From 05870b623f9da2693ae1ceb146f1810dbc4b26ba Mon Sep 17 00:00:00 2001
From: Mario Campos <mario-campos@github.com>
Date: Tue, 3 Nov 2026 11:13:53 -0600
Subject: [PATCH] Defer workflow activation to a follow-up PR

Keep the post-comment implementation independent of the workflow that loads it from main.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/pr-checks.yml | 75 +--------------------------------
 1 file changed, 2 insertions(+), 73 deletions(-)

diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index b72c45774..5d2b1576f 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -95,8 +95,6 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    outputs:
-      changelog-modified: ${{ steps.changelog-check.outputs.modified }}
 
     concurrency:
       cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
@@ -185,20 +183,6 @@ jobs:
           path: ${{ runner.temp }}/repo-size/
           if-no-files-found: error
 
-      - name: Check for CHANGELOG.md changes
-        id: changelog-check
-        if: steps.fetch-base.outcome == 'success'
-        env:
-          BASE_SHA: ${{ steps.fetch-base.outputs.merge_base }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          if ! git diff --exit-code --quiet "$BASE_SHA" "$HEAD_SHA" -- CHANGELOG.md; then
-            echo "CHANGELOG.md was modified in this PR."
-            echo "modified=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "modified=false" >> "$GITHUB_OUTPUT"
-          fi
-
       - name: "Backport: Check out base ref"
         id: checkout-base
         if: ${{ startsWith(github.head_ref, 'backport-') }}
@@ -219,8 +203,8 @@ jobs:
             exit 1
           fi
 
-  post-pr-comments:
-    name: Post PR comments
+  post-repo-size-comment:
+    name: Post repo size comment
     needs: other-checks
     # Keep write permissions isolated from the job that checks out and tests PR code. This job only
     # posts the candidate comment body produced by the read-only `pr-checks` job.
@@ -240,22 +224,6 @@ jobs:
       group: check-repo-size-${{ github.event.pull_request.number }}
 
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          # Check out main, not the PR's head, since this job runs with
-          # `pull-requests: write` permissions and must not execute untrusted code from the PR.
-          ref: main
-
-      - name: Set up Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version: 24
-          cache: "npm"
-
-      - name: Install dependencies
-        run: npm ci --workspace=pr-checks
-
       - name: Download repo size comment
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
@@ -285,42 +253,3 @@ jobs:
           else
             echo "Skipping repo size comment because the delta is below the threshold and no sticky comment exists."
           fi
-
-      - name: Post a warning about modifying CHANGELOG.md
-        # Release, backport, mergeback, and bundle-update PRs deliberately modify CHANGELOG.md,
-        # so skip comment management entirely for these automation flows.
-        if: >-
-          needs.other-checks.outputs.changelog-modified == 'true' &&
-          !startsWith(github.event.pull_request.head.ref, 'update-v') &&
-          !startsWith(github.event.pull_request.head.ref, 'backport-v') &&
-          !startsWith(github.event.pull_request.head.ref, 'mergeback/') &&
-          !startsWith(github.event.pull_request.head.ref, 'update-bundle/')
-        uses: ./.github/actions/post-comment
-        with:
-          marker: "post-comment:CHANGELOG.md"
-          body: |
-            ⚠️ `CHANGELOG.md` has been modified in this PR. Please do not modify `CHANGELOG.md` directly.
-            Instead, create a change-note file in `unreleased-change-notes/`. The `CHANGELOG.md`
-            file will be automatically generated from those change-notes.
-            See [`unreleased-change-notes/README.md`](https://github.com/github/codeql-action/blob/main/unreleased-change-notes/README.md) for more information.
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Mark the CHANGELOG.md concern as resolved
-        if: >-
-          needs.other-checks.outputs.changelog-modified == 'false' &&
-          !startsWith(github.event.pull_request.head.ref, 'update-v') &&
-          !startsWith(github.event.pull_request.head.ref, 'backport-v') &&
-          !startsWith(github.event.pull_request.head.ref, 'mergeback/') &&
-          !startsWith(github.event.pull_request.head.ref, 'update-bundle/')
-        uses: ./.github/actions/post-comment
-        with:
-          marker: "post-comment:CHANGELOG.md"
-          update-only: true
-          body: |
-            ⚠️ `CHANGELOG.md` has been modified in this PR. Please do not modify `CHANGELOG.md` directly.
-            Instead, create a change-note file in `unreleased-change-notes/`. The `CHANGELOG.md`
-            file will be automatically generated from those change-notes.
-            See [`unreleased-change-notes/README.md`](https://github.com/github/codeql-action/blob/main/unreleased-change-notes/README.md) for more information.
-
-            **Edit:** `CHANGELOG.md` is no longer modified in this PR. This concern is resolved.
-          token: ${{ secrets.GITHUB_TOKEN }}