Add automated CHANGELOG updates to ship-it job

[ramonskie]

Summary

Automates CHANGELOG updates during buildpack releases in the ship-it job.

Changes

• New task: tasks/update-changelog-for-release/

  • Extracts last version from existing CHANGELOG
  • Fetches all commits since last version tag
  • Formats commits as bullet points (matching scripts/bump format)
  • Prepends new version section to CHANGELOG
  • Commits with [ci skip] message
  • Updates .git/ref so buildpack-github-release tags the correct commit

• Pipeline integration: Added task to ship-it job

  • Position: After write-version-file, before check-tag-not-already-added
  • Uses SSH key: ((cf-buildpacks-eng-github-ssh-key.private_key))

Format

Matches existing CHANGELOG conventions across all CF buildpacks:

```
v1.10.28 Jan 20, 2026

• Commit subject line
  commit body indented by 2 spaces

• Another commit

```

Implementation Details

• Language: Bash (as requested - team migrating away from Ruby)
• Filters: Removes Signed-off-by: and Co-authored-by: lines
• Date format: `%b %d, %Y` (e.g., "Feb 20, 2025")
• Separator: `=` characters matching header width
• Git commit: Updates .git/ref to ensure GitHub release tags the CHANGELOG commit

Comparison with scripts/bump

This implementation replicates the behavior of the existing scripts/bump Ruby script, but:

• ✅ Written in Bash (team preference)
• ✅ Integrated into pipeline (not manual)
• ✅ Receives version from Concourse semver resource
• ✅ Commits automatically with [ci skip]

Testing Recommendations

1. Test with one buildpack first (e.g., go-buildpack)
2. Verify:
   • CHANGELOG updated correctly
   • Commit has [ci skip] message
   • GitHub release tags the CHANGELOG commit (not the version bump commit)
   • Release notes contain both manual and automated entries
3. Monitor first release cycle for any issues

Rollback Plan

If issues occur, comment out the task in pipelines/buildpack/pipeline.yml:

```yaml

- task: update-changelog-for-release

file: buildpacks-ci/tasks/update-changelog-for-release/task.yml

params:

REPO_PRIVATE_KEY: ((cf-buildpacks-eng-github-ssh-key.private_key))

```

Then regenerate pipelines with ./bin/update-pipelines.