Add API changelog check workflow

[jonathan343]

Summary

Add a GitHub Actions workflow to ensure changelog entries are added when manually updating AWS models. When a PR modifies files in codegen/aws-models/, this workflow verifies that a corresponding changelog entry exists in clients/aws-sdk-<service>/.changes/next-release/.

Workflow Behavior

Trigger	Action
PR modifies codegen/aws-models/*.json	Checks for valid changelog entry
skip-changelog label present	Skips the check
Label added/removed	Re-runs to evaluate current state

Validation Requirements

A valid changelog entry must:

• Be a JSON file in clients/aws-sdk-/.changes/next-release/
• Contain "type": "api-change" and a "description" field

Test plan

• Open a PR that modifies a model file without a changelog entry → check fails
• Add a valid changelog entry → check passes
• Add skip-changelog label to a failing PR → check skips
• Remove skip-changelog label → check re-runs and validates

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[SamRemis]

Suggested change

	fetch-depth: 0
	fetch-depth: 0
	persist-credentials: false

Suggestion 1 from zizmor -

This is for removing the git credentials after the git checkout. It prevents later steps from maliciously sending/using the credentials.

[SamRemis]

Suggested change

	changed_models=$(git diff --name-only origin/${{ github.base_ref }}...HEAD -- 'codegen/aws-models/*.json' | xargs -I {} basename {} .json)
	changed_models=$(git diff --name-only origin/${GITHUB_BASE_REF}...HEAD -- 'codegen/aws-models/*.json' | xargs -I {} basename {} .json)

Suggestion 2 from zizmor -

Again, not a major concern since running PRs from untrusted actors is turned off by default, but better safe than sorry.

This uses the builtin GitHub environment variable of GITHUB_BASE_REF to prevent malicious branch names from being executed. Example CVE.

[SamRemis]

Suggested change

	echo "All modified models have corresponding changelog entries."
	echo "All modified models have corresponding changelog entries."
	env:
	STEPS_CHANGED_MODELS_OUTPUTS_MODELS: ${{ steps.changed-models.outputs.models }}

Continuation of the above

[SamRemis]

Suggested change

	done <<< "${{ steps.changed-models.outputs.models }}"
	done <<< "${STEPS_CHANGED_MODELS_OUTPUTS_MODELS}"

Same as above comment

[SamRemis]

Looks good over all - added some suggestions from Zizmor, which we should add to this repo to run over all GH actions to run by default in the long run.