ci: add git-cliff changelog generation

Generates CHANGELOG.md from conventional commits on main and
release/* branches. Runs in parallel with docker build after
tests pass. Commits back with [skip ci] to avoid loops.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -141,3 +141,37 @@ jobs:
         run: |
           docker push registry.meghsakha.com/certifai/dashboard:${{ steps.tag.outputs.tag }}
           docker push registry.meghsakha.com/certifai/dashboard:latest
+
+  # ---------------------------------------------------------------------------
+  # Stage 3b: Generate changelog from conventional commits
+  #           Only on main and release/* branches
+  # ---------------------------------------------------------------------------
+  changelog:
+    name: Changelog
+    runs-on: docker
+    needs: [test]
+    if: >-
+      github.event_name == 'push' &&
+      (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/'))
+    container:
+      image: rust:1.89-bookworm
+    steps:
+      - name: Checkout (full history)
+        run: |
+          git clone "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" .
+          git checkout "${GITHUB_SHA}"
+      - name: Install git-cliff
+        run: cargo install git-cliff --locked
+      - name: Generate changelog
+        run: git cliff --output CHANGELOG.md
+      - name: Commit and push changelog
+        run: |
+          git config user.name "CI Bot"
+          git config user.email "ci@certifai.local"
+          git add CHANGELOG.md
+          if git diff --cached --quiet; then
+            echo "No changelog changes to commit"
+          else
+            git commit -m "docs: update CHANGELOG.md [skip ci]"
+            git push origin HEAD:"${GITHUB_REF_NAME}"
+          fi

cliff.toml

@@ -0,0 +1,52 @@
+[changelog]
+header = """
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+"""
+body = """
+{%- macro remote_url() -%}
+  https://gitea.meghsakha.com/{{ remote.github.owner }}/{{ remote.github.repo }}
+{%- endmacro -%}
+
+{% if version -%}
+    ## [{{ version | trim_start_matches(pat="v") }}] - {{ timestamp | date(format="%Y-%m-%d") }}
+{% else -%}
+    ## [Unreleased]
+{% endif -%}
+
+{% for group, commits in commits | group_by(attribute="group") %}
+    ### {{ group | striptags | trim | upper_first }}
+    {% for commit in commits %}
+        - {% if commit.scope %}*({{ commit.scope }})* {% endif %}{{ commit.message | upper_first }}\
+          {% if commit.breaking %} [**breaking**]{% endif %}\
+    {% endfor %}
+{% endfor %}\n
+"""
+footer = """
+---
+*Generated by [git-cliff](https://git-cliff.org)*
+"""
+trim = true
+
+[git]
+conventional_commits = true
+filter_unconventional = true
+split_commits = false
+commit_parsers = [
+    { message = "^feat", group = "Features" },
+    { message = "^fix", group = "Bug Fixes" },
+    { message = "^doc", group = "Documentation" },
+    { message = "^perf", group = "Performance" },
+    { message = "^refactor", group = "Refactoring" },
+    { message = "^style", group = "Styling" },
+    { message = "^test", group = "Testing" },
+    { message = "^ci", group = "CI/CD" },
+    { message = "^chore", group = "Miscellaneous" },
+    { message = "^build", group = "Build" },
+]
+protect_breaking_commits = false
+filter_commits = false
+tag_pattern = "v[0-9].*"
+sort_commits = "oldest"