nextchanges: Enforce changelog fragment format

.agents/skills/bump-sdk/SKILL.md

@@ -72,9 +72,9 @@ Confirm no internal proxy URL leaked into any lock file: `./task check-uv-lock`
 The `check-uv-lock` glob and the genkit lock revert are a known coverage gap; the internal proxy can re-leak into `internal/genkit/*.py.lock` on any future `generate-clijson`, so re-check after every run.
 
 **9. Changelog fragment.**
-Add a `dependency-updates` entry per the `pr-checklist` skill's "Changelog entry" section, modeled on prior bumps: ``Bump `github.com/databricks/databricks-sdk-go` from vOLD to vNEW.``.
+Add a `dependency-updates` entry per the `pr-checklist` skill's "Changelog entry" section, modeled on prior bumps: ``* Bump `github.com/databricks/databricks-sdk-go` from vOLD to vNEW.``.
 Never reference the Terraform provider version in the changelog fragment or PR body.
-Add it without `(#NNNN)` now; backfill the number after the PR exists, then run `./task links` to expand it into the full markdown link in place and commit the result.
+Omit the trailing PR link now (you don't have the number yet); after the PR exists, append `([#NNNN](https://github.com/databricks/cli/pull/NNNN))` after the period and commit the result.
 
 **10. Commit, push, PR.**
 If the push 403s, the active gh account lacks write access to `databricks/cli`; switch to one that has it with `gh auth switch`.

.agents/skills/bump-tf/SKILL.md

@@ -72,10 +72,10 @@ Regenerate the affected test's `out*` files with `go test ./acceptance -run 'Tes
 Add a `dependency-updates` entry per the `pr-checklist` skill's "Changelog entry" section:
 
 ```
-Bump Terraform provider from v{old_version} to v{version} (#{pr_number}).
+* Bump Terraform provider from v{old_version} to v{version}. ([#{pr_number}](https://github.com/databricks/cli/pull/{pr_number}))
 ```
 
-Add it without `(#NNNN)` now; backfill the number after the PR exists, then run `./task links` to expand it into the full markdown link in place and commit the result.
+Omit the trailing PR link now (you don't have the number yet); after the PR exists, append `([#NNNN](https://github.com/databricks/cli/pull/NNNN))` after the period and commit the result.
 
 **7. Commit, push, PR.**
 Run `./task fmt` and `./task lint-q` (if either touches `acceptance/`, a fixture is wrong, so fix the source rather than editing output).

.agents/skills/pr-checklist/SKILL.md

@@ -70,6 +70,6 @@ Add a changelog fragment under `.nextchanges/` when your change is user-visible.
 
 **How to add:**
 - Create `.nextchanges/<section>/<name>.md`, picking the section folder that fits: `cli`, `bundles`, `dependency-updates`, `notable-changes`, or `api-changes`. `<name>` is arbitrary (a feature name or your PR number) — just keep it unique.
-- Write one or two sentences in user-facing language, no Jira links. The leading `* ` is optional. Match the voice and tense of existing changelog entries.
-- A PR link is optional: write `(#NNNN)` (with NNNN being the PR number) in the text and it's expanded to a full link automatically.
+- Write a single line in user-facing language, no Jira links: start it with a `* ` bullet marker and end it with a period. Match the voice and tense of existing changelog entries.
+- A trailing PR link is required whenever the change is associated with a PR, and the introducing PR must be among the linked ones (the checker infers it and fails if it's missing) — enforced in CI (every PR and `main`) and locally once your branch has an open PR. Write the full markdown link at the very end, after the period: `([#NNNN](https://github.com/databricks/cli/pull/NNNN))` (your PR number). For an entry spanning several PRs, list them comma-separated: `([#NNNN](…), [#MMMM](…))`. Every `#NNNN` reference must be a full markdown link — a bare or paren-wrapped `#NNNN` is rejected.
 - See `.nextchanges/README.md` for details.

