Require next-major targets for breaking changes

[jar-stripe]

Why?

Breaking SDK changes must land on sdk-release/next-major so they do not enter the current major release from master.

What?

• Default workflow token permissions to none, with read-only permissions granted only to the changefile rule.
• Add a rules job that finds newly added top-level Hark changefiles through the paginated pull request files API.
• Inspect new changefiles with Hark and require major changes to target sdk-release/next-major.
• Allow the release pull request that merges sdk-release/next-major into master.
• Rerun the rules workflow when pull request contents or the base branch change.
• Add a patch changefile for this user-facing workflow behavior.
• Verify the generated workflow matches the sdk-codegen template, passes actionlint, and passes repository CI.

See Also

Configuration

• skip-changefile: This PR is not a user-facing change, so there's no changefile.

[Copilot]

🟡 Changes recommended

Unresolved workflow issues include an unpinned action, missed renamed changefiles, and an expanded squash-policy gate.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds CI enforcement requiring major Hark changes to target sdk-release/next-major.

Changes:

• Adds paginated changefile inspection and branch validation.
• Restricts workflow permissions and updates triggers.
• Adds a patch changefile documenting the behavior.

File summaries

File	Description
.hark/changes/2026-09-18_jar_require-next-major-target.change.md	Documents the workflow behavior change.
.github/workflows/rules.yml	Implements changefile targeting checks and workflow updates.

Review details

Suppressed comments (2)

.github/workflows/rules.yml:28

• This changes the existing rule for every auto-merge-enabled PR: non-/merge- branches now default to squash and will fail if they use merge or rebase. The previous rule only constrained merge-script PRs, and the PR description does not call out a repository-wide squash requirement; please preserve the previous scope or explicitly establish this new policy before changing the gate.

          expected_merge_method="squash"
          # for merge PRs, expect "merge"
          if [ ${{ contains(github.head_ref, '/merge-') }} == "true" ]; then
              expected_merge_method="merge"
          fi

.github/workflows/rules.yml:56

• This filter misses a changefile that is renamed into .hark/changes/: GitHub reports that file with status: "renamed", so a major changefile at the new path can bypass the target-branch check. Treat renamed files as newly added (or otherwise inspect the final path) before running hark inspect.

          if ! paths=$(jq -sc             '[.[] | select(.status == "added") | .filename | select(test("^[.]hark/changes/[^/]+[.]change[.]md$"))]'             <<< "$files" 2>&1); then

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[zacchua-stripe]

Same question as stripe/stripe-dotnet#3456 (comment) !