ci: add changelog and enforce new entries on every PR

Author: miparnisari

.github/workflows/keep-a-changelog.yaml

@@ -0,0 +1,29 @@
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
+---
+name: "Update unreleased section in CHANGELOG"
+on:
+  pull_request:
+    types: ["opened", "synchronize", "reopened", "ready_for_review", "labeled", "unlabeled"]
+
+permissions:
+  contents: "read"
+
+jobs:
+  changelog:
+    runs-on: "depot-ubuntu-24.04-small"
+    steps:
+      - uses: "dangoslen/changelog-enforcer@ea6a56764870c323a4563f450c0a50c5f2d72cd6"
+        with:
+          skipLabels: 'Skip-Changelog,dependencies,tests'
+      - uses: "actions/checkout@v6"
+      - uses: "actions/setup-node@v6"
+      - run: "npx keep-a-changelog@2.8.0"
+      - run: |
+          files=$(git status --porcelain)
+          if [[ -n ${files}  ]]; then
+            >&2 echo "If your PR has a change that users might care about, please edit the CHANGELOG.md and run \`npx keep-a-changelog\`. Otherwise, add the Skip-Changelog label to your PR."
+            >&2 echo ""
+            >&2 echo "${files}"
+            >&2 echo ""
+            exit 1
+          fi

.goreleaser.yml

@@ -208,7 +208,7 @@ nightly:
 release:
   draft: false
   prerelease: "auto"
-  mode: "replace"
+  mode: "append"
   footer: |
     ## Docker Images
     This release is available at `authzed/spicedb:v{{ .Version }}`, `quay.io/authzed/spicedb:v{{ .Version }}`, `ghcr.io/authzed/spicedb:v{{ .Version }}`