ci: reusable changeset-hygiene workflow

[turnipdabeets]

Summary

Adds a reusable workflow that any pnpm/changesets repo in the PostHog org can call to surface changeset coverage issues as a sticky PR comment. Always exits 0 — the comment is informational, never gates merging.

Why

A real bug in posthog-android (#491 → #507): a PR modified code in posthog-android-gradle-plugin/ but the changeset declared posthog-android (the SDK package). The mistake silently slipped through because the directory name and the SDK package name look almost identical. The wrong package got bumped, the actual change never released, and a corrective changeset PR was needed.

This workflow catches that class of mistake at PR-time. It also catches three other patterns:

Failure mode	Caught?
Changeset declares a package the PR didn't modify	✅
PR modifies a package no changeset declares (the #491 case)	✅
Changeset declares a name not in the workspace (typo)	✅
PR modifies workspace package code but adds no changeset at all	✅

How it works

• Triggered via workflow_call so each consumer repo has a tiny ~6-line caller that delegates here.
• Uses pnpm m ls --json --depth=-1 to discover workspace packages — handles globs, exclusions, and the catalog (e.g., posthog-js's packages/* + tooling/* + !**/playground/**).
• Diffs against the merge base, prefix-matches each changed file to its package directory, and parses the YAML frontmatter of any .changeset/*.md added or modified in the PR.
• Posts a single sticky comment under the marker <!-- changeset-hygiene -->, with a collapsible <details open> body. Auto-deletes when a follow-up push resolves the issue.
• Comment-management uses actions/github-script (no third-party deps) — same pattern as posthog-js's existing check-posthog-major-version.yml.

Caller setup (~6 lines)

name: 'Changeset hygiene'
on:
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened]
jobs:
  check:
    uses: PostHog/.github/.github/workflows/changeset-hygiene.yml@main

Test plan

• Verified end-to-end on posthog-android: ci: test shared changeset-hygiene workflow [SIMULATION] posthog-android#510 — caller workflow with simulation files (source in posthog-android-gradle-plugin/ + changeset declaring posthog-android) produces the expected mismatch comment. Shared workflow run: https://github.com/PostHog/posthog-android/actions/runs/25330885192
• Verified end-to-end on posthog-js: ci: test shared changeset-hygiene workflow [SIMULATION] posthog-js#3520 — caller workflow runs cleanly against posthog-js's glob-based workspace (20 packages including scoped @posthog/... names). Shared workflow run: https://github.com/PostHog/posthog-js/actions/runs/25331157848
• Cross-repo uses: from a feature branch works (no org-level restriction blocking it).
• script-ref input correctly fetches the script from the same ref as the caller pinned to.
• Marker-based stickiness creates / updates / deletes a single comment per PR.

Out of scope

Major-version-bump policies (e.g., posthog-js's autoload constraint blocking posthog-js: major) stay in each repo's existing workflow. This shared workflow handles coverage only.

After merge

Caller PRs in posthog-android and posthog-js will update their uses: from @feat/changeset-hygiene to @main and drop the script-ref input.

[Piccirello]

nit: use node 24 since it's the current LTS?