Warn about direct CHANGELOG.md changes in PR checks

Split workflow activation from #4217 while keeping the comment action loaded from trusted main.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

.github/workflows/pr-checks.yml

@@ -95,6 +95,8 @@ jobs:
       contents: read
     runs-on: ubuntu-26.04
     timeout-minutes: 10
+    outputs:
+      changelog-modified: ${{ steps.changelog-check.outputs.modified }}
 
     concurrency:
       cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
@@ -188,6 +190,20 @@ jobs:
           path: ${{ runner.temp }}/repo-size/
           if-no-files-found: error
 
+      - name: Check for CHANGELOG.md changes
+        id: changelog-check
+        if: steps.fetch-base.outcome == 'success'
+        env:
+          BASE_SHA: ${{ steps.fetch-base.outputs.merge_base }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          if ! git diff --exit-code --quiet "$BASE_SHA" "$HEAD_SHA" -- CHANGELOG.md; then
+            echo "CHANGELOG.md was modified in this PR."
+            echo "modified=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "modified=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: "Backport: Check out base ref"
         id: checkout-base
         if: ${{ startsWith(github.head_ref, 'backport-') }}
@@ -208,8 +224,8 @@ jobs:
             exit 1
           fi
 
-  post-repo-size-comment:
-    name: Post repo size comment
+  post-pr-comments:
+    name: Post PR comments
     needs: other-checks
     # Keep write permissions isolated from the job that checks out and tests PR code. This job only
     # posts the candidate comment body produced by the read-only `pr-checks` job.
@@ -229,6 +245,22 @@ jobs:
       group: check-repo-size-${{ github.event.pull_request.number }}
 
     steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Check out main, not the PR's head, since this job runs with
+          # `pull-requests: write` permissions and must not execute untrusted code from the PR.
+          ref: main
+
+      - name: Set up Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci --workspace=pr-checks
+
       - name: Download repo size comment
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
@@ -258,3 +290,42 @@ jobs:
           else
             echo "Skipping repo size comment because the delta is below the threshold and no sticky comment exists."
           fi
+
+      - name: Post a warning about modifying CHANGELOG.md
+        # Release, backport, mergeback, and bundle-update PRs deliberately modify CHANGELOG.md,
+        # so skip comment management entirely for these automation flows.
+        if: >-
+          needs.other-checks.outputs.changelog-modified == 'true' &&
+          !startsWith(github.event.pull_request.head.ref, 'update-v') &&
+          !startsWith(github.event.pull_request.head.ref, 'backport-v') &&
+          !startsWith(github.event.pull_request.head.ref, 'mergeback/') &&
+          !startsWith(github.event.pull_request.head.ref, 'update-bundle/')
+        uses: ./.github/actions/post-comment
+        with:
+          marker: "post-comment:CHANGELOG.md"
+          body: |
+            ⚠️ `CHANGELOG.md` has been modified in this PR. Please do not modify `CHANGELOG.md` directly.
+            Instead, create a change-note file in `unreleased-change-notes/`. The `CHANGELOG.md`
+            file will be automatically generated from those change-notes.
+            See [`unreleased-change-notes/README.md`](https://github.com/github/codeql-action/blob/main/unreleased-change-notes/README.md) for more information.
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Mark the CHANGELOG.md concern as resolved
+        if: >-
+          needs.other-checks.outputs.changelog-modified == 'false' &&
+          !startsWith(github.event.pull_request.head.ref, 'update-v') &&
+          !startsWith(github.event.pull_request.head.ref, 'backport-v') &&
+          !startsWith(github.event.pull_request.head.ref, 'mergeback/') &&
+          !startsWith(github.event.pull_request.head.ref, 'update-bundle/')
+        uses: ./.github/actions/post-comment
+        with:
+          marker: "post-comment:CHANGELOG.md"
+          update-only: true
+          body: |
+            ⚠️ `CHANGELOG.md` has been modified in this PR. Please do not modify `CHANGELOG.md` directly.
+            Instead, create a change-note file in `unreleased-change-notes/`. The `CHANGELOG.md`
+            file will be automatically generated from those change-notes.
+            See [`unreleased-change-notes/README.md`](https://github.com/github/codeql-action/blob/main/unreleased-change-notes/README.md) for more information.
+
+            **Edit:** `CHANGELOG.md` is no longer modified in this PR. This concern is resolved.
+          token: ${{ secrets.GITHUB_TOKEN }}