feat(changelog): Add configurable AI summaries for CLI and Actions

[MathurAditya724]

Adds opt-in AI summaries to automatic changelogs in the CLI and GitHub Actions. Choose release, category, and scope summaries independently; hidden lower-level digests are reused for higher levels. Both surfaces use one HTTP client, defaulting to Copilot Responses with GPT-6 Luna, with custom Responses or Chat Completions endpoints supported.

changelog:
  policy: auto
  aiSummary:
    levels: [release]
    minItems: 5
    style: Concise and friendly for developers. # optional
    llm:
      endpoint: https://api.githubcopilot.com/responses
      model: gpt-6-luna
      apiKeyEnv: GITHUB_TOKEN

An aiSummary object enables generation; omission or aiSummary: false disables it. Omitted or empty levels use [release]. Summaries appear when original entry counts exceed minItems (default 5), including descendants for categories and the entire changelog for release summaries. A threshold of 0 includes every nonempty selected group. Release-only output leaves originals expanded. Category prose and scope headings/summaries stay visible, with originals folded once per group. Release overviews are plain prose in up to three paragraphs and include every category, and source-linked breaking/security facts survive reductions.

Optional style supplies 1–500 characters of tone guidance at every generation stage while retaining factual, coverage and inert-output safeguards. Craft enables all three levels in its own .craft.yml with minItems: 2 and a concise, friendly writing style for dogfooding. Generation still requires an authorized credential and, for built-in Actions tokens, the organization policy described below; denied requests retain original output.

Connection settings live under llm; credentials come from the named environment variable (default GITHUB_TOKEN). Per-field precedence is explicit CLI flags, structured CRAFT_AI_LLM, scalar environment overrides, then effective project/workspace configuration. The Action accepts llm and an explicit llm_api_key; reusable release workflows forward both. Repository/organization variables are mapped in the calling workflow. Credentials are excluded from argument tracing. Craft sends HTTP requests directly, with no additional runtime installation or release artifact.

Copilot model access depends on the supplied credential. Explicit built-in workflow-token use requires copilot-requests: write and “Allow use of Copilot CLI billed to the organization,” with organization billing. The llm_api_key input selects a separate credential without replacing the release token. Copilot's direct inference backend is outside GitHub's public REST API contract. Custom endpoints receive no Copilot-specific headers, and failures never switch endpoints or providers.

Requests have fixed input/output, concurrency, count, and deadline limits. Strict structured-response validation and escaped generated prose keep summaries inert. Missing credentials, errors, timeouts, refusals, or incomplete coverage retain the entire original output. Dry runs, highlighted previews, --no-changelog, and version analysis make zero model calls; version-bump analysis remains independent.

Validation: 301 focused regressions, lint, type checking, formatting and the documentation build pass locally. The E2E runs under pnpm test in the regular Node 22/24 suites. It builds privately and exercises paths containing spaces, both HTTP formats, configuration precedence and original-output fallback. Regressions cover every level combination, visible scope headings, mixed groups, retained scope labels in reused digests, bounded writing styles and a ten-category prose overview. Final-head CI passes on f512a005383a10841b4bd3fe56e20925cfbe1670, including both Node suites, the native smoke test, container build, security scans and automated reviews. The two publication jobs are skipped for pull requests. Documentation includes release, category, scope and combination examples.

Live CLI samples passed Copilot Luna and OpenRouter Luna requests. The OpenRouter sample on b3769873 passed eight HTTP 200 responses with the revised config, preserving every original entry and the version bump while dry-run, missing-token and aiSummary: false cases made zero calls. Source metadata was a fixture; inference was live. The isolated built-in Actions-token run received HTTP 403 because the required organization policy was disabled. The real CLI and composite Action preserved original entries after the denial; Git pushes stayed local and publishing was stubbed. This is fallback proof, not successful workflow-token inference. Live OpenRouter inference in Actions remains untested. No organization policies were changed, and the live-test workflow is outside this PR.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-10-15 19:18 UTC

[BYK]

We should also enable this feature in Craft itself as part of the PR for demonstration purposes. I'd say we should go with minItems: 2 or less here.

[MathurAditya724]

Enabled AI summaries in Craft’s own .craft.yml in d392453, using levels: [release, category, scope] and minItems: 2 (groups with more than two original entries). The rendering now keeps category and scope prose visible and folds each original group once. All 294 focused regressions pass, including the standalone CLI E2E.

Generation still requires an authorized credential and the documented Copilot permission/policy for built-in workflow-token access; denied access retains the original changelog. No organization policies were changed.

[BYK]

I remember talking about adding a "style" config option too or a prompt override/addendum to give some personality to the output when desired. Where's that?

[MathurAditya724]

Added changelog.aiSummary.style in f512a00 and enabled a concise, friendly developer style in Craft’s own config. It accepts 1–500 characters of tone guidance, applies through both CLI and Actions at every generation stage, and retains the factual, coverage, length, structured-response and inert-prose safeguards. The setting and examples are documented; schema and standalone HTTP E2E regressions pass as part of 301 focused tests.