hiero-ledger · emiliyank · Dec 1, 2025
diff --git a/.github/scripts/changelog_check.sh b/.github/scripts/changelog_check.sh
@@ -0,0 +1,127 @@
+#!/bin/bash
+
+CHANGELOG="CHANGELOG.md"
+
+# ANSI color codes
+RED="\033[31m"
+GREEN="\033[32m"
+YELLOW="\033[33m"
+RESET="\033[0m"
+
+failed=0
+
+# Fetch upstream
+git remote add upstream https://github.com/${GITHUB_REPOSITORY}.git
+git fetch upstream main >/dev/null 2>&1
+
+# Get raw diff
+raw_diff=$(git diff upstream/main -- "$CHANGELOG")
+
+# 1️⃣ Show raw diff with colors
+echo "=== Raw git diff of $CHANGELOG against upstream/main ==="
+while IFS= read -r line; do
+    if [[ $line =~ ^\+ && ! $line =~ ^\+\+\+ ]]; then
+        echo -e "${GREEN}$line${RESET}"
+    elif [[ $line =~ ^- && ! $line =~ ^--- ]]; then
+        echo -e "${RED}$line${RESET}"
+    else
+        echo "$line"
+    fi
+done <<< "$raw_diff"
+echo "================================="
+
+# 2️⃣ Extract added bullet lines
+added_bullets=()
+while IFS= read -r line; do
+    [[ -n "$line" ]] && added_bullets+=("$line")
+done < <(echo "$raw_diff" | sed -n 's/^+//p' | grep -E '^[[:space:]]*[-*]' | sed '/^[[:space:]]*$/d')
+
+# 2️⃣a Extract deleted bullet lines
+deleted_bullets=()
+while IFS= read -r line; do
+    [[ -n "$line" ]] && deleted_bullets+=("$line")
+done < <(echo "$raw_diff" | grep '^\-' | grep -vE '^(--- |\+\+\+ |@@ )' | sed 's/^-//')
+
+# 2️⃣b Warn if no added entries
+if [[ ${#added_bullets[@]} -eq 0 ]]; then
+    echo -e "${RED}❌ No new changelog entries detected in this PR.${RESET}"
+    echo -e "${YELLOW}⚠️ Please add an entry in [UNRELEASED] under the appropriate subheading.${RESET}"
+    failed=1
+fi
+
+# 3️⃣ Initialize results
+correctly_placed=""
+orphan_entries=""
+wrong_release_entries=""
+
+# 4️⃣ Walk through changelog to classify entries
+current_release=""
+current_subtitle=""
+in_unreleased=0
+
+while IFS= read -r line; do
+    # Track release sections
+    if [[ $line =~ ^##\ \[Unreleased\] ]]; then
+        current_release="Unreleased"
+        in_unreleased=1
+        current_subtitle=""
+        continue
+    elif [[ $line =~ ^##\ \[.*\] ]]; then
+        current_release="$line"
+        in_unreleased=0
+        current_subtitle=""
+        continue
+    elif [[ $line =~ ^### ]]; then
+        current_subtitle="$line"
+        continue
+    fi
+
+    # Check each added bullet
+    for added in "${added_bullets[@]}"; do
+        if [[ "$line" == "$added" ]]; then
+            if [[ "$in_unreleased" -eq 1 && -n "$current_subtitle" ]]; then
+                correctly_placed+="$added   (placed under $current_subtitle)"$'\n'
+            elif [[ "$in_unreleased" -eq 1 && -z "$current_subtitle" ]]; then
+                orphan_entries+="$added   (NOT under a subtitle)"$'\n'
+            elif [[ "$in_unreleased" -eq 0 ]]; then
+                wrong_release_entries+="$added   (added under released version $current_release)"$'\n'
+            fi
+        fi
+    done
+done < "$CHANGELOG"
+
+# 5️⃣ Display results
+if [[ -n "$orphan_entries" ]]; then
+    echo -e "${RED}❌ Some CHANGELOG entries are not under a subtitle in [Unreleased]:${RESET}"
+    echo "$orphan_entries"
+    failed=1
+fi
+
+if [[ -n "$wrong_release_entries" ]]; then
+    echo -e "${RED}❌ Some changelog entries were added under a released version (should be in [Unreleased]):${RESET}"
+    echo "$wrong_release_entries"
+    failed=1
+fi
+
+if [[ -n "$correctly_placed" ]]; then
+    echo -e "${GREEN}✅ Some CHANGELOG entries are correctly placed under [Unreleased]:${RESET}"
+    echo "$correctly_placed"
+fi
+
+# 6️⃣ Display deleted entries
+if [[ ${#deleted_bullets[@]} -gt 0 ]]; then
+    echo -e "${RED}❌ Changelog entries removed in this PR:${RESET}"
