Fix part of #6106: Implement generate changelog workflow and update bazel setup step

.github/workflows/generate_changelog.yml

@@ -0,0 +1,115 @@
+# Triggered when a version-bump PR is merged to develop (path filter: version.bzl).
+# Runs the GenerateChangelogs Kotlin script, which:
+#   1. Reads the new MINOR_VERSION from version.bzl and derives the *previous* version
+#      (e.g. 0.17->0.18 bump generates the changelog for 0.17).
+#   2. Collects all PRs merged into develop between the two most recent release branches.
+#   3. Parses "Fixes #NNNN" / "Closes #NNNN" references to surface issue titles.
+#   4. Calls Vertex AI (Gemini) to produce a 2-3 sentence user-facing changelog summary.
+#   5. Writes config/changelogs/<major>.<minor>.md and opens a PR on develop for review.
+#
+# If the Vertex AI call fails (timeout, quota, API error), the workflow still creates the
+# PR with a raw commit list and an <!-- LLM generation failed --> marker. The release
+# coordinator then writes the summary manually.
+#
+# Can also be triggered manually via workflow_dispatch to test or regenerate a changelog.
+#
+# Note: this workflow authenticates to GCP to call the Vertex AI API. The environment
+# (oppia-android-release-env) must NOT have required reviewers configured, since the
+# workflow is triggered automatically on every version.bzl push. If required reviewers
+# are needed for other workflows in that environment, consider creating a separate
+# non-gated environment for changelog generation (e.g. oppia-android-automation-env).
+
+name: Generate Changelog
+
+on:
+  push:
+    branches:
+      - develop
+    paths:
+      - 'version.bzl'
+  workflow_dispatch:
+
+# Only one changelog generation may run at a time. An in-flight run is never cancelled
+# (cancel-in-progress: false) so that a rapid double-push to version.bzl does not leave
+# a half-committed changelog branch in an inconsistent state.
+concurrency:
+  group: generate-changelog
+  cancel-in-progress: false
+
+jobs:
+  generate_changelog:
+    name: Generate Changelog
+    runs-on: ubuntu-24.04
+    environment: oppia-android-release-env
+    permissions:
+      id-token: write      # Required for Workload Identity Federation (Vertex AI auth).
+      contents: write      # Required so the script can push the changelog branch.
+      pull-requests: write # Required so the script can open the PR via gh.
+
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          # Full history is required: the script uses `git log` to collect commits between
+          # release branches and needs the complete DAG to find merge bases correctly.
+          fetch-depth: 0
+
+      # Configure a bot identity so that the commit the script creates on the changelog
+      # branch is attributed to github-actions[bot] rather than an arbitrary user.
+      - name: Configure git identity
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      # Allow the script to `git push` the changelog branch and `gh pr create` without a
+      # personal access token. The built-in GITHUB_TOKEN is sufficient here because:
+      #   - contents: write allows pushing a new branch.
+      #   - pull-requests: write allows opening the PR.
+      - name: Configure git remote credentials
+        run: |
+          git remote set-url origin \
+            https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}
+
+      - name: Authenticate to GCP via Workload Identity Federation
+        uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed
+        with:
+          workload_identity_provider: ${{ secrets.WIF_PROVIDER }}
+          service_account: ${{ secrets.GCP_RELEASE_SERVICE_ACCOUNT }}
+
+      - name: Set up Google Cloud SDK
+        uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f
+
+      # Obtain a short-lived OAuth2 access token for the WIF-impersonated service account.
+      # GenerateChangelogs passes this as the Bearer token when calling the Vertex AI API.
+      - name: Get and mask GCP access token
+        run: |
+          ACCESS_TOKEN="$(gcloud auth print-access-token)"
+          echo "::add-mask::$ACCESS_TOKEN"
+          echo "GCP_ACCESS_TOKEN=$ACCESS_TOKEN" >> "$GITHUB_ENV"
+
+      # The GenerateChangelogs script is a pure Kotlin script with no Android resources.
+      # The Android build environment (NDK, SDK, etc.) is not needed here.
+      - name: Set up Bazel
+        uses: bazel-contrib/setup-bazel@8cb04a772ab4c1eb984e9c1b493a182e96c5e425
+        with:
+          bazelisk-cache: true
+
+      # Run the GenerateChangelogs script. It will:
+      #   - Determine the version to generate for from version.bzl.
+      #   - Collect commits between the two newest release branches.
+      #   - Call Vertex AI and write config/changelogs/<version>.md.
+      #   - Push the automated/changelog-<version> branch and open a PR.
+      #
+      # The GITHUB_TOKEN env var is picked up by the `gh` CLI (used internally by the
+      # script for `gh pr create`). GCP_PROJECT, GCP_LOCATION, and VERTEX_MODEL are
+      # non-sensitive configuration values stored as repository variables
+      # (Settings -> Variables -> Actions).
+      - name: Generate changelog and open PR
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          bazel run //scripts:generate_changelogs -- \
+            "$(pwd)" \
+            "${{ vars.GCP_PROJECT }}" \
+            "${{ vars.GCP_LOCATION }}" \
+            "${{ vars.VERTEX_MODEL }}" \
+            "$GCP_ACCESS_TOKEN"

scripts/BUILD.bazel

@@ -367,6 +367,14 @@ kt_jvm_binary(
 )
 
