nextchanges: Enforce changelog fragment format

.agents/skills/bump-sdk/SKILL.md

@@ -72,9 +72,9 @@ Confirm no internal proxy URL leaked into any lock file: `./task check-uv-lock`
 The `check-uv-lock` glob and the genkit lock revert are a known coverage gap; the internal proxy can re-leak into `internal/genkit/*.py.lock` on any future `generate-clijson`, so re-check after every run.
 
 **9. Changelog fragment.**
-Add a `dependency-updates` entry per the `pr-checklist` skill's "Changelog entry" section, modeled on prior bumps: ``Bump `github.com/databricks/databricks-sdk-go` from vOLD to vNEW.``.
+Add a `dependency-updates` entry per the `pr-checklist` skill's "Changelog entry" section, modeled on prior bumps: ``* Bump `github.com/databricks/databricks-sdk-go` from vOLD to vNEW.``.
 Never reference the Terraform provider version in the changelog fragment or PR body.
-Add it without `(#NNNN)` now; backfill the number after the PR exists, then run `./task links` to expand it into the full markdown link in place and commit the result.
+Omit the trailing PR link now (you don't have the number yet); after the PR exists, append `([#NNNN](https://github.com/databricks/cli/pull/NNNN))` after the period and commit the result.
 
 **10. Commit, push, PR.**
 If the push 403s, the active gh account lacks write access to `databricks/cli`; switch to one that has it with `gh auth switch`.

.agents/skills/bump-tf/SKILL.md

@@ -72,10 +72,10 @@ Regenerate the affected test's `out*` files with `go test ./acceptance -run 'Tes
 Add a `dependency-updates` entry per the `pr-checklist` skill's "Changelog entry" section:
 
 ```
-Bump Terraform provider from v{old_version} to v{version} (#{pr_number}).
+* Bump Terraform provider from v{old_version} to v{version}. ([#{pr_number}](https://github.com/databricks/cli/pull/{pr_number}))
 ```
 
-Add it without `(#NNNN)` now; backfill the number after the PR exists, then run `./task links` to expand it into the full markdown link in place and commit the result.
+Omit the trailing PR link now (you don't have the number yet); after the PR exists, append `([#NNNN](https://github.com/databricks/cli/pull/NNNN))` after the period and commit the result.
 
 **7. Commit, push, PR.**
 Run `./task fmt` and `./task lint-q` (if either touches `acceptance/`, a fixture is wrong, so fix the source rather than editing output).

.agents/skills/pr-checklist/SKILL.md

@@ -70,6 +70,6 @@ Add a changelog fragment under `.nextchanges/` when your change is user-visible.
 
 **How to add:**
 - Create `.nextchanges/<section>/<name>.md`, picking the section folder that fits: `cli`, `bundles`, `dependency-updates`, `notable-changes`, or `api-changes`. `<name>` is arbitrary (a feature name or your PR number) — just keep it unique.
-- Write one or two sentences in user-facing language, no Jira links. The leading `* ` is optional. Match the voice and tense of existing changelog entries.
-- A PR link is optional: write `(#NNNN)` (with NNNN being the PR number) in the text and it's expanded to a full link automatically.
+- Write a single line in user-facing language, no Jira links: start it with a `* ` bullet marker and end it with a period. Match the voice and tense of existing changelog entries.
+- A trailing PR link is required whenever the change is associated with a PR, and the introducing PR must be among the linked ones (the checker infers it and fails if it's missing) — enforced in CI (every PR and `main`) and locally once your branch has an open PR. Write the full markdown link at the very end, after the period: `([#NNNN](https://github.com/databricks/cli/pull/NNNN))` (your PR number). For an entry spanning several PRs, list them comma-separated: `([#NNNN](…), [#MMMM](…))`. Every `#NNNN` reference must be a full markdown link — a bare or paren-wrapped `#NNNN` is rejected.
 - See `.nextchanges/README.md` for details.

.github/workflows/bump-go-toolchain.yml

@@ -119,7 +119,7 @@ jobs:
           git fetch origin "$BRANCH"
           git checkout -f -B "$BRANCH" FETCH_HEAD
           fragment=".nextchanges/dependency-updates/go-toolchain-${TOOLCHAIN}.md"
-          echo "Bump Go toolchain to ${TOOLCHAIN#go} ([#${PR}](https://github.com/databricks/cli/pull/${PR}))." > "$fragment"
+          echo "* Bump Go toolchain to ${TOOLCHAIN#go}. ([#${PR}](https://github.com/databricks/cli/pull/${PR}))" > "$fragment"
           git add "$fragment"
           git -c user.name='github-actions[bot]' \
               -c user.email='41898282+github-actions[bot]@users.noreply.github.com' \

.github/workflows/changelog-preview.yml

@@ -16,7 +16,6 @@ on:
       - ".nextchanges/**"
       - "internal/genkit/**"
       - "tools/validate_nextchanges.py"
-      - "tools/update_github_links.py"
   push:
     branches:
       - main
@@ -32,15 +31,26 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Full history so the validator can infer each fragment's PR from the
+          # squash-merge commit that added it (see tools/validate_nextchanges.py).
+          fetch-depth: 0
 
