feat(create-pr): add reuse_branch to keep one self-updating pull request - #80

Adds a reuse_branch mode to the actions/create-pr action to keep a single self-updating PR (instead of opening a new PR on each run), and wires this behavior into the reusable generate-changelog workflow (including concurrency protection) to prevent changelog PR accumulation and long-lived conflicts.

Changes:

• Add reuse_branch input plus “updated vs created” outputs, and implement PR find/update/close behavior in actions/create-pr.
• Extend git helpers to support branch reset (git checkout -B) and force push (git push --force) when reusing a branch.
• Enable reuse_branch by default for the generate-changelog reusable workflow and add a concurrency group to prevent branch force-push races; update READMEs accordingly.

• Files reviewed: 8/12 changed files
• Comments generated: 4
• Review effort level: Lite

• Files reviewed: 9/13 changed files
• Comments generated: 1
• Review effort level: Lite

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

lib/action-utils/src/git.ts:44

• gitPushBranch passes the branch name as the final argument to git push without an explicit -- end-of-options marker. If the input branch name begins with -/-- (e.g. --all, --mirror), Git can parse it as an option rather than a refspec, potentially pushing unintended refs or otherwise changing push behavior. Add -- before the branch/refspec to prevent option injection and to support such branch names safely.

• Files reviewed: 9/13 changed files
• Comments generated: 0 new
• Review effort level: Lite

Suppressed comments (1)

lib/action-utils/src/git.ts:46

• This comment is inaccurate: git checkout -b/-B does have an equivalent -- end-of-options separator (and should use it) to prevent branch names starting with - from being parsed as options. Leaving this as-is is misleading for future maintenance.

  // `--` keeps a branch name that begins with a dash from being read as an
  // option: `git push origin --mirror` pushes every ref rather than a branch.
  // `git checkout -B` needs no equivalent, and rejects such a name itself.

• Files reviewed: 9/13 changed files
• Comments generated: 1
• Review effort level: Lite

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

.github/workflows/generate-changelog.yaml:87

• The concurrency group is keyed on github.ref (the triggering ref), but the race you’re preventing is on the reused head branch (inputs.branch_name). If this reusable workflow is invoked for multiple refs (e.g. main + a release branch) while keeping the same branch_name, runs can still overlap and force-push the same branch concurrently.
  workflows/generate-changelog/README.md:11
• This note explains that runs are serialized to avoid races when reuse_branch reuses a single branch, but it doesn’t mention that the reusable workflow itself now sets concurrency. Callers reading this README may still add their own concurrency block unnecessarily (and potentially with a different grouping).

• Files reviewed: 9/13 changed files
• Comments generated: 0 new
• Review effort level: Lite

Suppressed comments (3)

Previously missed (1) — in code that hasn't changed since the last review.

actions/create-pr/README.md:27

• The README lists the default token as ${{ GITHUB_TOKEN }}, but that expression is not valid in workflow syntax (it should be ${{ github.token }} or ${{ secrets.GITHUB_TOKEN }}). Aligning this with action.yaml prevents copy/paste failures.

workflows/generate-changelog/README.md:21

• The documented defaults for pull_request_title / pull_request_body don’t match the workflow’s actual defaults in .github/workflows/generate-changelog.yaml (which are changelog-specific). Keeping these aligned avoids surprising PR titles/bodies when callers rely on defaults.

| `pull_request_title` | The title of the pull request.                                                                | `'chore: automated by GitHub actions'`                                |
| `pull_request_body`  | The body of the pull request.                                                                 | `'This pull request was automatically created by a GitHub Action.'`   |

workflows/generate-changelog/README.md:24

• The documented default for commit_message does not match the workflow’s actual default in .github/workflows/generate-changelog.yaml (it defaults to chore: generate changelog).

| `commit_message`     | The message of the commit.                                                                    | `'chore: automated by GitHub actions'`                                |

• Files reviewed: 9/13 changed files
• Comments generated: 1
• Review effort level: Lite