[mario-campos]

This PR adds a PR check for non-release/mergeback/update-bundle PRs. The check posts a sticky PR comment if CHANGELOG.md has been modified in the PR, warning the author to instead direct their change to a change-note.

This PR is split-off from #4217, which retains the prerequisite post-comment Action.

Note

CI is EXPECTED TO FAIL until #4217 is merged. The write-permission job intentionally checks out trusted main, not the PR head, and the prerequisite ./.github/actions/post-comment action is not on main yet.

Risk assessment

For internal use only. Please select the risk level of this change:

• Low risk: Repository development/CI only

Which use cases does this change impact?

• Workflow types: None of the production workflow types; only this repository's PR checks.

• Products: No production analysis behavior changes.

Environments:

• Testing/None - This change does not impact any CodeQL workflows in production.

How did/will you validate this change?

• End-to-end tests - PR checks provide eventual integration coverage after Add CHANGELOG.md modification check and warning comment #4217 merges and this PR is updated.

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

• Development/testing only - This change cannot cause any failures in production.

How will you know if something goes wrong after this change is released?

• Other - Observe the PR Checks job logs and warning/resolution comments after the prerequisite merges and this PR is updated.

Are there any special considerations for merging or releasing this change?

• Special considerations - As this PR depends on an Action introduced in Add CHANGELOG.md modification check and warning comment #4217 being in main, Add CHANGELOG.md modification check and warning comment #4217 must merge first. CI is expected to fail until then. After Add CHANGELOG.md modification check and warning comment #4217 is merged, then this PR will be rebased.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows. Existing repo-size commenting is preserved; the new local action requires Add CHANGELOG.md modification check and warning comment #4217 on main first.
• Consider adding a changelog entry for this change. Not needed for repository-only CI activation.
• Confirm the readme and docs have been updated if necessary. No production documentation changes are needed.

[Copilot]

🟡 Changes recommended

The workspace-only install omits required root dependencies, leaving warning and resolution comment scripts at risk of module-loading failures in CI.

1 open issue

• Install root dependencies for the comment script in CI · New

What changed in this PR

Activates warnings for direct CHANGELOG.md edits in repository PR checks, using the comment action supplied by prerequisite #4217. Production CodeQL workflows are unaffected.

Changes:

• Detects changelog modifications and exposes the result as a job output.
• Extends the commenting job with trusted main checkout and Node/dependency setup.
• Adds sticky warning and update-only resolution comments, excluding release, backport, mergeback, and bundle-update branches.

File	Description
.github/​workflows/​pr-checks.yml	Wires changelog detection and warning/resolution comments into PR checks while preserving repo-size commenting.

_{Review effort: Balanced (auto)}