `@metamask/utils`) were intentionally skipped — `22.1.1` does not rely on new versions of them. - `@metamask/transaction-pay-middleware`'s dependency range on `perps-controller` was bumped to `^22.1.1` automatically by the release tooling (its own version is unchanged). - Dropped two non-consumer-facing CI/test commits (MetaMask#11261, MetaMask#11199) that the tooling had added under `Uncategorized`, per the release changelog guidelines. - `yarn changelog:validate` passes for `@metamask/perps-controller`. ## Checklist - [x] I've updated the test suite for new or updated code as appropriate - [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [ ] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them  [Slack Thread](https://consensys.slack.com/archives/D0AD7VDJ3U0/p1782396245326519?thread_ts=1782396245.326519&cid=D0AD7VDJ3U0) <div><a href="https://cursor.com/agents/bc-bc8c3875-2395-5248-9807-fdb8636d9cc3?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-bc8c3875-2395-5248-9807-fdb8636d9cc3&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div>  --- > [!NOTE] > **Low Risk** > Version and changelog-only release PR with dependency range updates; functional changes were already merged in prior PRs. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit e397b02. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>  --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Amélie <ameliejyc@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Mrtenz force-pushed the mrtenz/auto-changelog-all branch 2 times, most recently from 1bef4c1 to 8b0dbbb Compare November 2, 2026 13:03

Mrtenz marked this pull request as ready for review November 2, 2026 13:09

Mrtenz temporarily deployed to default-branch November 2, 2026 13:09 — with GitHub Actions Inactive

Mrtenz requested review from a team as code owners November 2, 2026 13:09

cursor Bot reviewed Nov 2, 2026

View reviewed changes

Comment thread .github/workflows/lint-build-test.yml Resolved

cryptodev-2s reviewed Nov 2, 2026

View reviewed changes

Comment thread packages/account-tree-controller/package.json Resolved

Mrtenz force-pushed the mrtenz/auto-changelog-all branch from 51fb35a to aa45b55 Compare November 2, 2026 13:43

Mrtenz added this pull request to stack #11236 November 2, 2026 13:45

cursor Bot reviewed Nov 2, 2026

View reviewed changes

Comment thread packages/json-rpc-engine/CHANGELOG.md Resolved

Mrtenz added 6 commits November 2, 2026 15:22

Update auto-changelog preview build

bb4e839

Point the `@metamask/auto-changelog` resolution at the `7.0.1-preview-04c950b` preview build, which includes the latest `--all` validation changes for CI.

Bump @metamask/auto-changelog to ^7.1.0

7ff9121

Fix auto-changelog version in new package

db19d2c

Update lockfile

f17248b

Mrtenz force-pushed the mrtenz/auto-changelog-all branch from aa45b55 to 6515745 Compare November 2, 2026 14:22

Gudahtt previously approved these changes Nov 2, 2026

View reviewed changes

mcmire reviewed Nov 2, 2026

View reviewed changes

Mrtenz added 2 commits November 2, 2026 19:25

Drop the package name argument from changelog:validate

3e54338

`validate-changelog.sh` now reads the package name from `package.json`, so every package's `changelog:validate` script calls it without arguments. Each package no longer needs a hard-coded name kept in sync.

Mrtenz dismissed Gudahtt’s stale review via 3e54338 November 2, 2026 18:25

cursor Bot reviewed Nov 2, 2026

View reviewed changes

Comment thread packages/account-tree-controller/package.json Resolved

Update changelog script constraint for validate-changelog.sh

a17d668

`changelog:validate` no longer passes the package name, but `changelog:update` still does. The constraint now expects each script's own form and no longer checks that both pass the same arguments.

Mrtenz added the no-changelog label Nov 2, 2026

mcmire reviewed Nov 2, 2026

View reviewed changes

cursor Bot reviewed Nov 2, 2026

View reviewed changes

Mrtenz requested review from Gudahtt and mcmire November 2, 2026 19:51

mcmire approved these changes Nov 2, 2026

View reviewed changes

Mrtenz added this pull request to the merge queue Nov 2, 2026

Merged via the queue into main with commit f5a5c39 Nov 2, 2026
155 checks passed

Mrtenz deleted the mrtenz/auto-changelog-all branch November 2, 2026 20:20

ameliejyc mentioned this pull request Nov 3, 2026

Release 1384.0.0 #11269

Merged

2 of 4 tasks

Conversation

Mrtenz commented Oct 29, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation

References

Checklist

Uh oh!

socket-security Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Gudahtt left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mcmire Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Nov 2, 2026

Choose a reason for hiding this comment

Release checks skipped on git errors

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mcmire left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Mrtenz commented Oct 29, 2026 •

edited by cursor Bot

Loading

socket-security Bot commented Oct 29, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

mcmire Nov 2, 2026 •

edited

Loading