Add CI job to check that changelog is up-to-date when making releases

Author: lang-m

.github/workflows/publish.yml

@@ -29,6 +29,48 @@ jobs:
       - name: Check that version and tag are identical
         run: test $GITHUB_REF_NAME = $VERSION
 
+  check_changelog:
+    name: Check changelog is up-to-date
+    needs: check_version
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check that changes/ is empty
+        shell: bash
+        run: |
+          set -euo pipefail
+          # Count every *.md file except README.md in changes/
+          count=$(find changes -type f -name '*.md' ! -name 'README.md' | wc -l)
+
+          if [ "$count" -ne 0 ]; then
+            echo "::error::There are still $count news fragment(s) in 'changes/'."
+            echo "Run 'towncrier build' and commit the updated CHANGELOG.md."
+            exit 1
+          fi
+          echo "No news fragments left in changes/"
+      - name: Check CHANGELOG.md heading
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          # Extract the first level 2 heading
+          first_h2=$(grep -m1 -E "^## \[blaupause ${GITHUB_REF_NAME//./\\.}\]" CHANGELOG.md || true)
+
+          if [ -z "$first_h2" ]; then
+            echo "::error::No level-2 (##) heading found in CHANGELOG.md."
+            exit 1
+          fi
+
+          echo "First heading in CHANGELOG.md: '$first_h2'"
+
+          expected="## [blaupause $GITHUB_REF_NAME]"
+          if [ "$first_h2" != "$expected" ]; then
+            echo "::error::First heading must be '$expected'"
+            exit 1
+          fi
+
+          echo "✔ CHANGELOG heading matches the pushed tag ($tag)"
+
   publish-to-pypi:
     name: Publish to PyPI
     if: startsWith(github.ref, 'refs/tags/')  # only publish on tag pushes