Optional publishing

Repository writes are the default. Every remote destination is disabled until its own flag and required configuration are supplied.

S3

Use short-lived workload credentials where possible. In GitHub Actions, assume an AWS role through OIDC before running the changelog Action:

permissions:
  contents: read
  id-token: write
 
steps:
  - uses: actions/checkout@v4
    with:
      fetch-depth: 0
 
  - uses: aws-actions/configure-aws-credentials@v5
    with:
      role-to-assume: ${{ vars.CHANGELOG_AWS_ROLE_ARN }}
      aws-region: us-east-1
 
  - uses: sparepartslabs/spareparts-changelog@v0
    with:
      provider: anthropic
      anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
      from: v1.0.0
      to: v1.1.0
      title: v1.1.0
      write-repository: "false"
      publish-s3: "true"
      s3-bucket: ${{ vars.CHANGELOG_S3_BUCKET }}
      s3-key: releases/my-product/1.1.0.md
      s3-region: us-east-1

The S3 publisher writes UTF-8 Markdown with content type text/markdown; charset=utf-8. It also supports s3-endpoint and s3-force-path-style for compatible object stores.

Enable LinkedIn independently with publish-linkedin: "true", an organization or member author URN in linkedin-author, and a secret access token in linkedin-access-token. The CLI equivalents are --linkedin, --linkedin-author, and LINKEDIN_ACCESS_TOKEN.

Treat remote publication failure as a release failure unless your workflow has an explicit recovery policy. A partially published release is harder for users to understand than a stopped release with a clear retry path.