docs: resolve changelog link and automate changelog updates for #253

[boscorat]

Resolves #253

Summary

This PR addresses all items in issue #253:

Changes

1. Fix broken links (/main/ → /master/)

• Fixed CHANGELOG.md link in
• Fixed CONTRIBUTING.md link in
• Both links were pointing to non-existent main branch instead of master

2. Update CHANGELOG.md with missing releases

• Added v0.2.3 (2026-10-07) with summary and comprehensive release notes
• Added v0.2.2 (2026-09-15) with summary and comprehensive release notes
• Added v0.2.1 (2026-09-10) with summary and comprehensive release notes
• Each entry includes: summary, Added, Fixed, Documentation, and Changed sections
• Each entry links to GitHub compare view

3. Automate future changelog updates

• Created new GitHub Actions workflow: .github/workflows/update-changelog.yml
• Workflow triggers when a release is published (draft → published)
• Steps:
  1. Extracts release information from GitHub event
  2. Strips auto-generated sections (Downloads, Security Scan Results)
  3. Reformats release body to Keep a Changelog format
  4. Finds previous tag for comparison link
  5. Creates a PR to update CHANGELOG.md for review
• Since master is protected, the workflow creates a PR rather than auto-committing
• This ensures changelog updates are reviewed before merge

Testing

The workflow will be tested when the next draft release is published. It will:

• Automatically create a PR with changelog update
• PR can be reviewed and merged before the release is promoted

Why a PR instead of auto-commit?

Master branch is protected, so the workflow creates a PR instead of auto-committing. This:

• Maintains review workflow
• Allows changelog accuracy verification
• Keeps audit trail of automated actions

[Copilot]

🟡 Changes recommended

The new workflow interpolates untrusted release text directly into a shell script (injection + multi-line breakage) and grants only contents: read, which blocks the create-pull-request step it depends on.

2 open findings

• Workflow lacks write permissions for PR creation · New
• Release body interpolation enables shell injection · New

What changed in this PR

This PR resolves issue #253 by fixing broken /main/ GitHub links (the repo uses the master branch), back-filling the CHANGELOG.md with the v0.2.1–v0.2.3 releases, and adding a GitHub Actions workflow that opens a changelog-update PR whenever a release is published. It improves documentation accuracy and reduces manual release-note maintenance.

Changes:

• Corrected changelog/contributing links from /blob/main/ to /blob/master/ in mkdocs.yml and docs/community.md (repo-wide /main/ links are now fully cleaned up, and compare-link tags all exist).
• Added structured ## [0.2.3] / [0.2.2] / [0.2.1] entries with summaries, sections, and valid GitHub compare links to CHANGELOG.md.
• Added .github/workflows/update-changelog.yml to auto-generate a changelog PR on release publish.

File	Description
mkdocs.yml	Fix Changelog nav link to use the master branch.
docs/​community.md	Fix CONTRIBUTING.md link to use the master branch.
CHANGELOG.md	Add v0.2.1–v0.2.3 release entries with compare links.
.github/​workflows/​update-changelog.yml	New release-triggered workflow that opens a changelog-update PR (has a script-injection/multiline bug and insufficient permissions).

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The 3-space indentation on mkdocs.yml line 115 produces invalid YAML that breaks the docs build and must be corrected to 2 spaces.

1 open finding

• Fix invalid YAML indentation in nav entry · New

2 resolved since last review

• Release body interpolation enables shell injection
• Workflow lacks write permissions for PR creation

Previously missed (1)

In code that hasn't changed since last review

Use a PAT so auto-generated PRs trigger CI

.github/​workflows/​update-changelog.yml:167

Pull requests created by peter-evans/create-pull-request using the default secrets.GITHUB_TOKEN do not trigger other workflows (on: push / on: pull_request) — this is an intentional GitHub safeguard against recursive runs. Since CI (ci.yml) and the docs build run on pull_request: branches: [master], the auto-generated changelog PR will have no status checks, so it cannot be merged automatically if master's branch protection requires those checks to pass. Consider using a dedicated PAT or GitHub App token for the token input (and the checkout) so the created PR runs the required checks.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🟡 Changes recommended

The automation relies on a GITHUB_TOKEN-created PR that won't trigger required CI on protected master, plus a changelog duplicate and an unhardened shell interpolation that should be addressed.

1 open finding

• GITHUB_TOKEN-created PRs may not trigger CI or pass branch protection · New

1 resolved since last review

• Fix invalid YAML indentation in nav entry

Previously missed (1)

In code that hasn't changed since last review

Duplicate changelog entry for organization JSON-LD schema

CHANGELOG.md:105

This entry duplicates "Organization JSON-LD schema to homepage", which already appears earlier in this same Added list (with the (#131) reference). Remove this redundant line to avoid a duplicate changelog entry.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.