       - name: Install uv
         uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           version: "0.8.9"
 
       # Fail the check on a misplaced/unexpected file under .nextchanges/ so it
-      # can't slip through as a silently-skipped (unrendered) fragment.
+      # can't slip through as a silently-skipped (unrendered) fragment. Running in
+      # CI (GITHUB_ACTIONS) makes the trailing PR link mandatory and checks it
+      # names the right PR. PR_NUMBER is the authoritative event PR (empty on push
+      # to main, where each fragment's PR is inferred from its squash-merge
+      # commit); it must have full history to attribute fragments, hence the
+      # fetch-depth: 0 checkout above.
       - name: Validate .nextchanges placement
+        env:
+          PR_NUMBER: ${{ github.event.number }}
         run: uv run tools/validate_nextchanges.py
 
       - name: Render changelog preview

.nextchanges/README.md

@@ -10,20 +10,31 @@ shared changelog file.
 Create `.nextchanges/<section>/<name>.md` and write what changed:
 
 ```
-Added the `databricks quickstart` command.
+* Added the `databricks quickstart` command.
 ```
 
 You can do this straight from the GitHub UI: **Add file → Create new file**,
-type the path (e.g. `.nextchanges/cli/quickstart.md`), write a sentence, commit.
+type the path (e.g. `.nextchanges/cli/quickstart.md`), write the entry, commit.
 
 - `<name>` is arbitrary — a feature name (`quickstart.md`) or your PR number
   (`5464.md`), whatever you like, as long as it's unique.
-- The leading `* ` is optional.
-- A PR link is optional. If you want one, write `(#5464)` and run `task links`
-  (or `task checks`) to expand it into a full markdown link in place; CI fails
-  if a raw `(#5464)` is left unexpanded. The release does not expand links, so
-  the fragment must already be expanded when it lands.
-- One file is usually one entry; for several, put each on its own `* ` line.
+- One file is exactly one entry: a single line that starts with a `* ` bullet
+  marker and ends with a period. `task check-changelog` (and CI) enforces this.
+- A trailing PR link is required whenever the change is associated with a PR,
+  and the PR that introduces the entry must be among the linked ones — the
+  checker infers that PR (from the squash-merge commit that added the fragment,
+  or your open branch PR) and fails if it isn't listed. CI enforces this on
+  every PR and on `main`, and `task check-changelog` enforces it locally too
+  once your branch has an open PR (detected best-effort via `gh`; skipped before
+  the PR exists or when `gh` is unavailable). Write the full markdown link at the
+  very end, after the period:
+  `([#5464](https://github.com/databricks/cli/pull/5464))` (your PR number). For
+  an entry spanning several PRs, list them comma-separated:
+  `([#5464](…), [#5500](…))`, as long as the introducing PR is included.
+- Every `#5464` reference — inline or trailing — must be a full markdown link.
+  A bare or paren-wrapped `#5464` is rejected: GitHub would render it as an
+  unintended auto-link in `CHANGELOG.md`. Nothing rewrites links, so the
+  fragment must already be correct when it lands.
 
 ### Sections
 

.nextchanges/bundles/automigration-plan-check.md

@@ -1 +1 @@
-Before committing the automatic terraform→direct migration, run a deployment plan against the converted state; if the plan fails the migration is abandoned.
+* Before committing the automatic terraform→direct migration, run a deployment plan against the converted state; if the plan fails the migration is abandoned. ([#6486](https://github.com/databricks/cli/pull/6486))

.nextchanges/bundles/dbt-sql-classic-dbr-16-4.md

@@ -1 +1 @@
-The `dbt-sql` bundle template now uses Databricks Runtime 16.4 LTS (up from 15.4 LTS) for classic (non-serverless) compute.
+* The `dbt-sql` bundle template now uses Databricks Runtime 16.4 LTS (up from 15.4 LTS) for classic (non-serverless) compute. ([#6418](https://github.com/databricks/cli/pull/6418))

.nextchanges/bundles/duration-timestamp-diff.md

@@ -1 +1 @@
-Fixed the direct engine silently ignoring edits to duration and timestamp fields, such as a Lakebase endpoint's `suspend_timeout_duration`. Such a change planned `0 to change` and was never applied.
+* Fixed the direct engine silently ignoring edits to duration and timestamp fields, such as a Lakebase endpoint's `suspend_timeout_duration`. Such a change planned `0 to change` and was never applied. ([#6377](https://github.com/databricks/cli/pull/6377))

