ci: auto-generate rpm changelog entry per release

On every tag push, build a %changelog entry from the git log since
the previous v* tag and prepend it to each spec. Stops the initial
entry from drifting further and catches bogus-date / stale-version
warnings automatically since the generated date always matches the
day the CI runs.

The generator drops "chore: bump version" commits (bot-authored,
noisy in user-facing changelogs) and merge commits. Author defaults
to the gitea-actions identity but can be overridden via
CHANGELOG_AUTHOR env var if a human release is desired.

Requires fetch-depth: 0 on checkout so git describe can see prior
tags and git log can reach them.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/scripts/generate-rpm-changelog.sh

@@ -0,0 +1,65 @@
+#!/bin/bash
+# Generate an rpm %changelog entry for this release and prepend it to
+# the spec's existing %changelog section.
+#
+# Usage: generate-rpm-changelog.sh <spec-file> <version>
+#
+# Collects commits since the previous v* tag, drops the bump-version
+# chore commits generated by CI, and writes a dated entry attributed
+# to $CHANGELOG_AUTHOR (defaults to the gitea-actions bot identity).
+
+set -euo pipefail
+
+SPEC="$1"
+VERSION="$2"
+AUTHOR="${CHANGELOG_AUTHOR:-Gitea Actions <actions@git.lair.cafe>}"
+
+if [ ! -f "$SPEC" ]; then
+  echo "error: spec file not found: $SPEC" >&2
+  exit 1
+fi
+
+# Find the previous release tag (exclude the current tag at HEAD).
+PREV_TAG=$(git describe --tags --abbrev=0 --match='v*' HEAD^ 2>/dev/null || echo "")
+
+if [ -n "$PREV_TAG" ]; then
+  RANGE="${PREV_TAG}..HEAD"
+  LOG=$(git log --no-merges --pretty=format:'- %s' "$RANGE" \
+          | grep -v '^- chore: bump version' \
+          | grep -v '^- Merge ' \
+          || true)
+else
+  LOG=""
+fi
+
+if [ -z "$LOG" ]; then
+  LOG="- No user-visible changes"
+fi
+
+DATE=$(LC_ALL=C date -u +'%a %b %d %Y')
+ENTRY="* ${DATE} ${AUTHOR} - ${VERSION}-1
+${LOG}
+"
+
+# Prepend the entry to the %changelog section.
+TMP=$(mktemp)
+awk -v entry="$ENTRY" '
+  inserted == 0 && /^%changelog[[:space:]]*$/ {
+    print
+    print entry
+    inserted = 1
+    next
+  }
+  { print }
+' "$SPEC" > "$TMP"
+
+if ! grep -q '^%changelog' "$SPEC"; then
+  echo "error: no %changelog section in $SPEC — refusing to mangle" >&2
+  rm -f "$TMP"
+  exit 1
+fi
+
+mv "$TMP" "$SPEC"
+
+echo "Added changelog entry for ${VERSION}:"
+echo "$ENTRY"

.gitea/workflows/ci.yml

@@ -66,6 +66,8 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Determine version
         id: version
@@ -79,6 +81,9 @@ jobs:
           sed -i '/\[workspace\.package\]/,/\[/{ s/^version = ".*"/version = "'"${VERSION}"'"/ }' Cargo.toml
           sed -i "s/^Version:.*/Version:        ${VERSION}/" cortex.spec
 
+      - name: Generate changelog entry
+        run: bash .gitea/scripts/generate-rpm-changelog.sh cortex.spec "${{ steps.version.outputs.VERSION }}"
+
       - name: Generate source tarball
         run: |
           set -ex
@@ -118,6 +123,8 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Determine version
         id: version
@@ -131,6 +138,9 @@ jobs:
           sed -i '/\[workspace\.package\]/,/\[/{ s/^version = ".*"/version = "'"${VERSION}"'"/ }' Cargo.toml
           sed -i "s/^Version:.*/Version:        ${VERSION}/" neuron.spec
 
+      - name: Generate changelog entry
+        run: bash .gitea/scripts/generate-rpm-changelog.sh neuron.spec "${{ steps.version.outputs.VERSION }}"
+
       - name: Generate source tarball
         run: |
           set -ex