ci: harden assign-prs and remove mirror-changelog

.github/workflows/assign-prs.yml

@@ -15,8 +15,11 @@
 name: PR assignment
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] - needs write token on fork PRs; never checks out or runs PR code
     types: [opened, edited, reopened]
+    branches: [main]
+
+permissions: {}
 
 jobs:
   auto-assign:
@@ -26,7 +29,7 @@ jobs:
       pull-requests: write
     steps:
       - name: "Auto-assign PR"
-        uses: pozil/auto-assign-issue@v2
+        uses: pozil/auto-assign-issue@7bf9d82c77d45976224660b873fc83e60576c5aa # v2
         with:
           assignees: dolphin1999
           numOfAssignee: 1

DEVELOPER.md

@@ -95,39 +95,7 @@ The primary maintainers for this repository are defined in the
 
 ### Releasing
 
-The release process is automated using `release-please`. It consists of an automated changelog preparation step followed by the manual merging of a Release PR.
-
-#### Automated Changelog Enrichment
-
-Before a Release PR is even created, a special workflow automatically mirrors
-relevant changelogs from the core `googleapis/genai-toolbox` dependency. This
-ensures that the release notes for this extension accurately reflect important
-upstream changes.
-
-The process is handled by the [`mirror-changelog.yml`](.github/workflows/mirror-changelog.yml) workflow:
-
-1. **Trigger:** The workflow runs automatically on pull requests created by
-   Renovate for `toolbox` version updates.
-2. **Parsing:** It reads the detailed release notes that Renovate includes in
-   the PR body.
-3. **Filtering:** These release notes are filtered to include only changes
-   relevant to this extension. The relevance is determined by a keyword (e.g.,
-   `mysql`), passed as an environment variable in the workflow file.
-4. **Changelog Injection:** The script formats the filtered entries as
-   conventional commits and injects them into the PR body within a
-   `BEGIN_COMMIT_OVERRIDE` block.
-5. **Release Please:** When the main Release PR is created, `release-please`
-   reads this override block instead of the standard `chore(deps): ...` commit
-   message, effectively mirroring the filtered upstream changelog into this
-   project's release notes.
-
-> **Note for Maintainers:** The filtering script is an automation aid, but it
-> may occasionally produce "false positives" (e.g., an internal logging change
-> that happens to contain the keyword). Before merging a `toolbox` dependency
-> PR, maintainers must **review the generated `BEGIN_COMMIT_OVERRIDE` block**
-> and manually delete any lines that are not relevant to the end-users of this
-> extension. The curated override block is the final source of truth for the
-> release changelog.
+The release process is automated using `release-please`. It consists of the manual merging of a Release PR.
 
 #### Release Process