ci(changeset): auto-generate the changeset from the PR template's Release section

[AakashHotchandani]

Why

Right now a canary/release silently no-ops when a PR merges without a changeset (that's what left main with none and made the last Release run green-but-empty). Rather than ask engineers to hand-run npx changeset, generate it from the PR template they already fill.

The mandatory ## Release section (version bump minor/patch + customer-facing/internal notes) and its enforcement (ready-for-review-label.yml) are already in the repo (ported in #57). This PR adds the missing half: a workflow that reads that section and writes the changeset.

What

.github/workflows/changeset-from-pr.yml — on PR open/edit/sync it parses the ## Release block (same parser as the ready-for-review gate: one minor|patch tick + the notes) and commits .changeset/pr-<number>.md to the PR branch:

---
"@wdio/browserstack-service": <minor|patch>
---

<customer-facing notes, else internal notes, else PR title>

• Idempotent — only commits when the derived changeset changes, so the bot's own push (which re-fires synchronize) settles in one no-op pass; body edits update it in place.
• Scope — skips forks (no write token → they add a changeset manually), the changesets Version PR (changeset-release/*), and skip-changeset-labelled PRs (CI/docs/chore).
• Separation of duties — ready-for-review-label.yml still independently requires the bump + internal notes; this workflow only generates when they're valid.

PR template — one line noting the changeset is auto-generated (no npx changeset) + the skip-changeset escape hatch.

Security

Single actions/github-script step — no run: shell, so untrusted pull_request.body/title/head.ref are read as JS context vars, never interpolated into a command. Uses pull_request (not pull_request_target) and skips forks, so the contents: write token only ever writes the author's own same-repo branch (which they can already push to). No privilege escalation, no injection surface.

Result

Engineers just fill the Release section; the changeset appears on the PR automatically → canaries/releases always have something to snapshot. (Complements the changeset-unblock-canary PR #69, which added the one-off changeset for the currently-pending fixes.)

Create a skip-changeset label in the repo for the escape hatch (the if treats a missing label as "don't skip", so nothing breaks until it exists).

🤖 Generated with Claude Code