Release Changelog Action

Public GitHub Action and reusable workflows for syncing published GitHub releases to the private Release Changelog WordPress plugin.

The software release remains valid if WordPress is unavailable. A failed sync is visible and can be retried safely; WordPress always receives a draft and uses an immutable repository/release identity to prevent duplicates.

Turnkey reusable workflow

jobs:
  changelog:
    uses: code-atlantic/release-changelog-action/.github/workflows/sync-release.yml@FULL_COMMIT_SHA
    with:
      product-key: example-plugin
      expected-repository: ExampleCo/example-plugin
      release-id: ${{ format('{0}', github.event.release.id || inputs.release_id) }}
    secrets:
      WORDPRESS_URL: ${{ secrets.WORDPRESS_URL }}
      WORDPRESS_ACCESS_TOKEN: ${{ secrets.WORDPRESS_ACCESS_TOKEN }}

Pin production callers to a full commit SHA. Version tags such as v1 and v1.0.0 are also published for shops that prefer managed upgrades.

Composite action

Use the lower-level action inside an existing release job:

- name: Sync release changelog draft
  uses: code-atlantic/release-changelog-action@FULL_COMMIT_SHA
  with:
    wordpress-access-token: ${{ secrets.WORDPRESS_ACCESS_TOKEN }}
    wordpress-url: ${{ secrets.WORDPRESS_URL }}
    github-token: ${{ github.token }}
    product-key: example-plugin
    expected-repository: ExampleCo/example-plugin
    release-id: ${{ github.event.release.id }}

See examples/ for complete published/edited release and manual retry callers. The backfill workflow defaults to a read-only dry run.

Historical releases from tags

The optional historical-releases.yml reusable workflow inventories version tags that do not yet have GitHub Releases and extracts the matching section from readme.txt. Its default inventory mode performs no writes. drafts creates reviewable GitHub draft releases; publish requires the exact confirmation phrase and sets make_latest: false. Stable tags are the default, while prerelease tag generation is independently opt-in.

GitHub does not allow callers to backdate release creation or publication timestamps. The action separately resolves the release tag to its target commit and sends that commit timestamp as tagged_at, alongside GitHub's exact release created_at and published_at values. Each WordPress site can choose its canonical date source.

Security model

• Put the WordPress URL and endpoint-scoped access token in a protected GitHub environment.
• The access token authenticates only the release-draft endpoint and does not require a WordPress user.
• Existing Release Sync Bot Application Password integrations remain supported for compatibility.
• Only published GitHub releases are accepted as shipped state.
• Credentials and raw WordPress responses are masked or suppressed.
• Repository and product mappings are validated by both the caller and WordPress.

Development

./tests/action/sync-release.test.sh
./tests/action/historical-releases.test.sh

License

MIT