 # Release automation binaries — invoked by GitHub Actions release workflows.
+kt_jvm_binary(
+    name = "generate_changelogs",
+    main_class = "org.oppia.android.scripts.release.GenerateChangelogsKt",
+    runtime_deps = [
+        "//scripts/src/java/org/oppia/android/scripts/release:generate_changelogs_lib",
+    ],
+)
+
 kt_jvm_binary(
     name = "sign_release_binary",
     main_class = "org.oppia.android.scripts.release.SignReleaseBinaryKt",

scripts/assets/test_file_exemptions.textproto

@@ -4939,3 +4939,7 @@ test_file_exemption {
   exempted_file_path: "scripts/src/java/org/oppia/android/scripts/release/CloudSigner.kt"
   test_file_not_required: true
 }
+test_file_exemption {
+  exempted_file_path: "scripts/src/java/org/oppia/android/scripts/release/VertexAiClient.kt"
+  test_file_not_required: true
+}

scripts/src/java/org/oppia/android/scripts/release/BUILD.bazel

@@ -61,6 +61,14 @@ kt_jvm_library(
     deps = [":cloud_signer"],
 )
 
+kt_jvm_library(
+    name = "fake_vertex_ai_client",
+    testonly = True,
+    srcs = ["FakeVertexAiClient.kt"],
+    visibility = ["//scripts:oppia_script_test_visibility"],
+    deps = [":vertex_ai_client"],
+)
+
 kt_jvm_library(
     name = "version_inversion_checker",
     srcs = ["VersionInversionChecker.kt"],
@@ -106,6 +114,35 @@ kt_jvm_library(
     ],
 )
 
+kt_jvm_library(
+    name = "vertex_ai_client",
+    srcs = ["VertexAiClient.kt"],
+    visibility = ["//scripts:oppia_script_library_visibility"],
+)
+
+kt_jvm_library(
+    name = "google_vertex_ai_client",
+    srcs = ["GoogleVertexAiClient.kt"],
+    visibility = ["//scripts:oppia_script_library_visibility"],
+    deps = [
+        ":vertex_ai_client",
+        "//third_party:com_squareup_okhttp3_okhttp",
+        "//third_party:moshi",
+    ],
+)
+
+kt_jvm_library(
+    name = "generate_changelogs_lib",
+    srcs = ["GenerateChangelogs.kt"],
+    visibility = ["//scripts:oppia_script_binary_visibility"],
+    deps = [
+        ":google_vertex_ai_client",
+        ":vertex_ai_client",
+        "//scripts/src/java/org/oppia/android/scripts/common:command_executor",
+        "//scripts/src/java/org/oppia/android/scripts/common:script_background_coroutine_dispatcher",
+    ],
+)
+
 kt_jvm_library(
     name = "sign_release_binary_lib",
     srcs = ["SignReleaseBinary.kt"],

scripts/src/java/org/oppia/android/scripts/release/FakeVertexAiClient.kt

@@ -0,0 +1,37 @@
+package org.oppia.android.scripts.release
+
+/**
+ * In-memory fake implementation of [VertexAiClient] for use in unit tests.
+ *
+ * By default, [generateText] returns [defaultResponse]. Tests can simulate an LLM failure by
+ * setting [shouldFail] to `true`, which causes the next call to throw an [IllegalStateException].
+ * The flag resets to `false` after each thrown exception so that subsequent calls succeed again
+ * (unless re-set). All prompts received are recorded in [receivedPrompts] for assertion.
+ *
+ * @property defaultResponse the text returned by [generateText] when [shouldFail] is false
+ */
+class FakeVertexAiClient(
+  private val defaultResponse: String = "Fake generated changelog summary."
+) : VertexAiClient {
+
+  /** Whether the next call to [generateText] should throw to simulate an LLM failure. */
+  var shouldFail = false
+
+  /** All prompts passed to [generateText], in call order. */
+  val receivedPrompts = mutableListOf<String>()
+
+  override fun generateText(prompt: String): String {
+    receivedPrompts += prompt
+    if (shouldFail) {
+      shouldFail = false
+      error("FakeVertexAiClient: simulated Vertex AI failure")
+    }
+    return defaultResponse
+  }
+
+  /** Resets all recorded state and configuration to defaults. */
+  fun reset() {
+    shouldFail = false
+    receivedPrompts.clear()
+  }
+}