use releasegen validate changlog workflow

.github/workflows/releasegen.yml

@@ -42,16 +42,16 @@ jobs:
           token: ${{ steps.generate-token.outputs.token }}
 
       - name: Run ReleaseGen
+        # custom_change_types now live in .releasegen.yaml so the validate
+        # and release workflows share one source of truth. Per-run values
+        # stay in env below.
         env:
           GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
           GITHUB_REPOSITORY: ${{ github.repository }}
           GITHUB_ACTOR: ${{ github.actor }}
           GITHUB_REF_NAME: ${{ github.event.inputs.branch || github.ref_name }}
           MANUAL_VERSION: ${{ github.event.inputs.version || '' }}
           REASON: ${{ github.event.inputs.reason || '' }}
-          CUSTOM_CHANGE_TYPES: |
-            documentation:patch
-            performance:minor
         run: |
           docker run --rm \
             -e GITHUB_TOKEN \
@@ -60,7 +60,6 @@ jobs:
             -e GITHUB_REF_NAME \
             -e MANUAL_VERSION \
             -e REASON \
-            -e CUSTOM_CHANGE_TYPES \
             -v "$(pwd):/workspace" \
             ghcr.io/c2fo/releasegen:v1 \
             --repo-root /workspace

.github/workflows/validate-changelog.yml

@@ -0,0 +1,34 @@
+name: Validate Changelog
+
+# Lightweight PR-time check that parses every CHANGELOG.md's [Unreleased]
+# section and reports malformed headings (e.g. ### Changed without the
+# BREAKING CHANGE marker, or an unknown heading not declared in
+# .releasegen.yaml's custom_change_types). No token, no commits, no side
+# effects. Pairs with the release-by-changelog workflow that runs on merge
+# to main / v6.
+
+on:
+  pull_request:
+    branches:
+      - main
+      - v6
+
+permissions:
+  contents: read
+
+jobs:
+  validate-changelog:
+    name: Validate CHANGELOG.md
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Run releasegen validate
+        run: |
+          docker run --rm \
+            -v "$(pwd):/workspace" \
+            ghcr.io/c2fo/releasegen:v1 \
+            validate --repo-root /workspace

.prenup.yaml

@@ -18,6 +18,17 @@ tasks:
     command: golangci-lint run --max-same-issues 0 --build-tags=vfsintegration ./...
     per_module: true
     working_dir: '{{.module_root}}'
-  - name: Check for changes in CHANGELOG.md
+  - name: Validate CHANGELOG.md
     default_selected: true
-    command: /bin/bash {{.repo_root}}/.github/workflows/scripts/changelog.sh
+    # Runs the same image and subcommand the validate workflow uses in CI,
+    # reading custom_change_types from .releasegen.yaml. Replaces the
+    # legacy changelog.sh "did the changelog change?" guard.
+    #
+    # --pull=always forces Docker to check GHCR for the current digest of
+    # the `v1` moving tag before each run, so we stay automatically in
+    # sync with the latest v1.x release that CI uses. Without this flag
+    # Docker uses its default --pull=missing behavior and will keep
+    # running whatever was first cached locally, even after newer v1.x
+    # images ship. Cost is one HTTP HEAD per invocation; layers stay
+    # cached so re-downloads only happen on a real version bump.
+    command: docker run --rm --pull=always -v "{{.repo_root}}:/workspace" ghcr.io/c2fo/releasegen:v1 validate --repo-root /workspace

.releasegen.yaml

@@ -0,0 +1,21 @@
+# ReleaseGen configuration shared by the release and validate workflows.
+# Per-invocation values (GITHUB_TOKEN, MANUAL_VERSION, etc.) stay in the
+# workflow env / CLI flags; repo-shape settings live here.
+#
+# Keep keys in lower-case; releasegen matches headings case-insensitively
+# but the canonical on-disk form is lower-cased.
+
+custom_change_types:
+  documentation: patch
+  performance: minor
+
+validate:
+  # Fail any PR whose non-CHANGELOG files changed vs the base ref but whose
+  # [Unreleased] section gained no new lines. Modules are scoped by where
+  # CHANGELOG.md lives; the root changelog catches everything not claimed
+  # by a submodule changelog. Replaces the legacy ensure_changelog.sh
+  # presence check and folds it into the same batched validate report.
+  require_changelog_entry: true
+  # base_ref defaults to origin/$GITHUB_BASE_REF on PR runs, else origin/main.
+  # Override here if you need to validate against a different revision.
+  # base_ref: origin/main

CHANGELOG.md

@@ -5,6 +5,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Added
+- Added `releasegen validate` changelog workflow as pr check
 
 ## [[v7.19.0](https://github.com/C2FO/vfs/releases/tag/v7.19.0)] - 2026-06-18
 ### Added