[szibis]

The failure this catches

When a release is cut while a branch is open, rebasing that branch moves its CHANGELOG entries into the version section that was just materialized. Because the ### Fixed / ### Added headings match on both sides, git merges it without a conflict — nothing warns, and the entries end up attributed to a release that never contained them.

This happened on four branches in a row today (#597, #582, #587, #594), twice silently. Each time it was caught only because it was checked by hand afterwards; the gate itself was happy.

The check

For any pull request touching CHANGELOG.md, everything from the first released version heading (## [x.y.z]) down must be byte-identical to the base branch. Released history is immutable once published.

changelog gate: released version sections must match the base branch — entries belong under
[Unreleased]. A rebase across a release moves them into the version that was cut while the
branch was open, without a conflict. Rebuild CHANGELOG.md from the base and re-insert your
entries under [Unreleased] (a deliberate history fix uses a docs(changelog) commit).

Escape hatches, both already in use here:

• the release-metadata sync path returns before this check, so the bot's own materialization is unaffected;
• a deliberate correction of released history (moving a misfiled entry back, as docs: file the backend-protection entries under Unreleased, not v1.83.0 #589 did) uses a docs(changelog) commit.

Verification

Simulated the exact trap on top of current main — one entry inserted at the top of the newest released section, everything else untouched:

$ python3 scripts/ci/check_changelog_pr.py --base origin/main --head HEAD
changelog gate: released version sections must match the base branch — ...
gate exit=1

Run against the four open branches that currently carry [Unreleased] entries, all of which were repaired by hand:

feat/conformance-evidence            changelog gate: ok
fix/vl-memory-allowed-bytes          changelog gate: ok
fix/series-count-aggregations        changelog gate: ok
fix/parser-capture-series-identity   changelog gate: ok

Gate unit tests: 27 pass (3 new — section extraction, the no-releases case, and docs(changelog) detection).

[github-actions]

PR Quality Report

Compared against base branch main.

Coverage and tests

Signal	Base	PR	Delta
Test count	7387	7387	0
Coverage	90.1%	90.1%	0.0% (stable)

Compatibility

Track	Base	PR	Delta
Loki API	100.0%	11/11 (100.0%)	0.0% (stable)
Logs Drilldown	100.0%	17/17 (100.0%)	0.0% (stable)
VictoriaLogs	100.0%	11/11 (100.0%)	0.0% (stable)

Performance smoke

Performance smoke was skipped for this PR because no perf-sensitive paths changed.

State

• Coverage, compatibility, and sampled performance are reported here from the same PR workflow.
• This is a delta report, not a release gate by itself. Required checks still decide merge safety.
• Performance smoke was intentionally skipped because no perf-sensitive paths changed in this PR.
• Delta states use the same noise guards as the quality gate (percent + absolute + low-baseline checks), so report labels match merge-gate behavior.