ci: add changelog verification workflow

.github/workflows/verify-changelog.yaml

@@ -0,0 +1,47 @@
+# This action requires that any PR targeting the main branch should touch at
+# least one CHANGELOG file. If a CHANGELOG entry is not required, add the
+# "Skip Changelog" label, the "dependencies" label, or include "[chore]" in
+# the PR title.
+
+name: Verify CHANGELOG
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+    branches:
+      - main
+
+permissions: read-all
+
+jobs:
+  changelog:
+    runs-on: ubuntu-latest
+
+    # Skip if:
+    # - PR has "Skip Changelog" label
+    # - PR has "dependencies" label
+    # - PR title contains "[chore]"
+    if: >
+      ! contains(github.event.pull_request.labels.*.name, 'Skip Changelog') &&
+      ! contains(github.event.pull_request.labels.*.name, 'dependencies') &&
+      ! contains(github.event.pull_request.title, '[chore]')
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Verify CHANGELOG updated
+        run: |
+          echo "Fetching base branch..."
+          git fetch origin ${{ github.base_ref }} --depth=1
+
+          echo "Checking for CHANGELOG modifications..."
+          if git diff --name-only FETCH_HEAD | grep -q 'CHANGELOG'; then
+            echo "CHANGELOG updated — OK"
+          else
+            echo "::error::No CHANGELOG file was updated in this PR."
+            echo "Please update CHANGELOG or use the 'Skip Changelog' label if appropriate."
+            false
+          fi