[szibis]

Summary

A release, and the changelog entry that goes with it, are for changes users receive. This PR makes both depend on one question, "does anything that ships change?", instead of on the infra or product classification and on commit subjects.

Bench, test suites (Go e2e, Playwright), the conformance registry and evidence, scripts, workflows, compose files, examples, docs and the website never cut a release and never need a changelog entry.

CI scoping is untouched: classify(), scope(), the rule tables and their test expectations are unchanged.

Shipped paths

A path ships when it matches one of these (SHIPPED in scripts/ci/change_scope.py):

Glob	Why
cmd/**, internal/**, pkg/**	compiled into the binary and image. *_test.go files and any testdata/ directory are excluded: they are compiled into nothing (no go:embed exists, and a test guards that)
go.mod, go.sum	dependency set of the binary
Dockerfile, .dockerignore	the image build and its context
charts/**	the packaged Helm chart, including templates/tests/**
dashboard/**, alerting/**	the sources scripts/ci/sync_observability_assets.sh copies into the chart, and the files the operations guide points users at

pkg/** has no files today; it is kept so a package added there ships without anyone editing the table (the dead-glob guard allows it explicitly and fails once the directory exists, so the exemption gets removed).

A path that cannot be placed (empty, absolute, ..) does not ship. This is the opposite of the CI classifier, which treats it as product, because releasing on a guess is the mistake this prevents. change_scope.py --ships prints ships=true|false; an empty list or an internal error prints ships=true, as the release bot always behaved, and its remaining checks (changelog content, labels) stay the deciding gate then.

Behaviour

Case	Before	After
fix: touching only internal/x/y_test.go	entry required	no entry
fix: / feat: touching only bench/, test/, conformance/, scripts/ or .github/	entry required for bench, test and registry paths and for the scripts the classifier keeps as product (rules P1 to P3: security, e2e and compat scripts, smoke-test.sh, the wait_* scripts, the quality and conformance gates); no entry for other scripts, .github/ and the classifier itself (P4)	no entry
Fix that edits internal/x/y.go and internal/x/y_test.go	entry required	entry required
Any change under charts/ (including templates/tests/**), dashboard/, alerting/, Dockerfile, .dockerignore, go.mod, go.sum, cmd/, internal/	entry required	entry required
Dependency-only PR that ships (go.mod, go.sum, Dockerfile)	exempt	exempt
Dependency-only PR for bench or test manifests	exempt	exempt
Release metadata sync, edit of released history	unchanged	unchanged
Push to main where nothing since the tag ships (after the Chart.yaml version-only filter)	classifier decided; bench, test and registry changes released	"Nothing that ships changed since ; skipping release"
Push to main where something ships	release	release
Go toolchain bumps	nothing tied the workflow pins to the shipped files	a workflow-only go-version bump fails CI; a real bump must change go.mod and the Dockerfile, which ship, so it releases

Go toolchain pin test (scripts/ci/tests/test_go_toolchain_pins.py, run in the lint job's unit-test step): the go.mod go directive (and toolchain directive when present), the Dockerfile golang: builder image, and every actions/setup-go go-version: in all workflows must be the same version. All workflows are included, not only auto-release.yaml and release.yaml (which build the release binaries and are asserted to be present), because every workflow already runs the same version and one rule is simpler than two. Each setup-go step must carry a literal go-version.

Changes

• scripts/ci/change_scope.py: SHIPPED, NOT_SHIPPED_GO, ships(), any_ships(), --ships.
• scripts/ci/check_changelog_pr.py: should_require_changelog is "any changed file ships" (with no files, a release-type subject is the only evidence). Obsolete path tables and helpers are removed. The dependency-only exemption, the released-history guard and the metadata-sync exemption are unchanged.
• .github/workflows/auto-release.yaml: the since-last-tag decision calls change_scope.py --ships after the existing Chart.yaml version-only filter. No new run: interpolation.
• .github/workflows/ci.yaml: one line, adds the toolchain pin test to the unit-test step.
• Tests: test_change_scope.py (ships table, real PR fixtures, dead-glob guards, CLI), test_check_changelog_pr.py, new test_go_toolchain_pins.py.

