From 18d9d1d24df6c47a78f6f103f9178eea4c24eebe Mon Sep 17 00:00:00 2001
From: Jeff Welling <tvc-jeff.welling@smartcontract.com>
Date: Tue, 20 Oct 2026 14:18:52 -0700
Subject: [PATCH 1/8] Create change-management-check composite action

Fails the check when a Testing evidence, Success / failure criteria, or Rollback plan section in the PR body is empty or missing. Exempt: Renovate branches, docs-only PRs, dev-only PRs.
---
 .changeset/change-management-check.md         |   5 +
 actions/change-management-check/README.md     |   4 +
 actions/change-management-check/action.yml    |  49 ++
 actions/change-management-check/package.json  |  11 +
 actions/change-management-check/project.json  |  16 +
 .../change-management-check/scripts/check.js  | 214 ++++++++
 .../scripts/check.test.js                     | 462 ++++++++++++++++++
 pnpm-lock.yaml                                |   2 +
 8 files changed, 763 insertions(+)
 create mode 100644 .changeset/change-management-check.md
 create mode 100644 actions/change-management-check/README.md
 create mode 100644 actions/change-management-check/action.yml
 create mode 100644 actions/change-management-check/package.json
 create mode 100644 actions/change-management-check/project.json
 create mode 100644 actions/change-management-check/scripts/check.js
 create mode 100644 actions/change-management-check/scripts/check.test.js

diff --git a/.changeset/change-management-check.md b/.changeset/change-management-check.md
new file mode 100644
index 000000000..51d24bcfd
--- /dev/null
+++ b/.changeset/change-management-check.md
@@ -0,0 +1,5 @@
+---
+"change-management-check": major
+---
+
+Add the change-management-check composite action: fails the check when a change-management section in the PR body is empty or missing.
diff --git a/actions/change-management-check/README.md b/actions/change-management-check/README.md
new file mode 100644
index 000000000..759a19abb
--- /dev/null
+++ b/actions/change-management-check/README.md
@@ -0,0 +1,4 @@
+# change-management-check
+
+> Fails the check when a change-management section in the PR body is empty or
+> missing
diff --git a/actions/change-management-check/action.yml b/actions/change-management-check/action.yml
new file mode 100644
index 000000000..44c981219
--- /dev/null
+++ b/actions/change-management-check/action.yml
@@ -0,0 +1,49 @@
+name: change-management-check
+description:
+  "Fails the check when a change-management section in the PR body is empty or
+  missing"
+
+inputs:
+  sections:
+    description:
+      "Lines of 'Display name: heading text'. One line per required section."
+    required: true
+  strip-lines:
+    description:
+      "Lines removed from a section before the empty test. Use for template
+      default lines."
+    required: false
+    default: ""
+  docs-paths:
+    description: "Glob lines. A PR whose files all match is exempt (docs-only)."
+    required: false
+    default: "**/*.md"
+  dev-paths:
+    description: "Glob lines. A PR whose files all match is exempt (dev-only)."
+    required: false
+    default: ""
+  head-prefixes:
+    description: "Comma separated head-branch prefixes that are exempt."
+    required: false
+    default: "renovate/"
+  standard-url:
+    description: "Link to the Standard, included in the failure message."
+    required: false
+    default: "https://smartcontract-it.atlassian.net/wiki/spaces/ENG/pages/1417445401/Infrastructure+Change+Management+Standard"
+
+runs:
+  using: composite
+  steps:
+    - name: Check change management sections
+      uses: actions/github-script@v9
+      env:
+        SECTIONS: ${{ inputs.sections }}
+        STRIP_LINES: ${{ inputs.strip-lines }}
+        DOCS_PATHS: ${{ inputs.docs-paths }}
+        DEV_PATHS: ${{ inputs.dev-paths }}
+        HEAD_PREFIXES: ${{ inputs.head-prefixes }}
+        STANDARD_URL: ${{ inputs.standard-url }}
+      with:
+        script: |
+          const script = require(`${process.env.GITHUB_ACTION_PATH}/scripts/check.js`);
+          await script({ context, core, github });
diff --git a/actions/change-management-check/package.json b/actions/change-management-check/package.json
new file mode 100644
index 000000000..9c1d47391
--- /dev/null
+++ b/actions/change-management-check/package.json
@@ -0,0 +1,11 @@
+{
+  "name": "change-management-check",
+  "version": "0.0.0",
+  "description": "",
+  "private": true,
+  "scripts": {},
+  "author": "@smartcontractkit",
+  "license": "MIT",
+  "dependencies": {},
+  "repository": "https://github.com/smartcontractkit/.github"
+}
diff --git a/actions/change-management-check/project.json b/actions/change-management-check/project.json
new file mode 100644
index 000000000..4b19ca6a7
--- /dev/null
+++ b/actions/change-management-check/project.json
@@ -0,0 +1,16 @@
+{
+  "name": "change-management-check",
+  "$schema": "../../node_modules/nx/schemas/project-schema.json",
+  "projectType": "application",
+  "sourceRoot": "actions/change-management-check",
+  "targets": {
+    "test": {
+      "executor": "nx:run-commands",
+      "options": {
+        "cwd": "{projectRoot}",
+        "color": true,
+        "command": "node --test"
+      }
+    }
+  }
+}
diff --git a/actions/change-management-check/scripts/check.js b/actions/change-management-check/scripts/check.js
new file mode 100644
index 000000000..8bc2305a0
--- /dev/null
+++ b/actions/change-management-check/scripts/check.js
@@ -0,0 +1,214 @@
+/**
+ * Fails the check when a change-management section in the PR body is empty
+ * or missing. Exempt: Renovate branches, docs-only PRs, dev-only PRs.
