From fd07163946c6c16ece59926989080d0307d8d00d Mon Sep 17 00:00:00 2001
From: Tim Collins <tim@thecollins.team>
Date: Thu, 19 Mar 2026 14:07:07 +0000
Subject: [PATCH 1/2] feat(ci): Linter to check that the changelog was
 replaced, not appended

Signed-off-by: Tim Collins <tim@thecollins.team>
---
 .github/workflows/lint-changelog.yml | 25 +++++++++++++++++++++++++
 scripts/lint-changelog.sh            | 27 +++++++++++++++++++++++++++
 2 files changed, 52 insertions(+)
 create mode 100644 .github/workflows/lint-changelog.yml
 create mode 100755 scripts/lint-changelog.sh

diff --git a/.github/workflows/lint-changelog.yml b/.github/workflows/lint-changelog.yml
new file mode 100644
index 000000000..9570bbca8
--- /dev/null
+++ b/.github/workflows/lint-changelog.yml
@@ -0,0 +1,25 @@
+name: "Lint Changelog"
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - synchronize
+    paths:
+      - "charts/*/Chart.yaml"
+
+permissions:
+  contents: read
+
+jobs:
+  validate-changelog:
+    name: Validate single changelog entry
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
+      - name: Check artifacthub.io/changes entries
+        run: ./scripts/lint-changelog.sh
diff --git a/scripts/lint-changelog.sh b/scripts/lint-changelog.sh
new file mode 100755
index 000000000..24dc241d8
--- /dev/null
+++ b/scripts/lint-changelog.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Validates that each Chart.yaml has at most one entry in artifacthub.io/changes.
+# Contributors often append a new changelog entry instead of replacing the existing one.
+# The annotation should describe only the *current* change; previous entries are captured
+# in git history and the ArtifactHub release feed.
+
+rc=0
+
+for chart_yaml in charts/*/Chart.yaml; do
+  # Count "- kind:" lines inside the artifacthub.io/changes block.
+  # The block is a YAML literal scalar indented under the annotation key,
+  # so entries appear as lines matching "    - kind:" (4-space indent).
+  count=$(grep -c '^\s*- kind:' <<< "$(sed -n '/artifacthub.io\/changes/,/^  [^ ]/p' "$chart_yaml")" || true)
+
+  if [[ "$count" -gt 1 ]]; then
+    echo "::error file=${chart_yaml}::${chart_yaml}: artifacthub.io/changes has ${count} entries (expected 1). Replace the existing entry instead of adding a new one."
+    rc=1
+  fi
+done
+
+if [[ "$rc" -eq 0 ]]; then
+  echo "All charts have a single changelog entry ✔"
+fi
+
+exit $rc

From b7456b8e194b4d009fe14ee6b56c6209d1a418e8 Mon Sep 17 00:00:00 2001
From: Tim Collins <tim@thecollins.team>
Date: Fri, 20 Mar 2026 07:03:19 +0000
Subject: [PATCH 2/2] move to pull_request

Signed-off-by: Tim Collins <tim@thecollins.team>
---
 .github/workflows/lint-changelog.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/lint-changelog.yml b/.github/workflows/lint-changelog.yml
index 9570bbca8..6e1845fea 100644
--- a/.github/workflows/lint-changelog.yml
+++ b/.github/workflows/lint-changelog.yml
@@ -1,7 +1,7 @@
 name: "Lint Changelog"
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - synchronize