.nextchanges/bundles/escaped-refs.md

@@ -1 +1 @@
-Fixed `$${...}` no longer escaping a literal `${...}` on the direct engine. A config using `$${source_file}` for a placeholder the Databricks runtime resolves failed with `invalid dependency "${source_file}", no such node ""`; it now deploys with `${source_file}` sent to the API, matching the terraform engine ([#6480](https://github.com/databricks/cli/issues/6480)).
+* Fixed `$${...}` no longer escaping a literal `${...}` on the direct engine. A config using `$${source_file}` for a placeholder the Databricks runtime resolves failed with `invalid dependency "${source_file}", no such node ""`; it now deploys with `${source_file}` sent to the API, matching the terraform engine. ([#6484](https://github.com/databricks/cli/pull/6484))

.nextchanges/bundles/postgres-leaf-update-mask.md

@@ -1 +1 @@
-direct: Fix deploying an update to `postgres_projects.default_endpoint_settings` ([#6440](https://github.com/databricks/cli/pull/6440)).
+* direct: Fix deploying an update to `postgres_projects.default_endpoint_settings`. ([#6440](https://github.com/databricks/cli/pull/6440))

.nextchanges/bundles/postgres-map-update-mask.md

@@ -1 +1 @@
-direct: Fix deploying an update to `postgres_endpoints.settings.pg_settings` ([#6441](https://github.com/databricks/cli/pull/6441)).
+* direct: Fix deploying an update to `postgres_endpoints.settings.pg_settings`. ([#6441](https://github.com/databricks/cli/pull/6441))

.nextchanges/bundles/postgres-oneof-update-mask.md

@@ -1 +1 @@
-direct: Fix deploying an update to `expire_time`, `ttl` or `suspend_timeout_duration` on Lakebase resources ([#6443](https://github.com/databricks/cli/pull/6443)).
+* direct: Fix deploying an update to `expire_time`, `ttl` or `suspend_timeout_duration` on Lakebase resources. ([#6443](https://github.com/databricks/cli/pull/6443))

.nextchanges/bundles/pydabs-catalogs.md

@@ -1 +1 @@
-Added PyDABs (Python) support for catalogs: `Resources.add_catalog` and the `catalog_mutator` decorator.
+* Added PyDABs (Python) support for catalogs: `Resources.add_catalog` and the `catalog_mutator` decorator. ([#6408](https://github.com/databricks/cli/pull/6408))

.nextchanges/bundles/serverless-environment-version-v5.md

@@ -1 +1 @@
-Bundle templates now use serverless [environment version 5](https://docs.databricks.com/aws/en/release-notes/serverless/environment-version/five), which offers better performance, and `databricks-connect` 16.4.
+* Bundle templates now use serverless [environment version 5](https://docs.databricks.com/aws/en/release-notes/serverless/environment-version/five), which offers better performance, and `databricks-connect` 16.4. ([#6378](https://github.com/databricks/cli/pull/6378))

.nextchanges/bundles/table-update-trigger-condition.md

@@ -1 +1 @@
-Fixed a job with a `table_update` trigger never converging on the direct engine ([#6442](https://github.com/databricks/cli/pull/6442)).
+* Fixed a job with a `table_update` trigger never converging on the direct engine. ([#6442](https://github.com/databricks/cli/pull/6442))

.nextchanges/cli/setup-local-multiline-toml.md

@@ -1 +1 @@
-Allow `databricks environments setup-local` to update `pyproject.toml` files containing TOML multi-line strings.
+* Allow `databricks environments setup-local` to update `pyproject.toml` files containing TOML multi-line strings. ([#6445](https://github.com/databricks/cli/pull/6445))

.nextchanges/dependency-updates/go-toolchain-go1.26.8.md

@@ -1 +1 @@
-Bump Go toolchain to 1.26.8 ([#6476](https://github.com/databricks/cli/pull/6476)).
+* Bump Go toolchain to 1.26.8. ([#6476](https://github.com/databricks/cli/pull/6476))

Taskfile.yml

@@ -281,17 +281,8 @@ tasks:
     cmds:
       - "./tools/validate_whitespace.py --fix"
 
-  links:
-    desc: Update GitHub links in CHANGELOG.md and .nextchanges/ fragments
-    sources:
-      - CHANGELOG.md
-      - ".nextchanges/**/*.md"
-      - tools/update_github_links.py
-    cmds:
-      - "./tools/update_github_links.py"
-
   check-changelog:
-    desc: Validate .nextchanges fragment placement
+    desc: Validate .nextchanges fragment placement and links
     cmds:
       - "./tools/validate_nextchanges.py"
 
@@ -323,13 +314,12 @@ tasks:
       - "! git grep -lF databricks.com -- '*uv.lock' '*.py.lock'"
 
   checks:
-    desc: Run quick checks (tidy, whitespace, links, deadcode, changelog, lockfiles)
+    desc: Run quick checks (tidy, whitespace, deadcode, changelog, lockfiles)
     # Sequential: `tidy` rewrites go.mod/go.sum and any future tidy work
-    # touching more paths should not race with whitespace/link scanners.
+    # touching more paths should not race with the whitespace scanner.
     cmds:
       - task: tidy
       - task: ws
-      - task: links
       - task: deadcode
       - task: check-changelog
       - task: check-lockfiles