Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

contract: nothing refuses a direct CHANGELOG.md edit from a PR — the fragment convention is guidance without a fence

Open
  • Is something wrong?
#851 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
git, github-actions, go
Domain
build-system, ci-cd, tooling

Research direction

Read hooks/pre-commit around lines 60–66 and the existing check-changelog-duplicates.py contract check to understand the current fragment validation and CI pattern. Then trace how CI obtains the PR merge-base diff. Done means staged direct edits to CHANGELOG.md are refused with the documented override, and a CI check rejects PR diffs touching that file while allowing release-time fold commits.

Written by the indexing model from the issue text.

Description

Body:

#800 fixed the AGENTS.md/changelog.d-README split-brain ("mis-led three PRs in one week"), and hooks/pre-commit:60-66 now states "PRs do not edit the changelog directly" — but the enforcement gap is exactly where it was: the hook only validates fragments when staged, and no check anywhere refuses a PR diff that edits CHANGELOG.md directly. The convention is still guidance, not a fence, and the 2026-10-10 train proved the failure mode end to end:

  • Four PRs in one night (#835/#837/#836/#842) hand-edited the same [Unreleased] → Changed / Internal anchor — the precise hand-merge the fragment system exists to remove (#524/#531 history).
  • #835 merged first with its direct edit, instantly CONFLICTING the other three (verified by trial-merge: sole unmerged file CHANGELOG.md in each).
  • The one fragment-authoring PR of the four (#840) stayed MERGEABLE through the same merges — the convention's value, demonstrated by the accident.
  • The review lane then had to rebase-and-swap all three manually (heads e6741ea9/bc4b86a0/d595c569) — reviewer time spent on a class a check would have prevented at git commit time.

Per the drift doctrine, a rule you cannot remove gets a fence that EXECUTES and can fail. Proposal:

  1. hooks/pre-commit: refuse staged paths matching ^CHANGELOG.md$ unless an explicit maintainer override is set (e.g. TOLLGATE_CHANGELOG_FOLD=1 env), pointing at changelog.d/README.md.
  2. A small contract check (same family as check-changelog-duplicates.py) that runs in CI on the PR diff: fail when the merge-base diff touches CHANGELOG.md. The maintainer's release-time fold commits don't carry a merge-base diff against a PR base, so the allowlist comes for free.

Either half alone leaves the hole (the hook is bypassable with --no-verify; CI sees merged results, not local intent); both together close it the way the entry-port and SSID fences do.

Dominant language
Go
Stars
12
Forks
14
Avg merge
1d 5h
Merged PRs (30d)
239

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from OpenTollGate/tollgate-module-basic-go

All issues in OpenTollGate/tollgate-module-basic-go

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.