Fix #181: Arbitrary file write during tarfile extraction #341

	# what?
	# Checks that a file has been committed under the /.changes directory
	# as a new CHANGELOG entry. Cannot check for a specific filename as
	# it is dynamically generated by change type and timestamp.
	# This workflow runs on pull_request_target because it requires
	# secrets to post comments.

	# why?
	# Ensure code change gets reflected in the CHANGELOG.

	# when?
	# This will run for all PRs going into main. It will
	# run when they are opened, reopened, when any label is added or removed
	# and when new code is pushed to the branch. The action will get
	# skipped if the 'Skip Changelog' label is present is any of the labels.

	name: Check Changelog Entry

	on:
	pull_request_target:
	types: [opened, reopened, labeled, unlabeled, synchronize]
	paths-ignore: ['.changes/', '.github/', 'tests/', 'third-party-stubs/', '.md', '.yml']

	workflow_dispatch:

	defaults:
	run:
	shell: bash

	permissions:
	contents: read
	pull-requests: write

	jobs:
	changelog:
	uses: dbt-labs/actions/.github/workflows/changelog-existence.yml@main
	with:
	changelog_comment: 'Thank you for your pull request! We could not find a changelog entry for this change. For details on how to document a change, see [the contributing guide](https://github.com/dbt-labs/dbt-common/blob/main/CONTRIBUTING.md#adding-changelog-entry).'
	skip_label: 'Skip Changelog'
	secrets: inherit

Provide feedback