+ *
+ * Inputs (via environment):
+ *   SECTIONS:      lines of "Display name: heading text"
+ *   STRIP_LINES:   lines removed from a section before the empty test
+ *   DOCS_PATHS:    glob lines; a PR whose files all match is docs-only
+ *   DEV_PATHS:     glob lines; a PR whose files all match is dev-only
+ *   HEAD_PREFIXES: comma-separated head-branch prefixes that are exempt
+ *   STANDARD_URL:  link included in the failure message
+ */
+
+const DEFAULT_STANDARD_URL =
+  "https://smartcontract-it.atlassian.net/wiki/spaces/ENG/pages/1417445401" +
+  "/Infrastructure+Change+Management+Standard";
+
+const HEADING_RE = /^ {0,3}#{1,6}\s+(.*?)\s*#*\s*$/;
+const FENCE_RE = /^\s{0,3}(```|~~~)/;
+const COMMENT_RE = /<!--[\s\S]*?-->/g;
+
+function splitLines(value) {
+  return (value || "")
+    .split("\n")
+    .map((line) => line.trim())
+    .filter(Boolean);
+}
+
+// Converts a glob to an anchored RegExp. `**` crosses `/`, `*` does not.
+function globToRegExp(glob) {
+  let out = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        if (glob[i + 2] === "/") {
+          out += "(?:.*/)?";
+          i += 2;
+        } else {
+          out += ".*";
+          i += 1;
+        }
+      } else {
+        out += "[^/]*";
+      }
+    } else if (c === "?") {
+      out += "[^/]";
+    } else if ("\\^$.|+()[]{}".includes(c)) {
+      out += `\\${c}`;
+    } else {
+      out += c;
+    }
+  }
+  return new RegExp(`^${out}$`);
+}
+
+function parseSectionSpec(sections) {
+  return splitLines(sections).map((line) => {
+    const i = line.indexOf(":");
+    if (i === -1) {
+      throw new Error(
+        `Invalid sections line (want "Display: heading"): ${line}`,
+      );
+    }
+    return {
+      display: line.slice(0, i).trim(),
+      alias: line
+        .slice(i + 1)
+        .trim()
+        .toLowerCase(),
+    };
+  });
+}
+
+// Section bodies keyed by lowercased heading text. Fenced code is not scanned.
+function splitSections(body) {
+  const sections = new Map();
+  let current = null;
+  let fenced = false;
+  for (const line of body.split("\n")) {
+    if (FENCE_RE.test(line)) fenced = !fenced;
+    const heading = fenced ? null : line.match(HEADING_RE);
+    if (heading) {
+      current = heading[1].trim().toLowerCase();
+      if (!sections.has(current)) sections.set(current, []);
+      continue;
+    }
+    if (current !== null) sections.get(current).push(line);
+  }
+  return sections;
+}
+
+// Specs whose section body is empty after comment and strip-line removal.
+function missingSections(body, specs, stripLines) {
+  const sections = splitSections(String(body || "").replace(COMMENT_RE, ""));
+  const strip = new Set((stripLines || []).map((line) => line.trim()));
+  return specs.filter((spec) => {
+    const content = (sections.get(spec.alias) || [])
+      .filter((line) => !strip.has(line.trim()))
+      .join("\n")
+      .trim();
+    return content === "";
+  });
+}
+
+async function listFiles(github, context) {
+  const { owner, repo } = context.repo;
+  const pull_number = context.payload.pull_request.number;
+  const files = [];
+  // The API caps at 3000 files; 30 pages of 100.
+  for (let page = 1; page <= 30; page++) {
+    const { data } = await github.rest.pulls.listFiles({
+      owner,
+      repo,
+      pull_number,
+      per_page: 100,
+      page,
+    });
+    files.push(...data.map((file) => file.filename));
+    if (data.length < 100) break;
+  }
+  return files;
+}
+
+// Reason string when every changed file matches one glob set, else null.
+function classifyFiles(files, docsPaths, devPaths) {
+  if (files.length === 0) return null;
+  const allMatch = (regexps) =>
+    regexps.length > 0 &&
+    files.every((file) => regexps.some((re) => re.test(file)));
+  if (allMatch(docsPaths)) return "docs-only";
+  if (allMatch(devPaths)) return "dev-only";
+  return null;
+}
+
+// Reason string when the PR is exempt, else null.