Changed existing assertions in test_check_changelog_pr.py:

• fix(proxy) with README.md and bench/ab/daily.py: now no entry (a second case with internal/proxy/tail.go keeps the entry);
• test: with test/e2e-compat/features_test.go: now no entry;
• the three "benchmark harness / registry changes still require changelog" assertions: now no entry (test renamed; the third case's subject changed from bench: to feat: to show the subject no longer matters);
• fix: with internal/x/y_test.go: now no entry (test renamed);
• is_dependency_only_pr with bench/visual/package.json and bench/visual/run.py: now exempt (the script ships nothing); the rejecting case now pairs the manifest with internal/proxy/proxy.go;
• the "product paths are not non-release" list drops bench/ab/daily.py, bench/visual/package.json and conformance/registry/baseline.json, which move to a new non-release test; it gains dashboard/loki-vl-proxy.json, alerting/loki-vl-proxy-prometheusrule.yaml and the chart test template.

Proofs

• python3 -m unittest discover -s scripts/ci/tests -p 'test_*.py': 181 tests, OK.
• The lint job's unit-test list (including the new test): 176 tests, OK.
• python3 scripts/ci/check_changelog_pr.py --base origin/main --head HEAD on this branch: skipped (no releasable changes detected).
• Real pull request file lists: ci: the daily report pull request passes the changelog and label checks and never cuts a release #807, build(deps): bump nginx from 1.27-alpine to 1.29-alpine in /test/e2e-compat in the test-stack-images group across 1 directory #810, build(deps-dev): bump @playwright/test from 1.59.1 to 1.64.1 in /test/e2e-ui in the e2e-ui-deps group #811, build(deps-dev): bump @playwright/test from 1.59.1 to 1.64.1 in /bench/visual in the visual-deps group #813, build(deps): bump semgrep from 1.161.0 to 1.181.0 in /security in the semgrep-deps group across 1 directory #814, build(deps): bump the website-deps group in /website with 2 updates #815, build(deps): bump certifi from 2026.7.22 to 2026.10.19 in /security #816, build(deps): bump the actions-minor group with 3 updates #817, ci: classify pull request changes as infra or product #820, ci: infra-only pull requests need no changelog entry and cut no release #821, ci: skip the product jobs in CI for infra-only pull requests #822, ci: skip product checks in the other workflows for infra-only pull requests #823, ci: give the compose validation a placeholder peer token #826 and bench: daily performance report 2026-10-22 #805 ship nothing; ci: pin tool and test images by digest, pip installs by hash, and widen Dependabot #808 (chart test template), build(deps): bump github.com/klauspost/compress from 1.20.1 to 1.20.3 in the go-minor group #812 (go.mod), docs: pin example images, require a peer token in examples, add a Dockerfile HEALTHCHECK #819 (Dockerfile), fix(security): resolve the open Semgrep code-scanning alerts in the release workflows and the unwrap check #804 and fix: count, min, max and avg read one value per Loki series #582 ship.
• Release decision replayed with the workflow's logic over real ranges:

Range	Result
v2.24.4..0638246c (#807)	skip
v2.25.1..origin/main (workflows, scripts, tests, Chart.yaml version only)	skip
v2.24.5..6c20fb03 (#808)	release (chart test template)
v2.25.0..17aa57c1 (#819)	release (Dockerfile, go.mod, go.sum)
v2.24.3..v2.24.4	release (internal/)

• actionlint: no findings. zizmor 1.30.1 --offline: identical output to main (no findings).
• Negative check of the pin test: changing go-version in release.yaml alone fails it.

Not applicable

This PR ships nothing; product checks (e2e vs Loki, Grafana range matrix, visual, A/B, benchstat, load) do not apply. No changelog entry and no release.

It edits scripts/ci/change_scope.py, which is rule P4, so its own CI run is the full product run.

[github-actions]

PR Quality Report

Compared against base branch main.

Coverage and tests

Signal	Base	PR	Delta
Test count	11827	11827	0
Coverage	88.3%	88.3%	0.0% (stable)

Compatibility

Track	Base	PR	Delta
Loki API	100.0%	11/11 (100.0%)	0.0% (stable)
Logs Drilldown	100.0%	17/17 (100.0%)	0.0% (stable)
VictoriaLogs	100.0%	11/11 (100.0%)	0.0% (stable)

Performance smoke

Performance smoke was skipped for this PR because no perf-sensitive paths changed.

State

• Coverage, compatibility, and sampled performance are reported here from the same PR workflow.
• This is a delta report, not a release gate by itself. Required checks still decide merge safety.
• Performance smoke was intentionally skipped because no perf-sensitive paths changed in this PR.
• Delta states use the same noise guards as the quality gate (percent + absolute + low-baseline checks), so report labels match merge-gate behavior.