From 9576adc135ee9a7a32a44c6c3b3980b36c81af5f Mon Sep 17 00:00:00 2001
From: Alexander Lyall <alexander.lyall@adcm.uk>
Date: Thu, 25 Dec 2025 16:57:59 +0000
Subject: [PATCH 1/3] Add .gitea/workflows/changelog.yml

---
 .gitea/workflows/changelog.yml | 40 ++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 .gitea/workflows/changelog.yml

diff --git a/.gitea/workflows/changelog.yml b/.gitea/workflows/changelog.yml
new file mode 100644
index 0000000..2d5a3f9
--- /dev/null
+++ b/.gitea/workflows/changelog.yml
@@ -0,0 +1,40 @@
+name: Changelog
+
+on:
+  push:
+    branches: [ main ]
+  workflow_dispatch:
+
+jobs:
+  changelog:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout (full history + tags)
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      # fetch-depth: 0 is important so git-cliff can see tags/history properly :contentReference[oaicite:3]{index=3}
+
+      - name: Generate CHANGELOG.md (Keep a Changelog)
+        uses: orhun/git-cliff-action@v4
+        with:
+          config: cliff.toml
+          args: --verbose
+        env:
+          OUTPUT: CHANGELOG.md
+
+      - name: Commit and push if changed
+        shell: bash
+        run: |
+          set -e
+          if git diff --quiet -- CHANGELOG.md; then
+            echo "No changelog changes."
+            exit 0
+          fi
+
+          git config user.name "gitea-actions[bot]"
+          git config user.email "actions@localhost"
+
+          git add CHANGELOG.md
+          git commit -m "docs(changelog): update changelog [skip ci]"
+          git push

From 49292121b2c859783b05b8e8ab512f32308e0ea9 Mon Sep 17 00:00:00 2001
From: Alexander Lyall <alexander.lyall@adcm.uk>
Date: Thu, 25 Dec 2025 17:00:30 +0000
Subject: [PATCH 2/3] Update .gitea/workflows/changelog.yml

---
 .gitea/workflows/changelog.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitea/workflows/changelog.yml b/.gitea/workflows/changelog.yml
index 2d5a3f9..3247705 100644
--- a/.gitea/workflows/changelog.yml
+++ b/.gitea/workflows/changelog.yml
@@ -3,6 +3,8 @@ name: Changelog
 on:
   push:
     branches: [ main ]
+    tags:
+      - "v*"
   workflow_dispatch:
 
 jobs:

From d86a824fd7e410b1b9799cded68aea927337dec6 Mon Sep 17 00:00:00 2001
From: Alexander Lyall <alexander.lyall@adcm.uk>
Date: Thu, 25 Dec 2025 17:15:05 +0000
Subject: [PATCH 3/3] Update .gitea/workflows/changelog.yml

---
 .gitea/workflows/changelog.yml | 27 ++++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/changelog.yml b/.gitea/workflows/changelog.yml
index 3247705..35be0a0 100644
--- a/.gitea/workflows/changelog.yml
+++ b/.gitea/workflows/changelog.yml
@@ -15,7 +15,6 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      # fetch-depth: 0 is important so git-cliff can see tags/history properly :contentReference[oaicite:3]{index=3}
 
       - name: Generate CHANGELOG.md (Keep a Changelog)
         uses: orhun/git-cliff-action@v4
@@ -25,18 +24,36 @@ jobs:
         env:
           OUTPUT: CHANGELOG.md
 
-      - name: Commit and push if changed
+      - name: Commit and push if changed (PAT)
         shell: bash
+        env:
+          CHANGELOG_PAT: ${{ secrets.CHANGELOG_PAT }}
         run: |
           set -e
+
           if git diff --quiet -- CHANGELOG.md; then
             echo "No changelog changes."
             exit 0
           fi
 
-          git config user.name "gitea-actions[bot]"
-          git config user.email "actions@localhost"
+          git config user.name "changelog-bot"
+          git config user.email "changelog-bot@users.noreply.local"
 
           git add CHANGELOG.md
           git commit -m "docs(changelog): update changelog [skip ci]"
-          git push
+
+          # Push using PAT (avoid relying on built-in tokens)
+          # NOTE: This assumes your origin remote is already set by checkout.
+          origin_url="$(git remote get-url origin)"
+
+          # Convert SSH origin to HTTPS if needed
+          if echo "$origin_url" | grep -q "^git@"; then
+            host="$(echo "$origin_url" | sed -E 's#git@([^:]+):.*#\1#')"
+            path="$(echo "$origin_url" | sed -E 's#git@[^:]+:(.*)#\1#')"
+            origin_url="https://$host/$path"
+          fi
+
+          # Inject token (PAT) into HTTPS URL
+          authed_url="$(echo "$origin_url" | sed -E "s#^https://#https://oauth2:${CHANGELOG_PAT}@#")"
+
+          git push "$authed_url" HEAD:main