.github/workflows/changelog-preview.yml

@@ -16,7 +16,6 @@ on:
       - ".nextchanges/**"
       - "internal/genkit/**"
       - "tools/validate_nextchanges.py"
-      - "tools/update_github_links.py"
   push:
     branches:
       - main
@@ -32,6 +31,10 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Full history so the validator can infer each fragment's PR from the
+          # squash-merge commit that added it (see tools/validate_nextchanges.py).
+          fetch-depth: 0
 
       - name: Install uv
         uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
@@ -40,8 +43,15 @@ jobs:
 
       # Fail the check on a misplaced/unexpected file under .nextchanges/ so it
       # can't slip through as a silently-skipped (unrendered) fragment.
+      #
+      # --strict fails closed: require the trailing PR link on every fragment and
+      # check it names the right PR (never fall open to best-effort detection).
+      # Both triggers are associated with a PR: on pull_request we pass the PR
+      # number (a fragment added by the PR is not yet on main, so it can't be
+      # inferred from a squash-merge commit); on push to main each fragment's PR
+      # is inferred from the commit that added it.
       - name: Validate .nextchanges placement
-        run: uv run tools/validate_nextchanges.py
+        run: uv run tools/validate_nextchanges.py --strict ${{ github.event_name == 'pull_request' && format('--pr-number {0}', github.event.pull_request.number) || '' }}
 
       - name: Render changelog preview
         run: |-

.nextchanges/README.md

@@ -10,20 +10,31 @@ shared changelog file.
 Create `.nextchanges/<section>/<name>.md` and write what changed:
 
 ```
-Added the `databricks quickstart` command.
+* Added the `databricks quickstart` command.
 ```
 
 You can do this straight from the GitHub UI: **Add file → Create new file**,
-type the path (e.g. `.nextchanges/cli/quickstart.md`), write a sentence, commit.
+type the path (e.g. `.nextchanges/cli/quickstart.md`), write the entry, commit.
 
 - `<name>` is arbitrary — a feature name (`quickstart.md`) or your PR number
   (`5464.md`), whatever you like, as long as it's unique.
-- The leading `* ` is optional.
-- A PR link is optional. If you want one, write `(#5464)` and run `task links`
-  (or `task checks`) to expand it into a full markdown link in place; CI fails
-  if a raw `(#5464)` is left unexpanded. The release does not expand links, so
-  the fragment must already be expanded when it lands.
-- One file is usually one entry; for several, put each on its own `* ` line.
+- One file is exactly one entry: a single line that starts with a `* ` bullet
+  marker and ends with a period. `task check-changelog` (and CI) enforces this.
+- A trailing PR link is required whenever the change is associated with a PR,
+  and the PR that introduces the entry must be among the linked ones — the
+  checker infers that PR (from the squash-merge commit that added the fragment,
+  or your open branch PR) and fails if it isn't listed. CI enforces this on
+  every PR and on `main`, and `task check-changelog` enforces it locally too
+  once your branch has an open PR (detected best-effort via `gh`; skipped before
+  the PR exists or when `gh` is unavailable). Write the full markdown link at the
+  very end, after the period:
+  `([#5464](https://github.com/databricks/cli/pull/5464))` (your PR number). For
+  an entry spanning several PRs, list them comma-separated:
+  `([#5464](…), [#5500](…))`, as long as the introducing PR is included.
+- Every `#5464` reference — inline or trailing — must be a full markdown link.
+  A bare or paren-wrapped `#5464` is rejected: GitHub would render it as an
+  unintended auto-link in `CHANGELOG.md`. Nothing rewrites links, so the
+  fragment must already be correct when it lands.
 
 ### Sections
 

Taskfile.yml

@@ -281,17 +281,8 @@ tasks:
     cmds:
       - "./tools/validate_whitespace.py --fix"
 
-  links:
-    desc: Update GitHub links in CHANGELOG.md and .nextchanges/ fragments
-    sources:
-      - CHANGELOG.md
-      - ".nextchanges/**/*.md"
-      - tools/update_github_links.py
-    cmds:
-      - "./tools/update_github_links.py"
-
   check-changelog:
-    desc: Validate .nextchanges fragment placement
+    desc: Validate .nextchanges fragment placement and links
     cmds:
       - "./tools/validate_nextchanges.py"
 
@@ -321,13 +312,12 @@ tasks:
       - "! git grep -lF databricks.com -- '*uv.lock' '*.py.lock'"
 
   checks:
-    desc: Run quick checks (tidy, whitespace, links, deadcode, changelog, lockfiles)
+    desc: Run quick checks (tidy, whitespace, deadcode, changelog, lockfiles)
     # Sequential: `tidy` rewrites go.mod/go.sum and any future tidy work
-    # touching more paths should not race with whitespace/link scanners.
+    # touching more paths should not race with the whitespace scanner.
     cmds:
       - task: tidy
       - task: ws
-      - task: links
       - task: deadcode
       - task: check-changelog
       - task: check-lockfiles