Use the SDK release bot for changelog updates

.github/workflows/update-changelog.yml

@@ -5,28 +5,62 @@ on:
     types: [released]
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   update:
     runs-on: ubuntu-latest
     timeout-minutes: 5
 
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v7
+      - name: Create release bot token
+        id: release-bot
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
         with:
-          ref: main
+          app-id: ${{ vars.LETTERMINT_RELEASE_APP_ID }}
+          private-key: ${{ secrets.LETTERMINT_RELEASE_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: ${{ github.event.repository.name }}
+          permission-contents: write
 
-      - name: Update Changelog
-        uses: stefanzweifel/changelog-updater-action@v1
+      - name: Checkout default branch
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
-          latest-version: ${{ github.event.release.name }}
-          release-notes: ${{ github.event.release.body }}
+          ref: ${{ github.event.repository.default_branch }}
+          token: ${{ steps.release-bot.outputs.token }}
 
-      - name: Commit updated CHANGELOG
-        uses: stefanzweifel/git-auto-commit-action@v7
+      - name: Update changelog from release notes
+        uses: stefanzweifel/changelog-updater-action@a938690fad7edf25368f37e43a1ed1b34303eb36 # v1
         with:
-          branch: main
-          commit_message: Update CHANGELOG
-          file_pattern: CHANGELOG.md
+          latest-version: ${{ github.event.release.tag_name }}
+          release-notes: ${{ github.event.release.body }}
+
+      - name: Verify changed paths
+        shell: bash
+        run: |
+          test -f CHANGELOG.md
+          test ! -L CHANGELOG.md
+
+          mapfile -t changed_paths < <(git status --porcelain=v1 --untracked-files=all | cut -c4-)
+          for path in "${changed_paths[@]}"; do
+            if [[ "$path" != "CHANGELOG.md" ]]; then
+              echo "Unexpected changed path: $path" >&2
+              exit 1
+            fi
+          done
+
+      - name: Commit updated changelog
+        shell: bash
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          if git diff --quiet -- CHANGELOG.md; then
+            echo "CHANGELOG.md is already current."
+            exit 0
+          fi
+
+          git config user.name "lettermint-sdk-release-bot[bot]"
+          git config user.email "331370748+lettermint-sdk-release-bot[bot]@users.noreply.github.com"
+          git add -- CHANGELOG.md
+          git commit -m "Update CHANGELOG"
+          git push origin "HEAD:${DEFAULT_BRANCH}"