+    for deleted in "${deleted_bullets[@]}"; do
+        echo -e "  - ${RED}$deleted${RESET}"
+    done
+    echo -e "${YELLOW}⚠️ Please add these entries back under the appropriate sections${RESET}"
+fi
+
+# 7️⃣ Exit with failure if any bad entries exist
+if [[ $failed -eq 1 ]]; then
+    echo -e "${RED}❌ Changelog check failed.${RESET}"
+    exit 1
+else
+    echo -e "${GREEN}✅ Changelog check passed.${RESET}"
+    exit 0
+fi
diff --git a/.github/workflows/bot-office-hours.yml b/.github/workflows/bot-office-hours.yml
@@ -0,0 +1,73 @@
+name: PythonBot - Office Hour Reminder
+
+on:
+  # push:
+  schedule:
+    - cron: '0 10 * * 3'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  office-hour-reminder:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 
+        with:
+          egress-policy: audit
+
+      - name: Check Schedule and Notify
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          ANCHOR_DATE="2025-12-03"
+          MEETING_LINK="https://zoom-lfx.platform.linuxfoundation.org/meeting/99912667426?password=5b584a0e-1ed7-49d3-b2fc-dc5ddc888338"
+          CALENDAR_LINK="https://zoom-lfx.platform.linuxfoundation.org/meetings/hiero?view=week"
+
+          IS_MEETING_WEEK=$(python3 -c "from datetime import date; import os; d1=date.fromisoformat('$ANCHOR_DATE'); d2=date.today(); print('true' if (d2-d1).days % 14 == 0 else 'false')")
+
+          if [ "$IS_MEETING_WEEK" = "false" ]; then
+            echo "Not a fortnightly meeting week. Skipping execution."
+            exit 0
+          fi
+
+          echo "Meeting week detected. Proceeding to notify open PRs."
+
+          REPO="${{ github.repository }}"
+          PR_LIST=$(gh pr list --repo $REPO --state open --json number --jq '.[].number')
+
+          if [ -z "$PR_LIST" ]; then
+            echo "No open PRs found."
+            exit 0
+          fi
+
+          COMMENT_BODY=$(cat <<EOF
+          Hello, this is the Office Hour Bot.
+
+          This is a reminder that the Hiero Python SDK Office Hours are scheduled in approximately 4 hours (14:00 UTC).
+
+          This session provides an opportunity to ask questions regarding this Pull Request or receive assistance from a maintainer.
+
+          Details:
+          - Time: 14:00 UTC
+          - Join Link: [Zoom Meeting]($MEETING_LINK)
+
+          Disclaimer: This is an automated reminder. Please verify the schedule [here]($CALENDAR_LINK) to be notified of any changes.
+          EOF
+          )
+
+          for PR_NUM in $PR_LIST; do
+            echo "Processing PR #$PR_NUM"
+
+            ALREADY_COMMENTED=$(gh pr view $PR_NUM --repo $REPO --json comments --jq '.comments[].body' | grep -F "Office Hour Bot" || true)
+
+            if [ -z "$ALREADY_COMMENTED" ]; then
+              gh pr comment $PR_NUM --repo $REPO --body "$COMMENT_BODY"
+              echo "Reminder posted to PR #$PR_NUM"
+            else
+              echo "PR #$PR_NUM already notified. Skipping."
+            fi
+          done
diff --git a/.github/workflows/bot-verified-commits.yml b/.github/workflows/bot-verified-commits.yml
@@ -38,8 +38,16 @@ jobs:
 
           echo "Unverified commits: $UNVERIFIED_COUNT"
 
+          EXISTING_BOT_COMMENT_COUNT=$(gh pr view $PR_NUMBER --repo $REPO --json comments | jq '[.comments[] | select(.author.login == "github-actions" and (.body | contains("[commit-verification-bot]")))] | length')
+
+          echo "Existing verification commit bot comments: $EXISTING_BOT_COMMENT_COUNT"
+
           if [ "$UNVERIFIED_COUNT" -gt 0 ]; then
-            COMMENT=$(cat <<EOF
+            if [ "$EXISTING_BOT_COMMENT_COUNT" -ge 1 ]; then   
+              echo "VerificationBot already commented. Skipping additional comments."
