CI: check that the changelog is populated on each pull request

.github/workflows/check_pr.yml

@@ -0,0 +1,41 @@
+name: Check branch conformity
+on:
+  pull_request:
+
+jobs:
+  prevent-fixup-commits:
+      runs-on: ubuntu-latest
+      env:
+        target: debian-bookworm
+        distro: debian
+        version: bookworm
+      steps:
+        - name: Checkout
+          uses: actions/checkout@v4
+        - name: prevent fixup commits
+          run: |
+            git fetch origin
+            git status
+            git log --pretty=format:%s origin/main..HEAD | grep -ie '^fixup\|^wip' && exit 1 || true
+
+  check-changelog:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: ensure CHANGELOG.md is populated
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          NO_CHANGELOG_LABEL: ${{ contains(github.event.pull_request.labels.*.name, 'no changelog') }}
+        shell: bash
+        run: |
+          if [ "${NO_CHANGELOG_LABEL}" = "true" ]; then
+              exit 0
+          else
+              if git diff --exit-code "origin/${BASE_REF}" -- CHANGELOG.md; then
+                  echo "::error::No CHANGELOG.md modifications found in this pull request. You can override this check by adding the 'no changelog' label to the pull request."
+                  exit 1
+              fi
+          fi

CHANGELOG.md

@@ -16,6 +16,10 @@ since 0.4.1, and this project adheres to [Semantic Versioning](https://semver.or
 
 - Platform support: Drop support for Fedora 39, since it's end-of-life ([#999](https://github.com/freedomofpress/dangerzone/pull/999))
 
+### Development changes
+
+- CI: Check that the changelog is populated on each pull request ([#995](https://github.com/freedomofpress/dangerzone/pull/995))
+
 ## [0.8.0](https://github.com/freedomofpress/dangerzone/compare/v0.8.0...0.7.1)
 
 ### Added