ci: make changelog releases deterministic

Author: You

.github/workflows/changelog.yml

@@ -19,6 +19,23 @@ jobs:
         run: git tag -d beta
         continue-on-error: true
 
-      - run: npx changelogithub # or changelogithub@0.12 if ensure the stable result
+      - name: Verify release token
         env:
-          GITHUB_TOKEN: ${{secrets.MY_TOKEN}}
+          GH_TOKEN: ${{ secrets.MY_TOKEN }}
+          TAG_NAME: ${{ github.ref_name }}
+        run: |
+          if [ -z "$GH_TOKEN" ]; then
+            echo "::error::MY_TOKEN is not configured"
+            exit 1
+          fi
+          curl --fail-with-body --silent --show-error \
+            --header "Authorization: Bearer ${GH_TOKEN}" \
+            --header "Accept: application/vnd.github+json" \
+            --header "X-GitHub-Api-Version: 2022-11-28" \
+            "https://api.github.com/repos/${GITHUB_REPOSITORY}/git/ref/tags/${TAG_NAME}" \
+            >/dev/null
+
+      - name: Create GitHub release
+        run: npx --yes changelogithub@13.16.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.MY_TOKEN }}