+            else 
+              COMMENT=$(cat <<EOF
+            [commit-verification-bot]
             Hi, this is VerificationBot. 
             Your pull request cannot be merged as it has **unverified commits**. 
             View your commit verification status: [Commits Tab]($COMMITS_URL).
@@ -58,9 +66,11 @@ jobs:
           EOF
             )
 
-            gh pr view $PR_NUMBER --repo $REPO --json comments --jq '.comments[].body' | grep -F "PythonBot" >/dev/null || \
-            (gh pr comment $PR_NUMBER --repo $REPO --body "$COMMENT" && echo "Comment added to PR #$PR_NUMBER")
+              gh pr comment $PR_NUMBER --repo $REPO --body "$COMMENT"
+              echo "Comment added to PR #$PR_NUMBER"
+            fi
+
+            exit 1
           else
             echo "All commits in PR #$PR_NUMBER are verified."
           fi
-
diff --git a/.github/workflows/merge-conflict-bot.yml b/.github/workflows/merge-conflict-bot.yml
@@ -0,0 +1,71 @@
+name: PythonBot - Check Merge Conflicts
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: "check-conflicts-${{ github.event.pull_request.number }}"
+  cancel-in-progress: true
+
+jobs:
+  check-conflicts:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        with:
+          egress-policy: audit
+
+      - name: Check for merge conflicts
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PR_NUMBER=${{ github.event.pull_request.number }}
+          REPO="${{ github.repository }}"
+
+          echo "Checking merge status for PR #$PR_NUMBER in repository $REPO..."
+
+          for i in {1..10}; do
+            PR_JSON=$(gh api repos/$REPO/pulls/$PR_NUMBER)
+            MERGEABLE_STATE=$(echo "$PR_JSON" | jq -r '.mergeable_state')
+
+            echo "Attempt $i: Current mergeable state: $MERGEABLE_STATE"
+
+            if [ "$MERGEABLE_STATE" != "unknown" ]; then
+              break
+            fi
+
+            echo "State is 'unknown', waiting 2 seconds..."
+            sleep 2
+          done
+
+          if [ "$MERGEABLE_STATE" = "dirty" ]; then
+            COMMENT=$(cat <<EOF
+            Hi, this is MergeConflictBot. 
+            Your pull request cannot be merged because it contains **merge conflicts**. 
+
+            Please resolve these conflicts locally and push the changes.
+
+            To assist you, please read:
+            - [Resolving Merge Conflicts](docs/sdk_developers/merge_conflicts.md)
+            - [Rebasing Guide](docs/sdk_developers/rebasing.md)
+
+            Thank you for contributing!
+
+            From the Hiero Python SDK Team
+          EOF
+            )
+
+            gh pr view $PR_NUMBER --repo $REPO --json comments --jq '.comments[].body' | grep -F "MergeConflictBot" >/dev/null || \
+            (gh pr comment $PR_NUMBER --repo $REPO --body "$COMMENT" && echo "Comment added to PR #$PR_NUMBER")
+
+            exit 1
+          else
+            echo "No merge conflicts detected (State: $MERGEABLE_STATE)."
+          fi
diff --git a/.github/workflows/pr-check-changelog.yml b/.github/workflows/pr-check-changelog.yml
@@ -0,0 +1,27 @@
+name: 'PR Changelog Check'
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types: [opened, reopened, edited, synchronize]
+
+permissions:
+  contents: read
+
+jobs:
+  changelog-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Harden the runner
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        with:
+          egress-policy: audit
+
+      - name: Run local changelog check
+        run: |
+          chmod +x .github/scripts/changelog_check.sh
+          bash .github/scripts/changelog_check.sh
diff --git a/.github/workflows/pr-check-title.yml b/.github/workflows/pr-check-title.yml
@@ -0,0 +1,41 @@
+name: 'PR Formatting'
+on:
+  workflow_dispatch:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - edited
+      - synchronize
+
+defaults:
+  run:
+    shell: bash
+
+permissions:
+  contents: read
+  checks: write
+  statuses: write
+
+concurrency:
+  group: pr-checks-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  title-check:
+    name: Title Check
+    runs-on: ubuntu-latest
+    if: ${{ !github.event.pull_request.base.repo.fork }}
+    permissions:
+      checks: write
+      statuses: write
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        with:
+          egress-policy: audit
+
+      - name: Check PR Title
+        uses: step-security/conventional-pr-title-action@cb1c5657ccf4c42f5c0a6c0708cb8251b960d902 # v3.2.5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}