+async function findExemption({
+  github,
+  context,
+  headPrefixes,
+  docsPaths,
+  devPaths,
+}) {
+  const headRef = context.payload.pull_request.head.ref || "";
+  const prefix = headPrefixes.find((p) => headRef.startsWith(p));
+  if (prefix) return `head branch starts with ${prefix}`;
+
+  return classifyFiles(await listFiles(github, context), docsPaths, devPaths);
+}
+
+function summarize(specs, missing) {
+  const empty = new Set(missing.map((spec) => spec.display));
+  return [
+    "### Change management check",
+    "",
+    ...specs.map(
+      (spec) =>
+        `- ${spec.display}: ${empty.has(spec.display) ? "empty" : "present"}`,
+    ),
+  ].join("\n");
+}
+
+module.exports = async ({ context, core, github }) => {
+  const pr = context.payload.pull_request;
+  if (!pr) {
+    core.info("This action is only applicable to pull requests.");
+    return;
+  }
+
+  const specs = parseSectionSpec(process.env.SECTIONS);
+  const stripLines = splitLines(process.env.STRIP_LINES);
+  const docsPaths = splitLines(process.env.DOCS_PATHS || "**/*.md").map(
+    globToRegExp,
+  );
+  const devPaths = splitLines(process.env.DEV_PATHS).map(globToRegExp);
+  const headPrefixes = (process.env.HEAD_PREFIXES || "renovate/")
+    .split(",")
+    .map((prefix) => prefix.trim())
+    .filter(Boolean);
+  const standardUrl = process.env.STANDARD_URL || DEFAULT_STANDARD_URL;
+
+  const exempt = await findExemption({
+    github,
+    context,
+    headPrefixes,
+    docsPaths,
+    devPaths,
+  });
+  if (exempt) {
+    core.info(
+      `Exempt (${exempt}): the change-management check does not apply.`,
+    );
+    return;
+  }
+
+  const missing = missingSections(pr.body, specs, stripLines);
+  core.summary.addRaw(summarize(specs, missing));
+
+  if (missing.length > 0) {
+    core.setFailed(
+      `Please fill in: ${missing.map((spec) => spec.display).join(", ")}. ` +
+        `See the Infrastructure Change Management Standard: ${standardUrl}`,
+    );
+    return;
+  }
+
+  core.info("All change-management sections are present.");
+};
+
+module.exports.classifyFiles = classifyFiles;
+module.exports.globToRegExp = globToRegExp;
+module.exports.missingSections = missingSections;
+module.exports.parseSectionSpec = parseSectionSpec;
+module.exports.splitSections = splitSections;
diff --git a/actions/change-management-check/scripts/check.test.js b/actions/change-management-check/scripts/check.test.js
new file mode 100644
index 000000000..3f377645f
--- /dev/null
+++ b/actions/change-management-check/scripts/check.test.js
@@ -0,0 +1,462 @@
+const test = require("node:test");
+const assert = require("node:assert/strict");
+
+const check = require("./check.js");
+const {
+  classifyFiles,
+  globToRegExp,
+  missingSections,
+  parseSectionSpec,
+  splitSections,
+} = check;
+
+// infra-k8s pull_request_template.md at origin/main, 2026-10-20.
+const INFRA_K8S_TEMPLATE = `## What
+
+<!--
+Brief, point form descriptions of what you changed
+Also, reference any Jira/Github issues here
+-->
+
+## Why
+
+<!--
+ Why is this change needed?
+-->
+
+## Testing evidence
+
+<!--
+Link the lower-environment PRs (dev / stage) where this change was applied, plus any dashboards or screenshots.
+-->
+
+## Success / failure criteria
+
+<!--
+Metric-based where possible. Reaching a failure criterion signals: revert.
+-->
+
+## Rollback plan
+
+<!--
+Step-by-step. Example: "Revert this PR, returning <app> to <previous version>".
+-->
+
+<!--
+## Notes
+- Notes are optional
+- Note anything of importance here: such as explanations/reasoning, pull requests that block this one, or…
+- TODO items…
+-->
+
+<!--
+ ChatOps commands:
+     - "/rerun": re-trigger the latest workflow run.
+     - "/unlock": remove existing application locks, allowing other PRs to deploy to those environments.
+     - "/show-prod": show the existing Prod status of applications modified in this PR.
+-->
+
+## Checklist
+
+- [ ] [pre-commit hooks](https://github.com/smartcontractkit/infra-k8s#pre-commit-hooks) set up and run
+- [ ] Relevant PRs and tickets linked
+`;
+
+// infra .github/pull_request_template.md at origin/master, 2026-10-20.
+const INFRA_TEMPLATE = `# Description
+
+1. Why is this change necessary?
+
+2. What are the key changes introduced?
+
+<!--
+# Design Documentation
+
+Link to any design documents or diagrams relevant to this feature.
+-->
+
+# Related Issues/Tickets
+
+- Jira ticket: https://smartcontract-it.atlassian.net/browse/<TICKET_ID>
+
+# Testing Evidence
+
+<!-- Link the PRs that applied this change to lower environments (dev / stage), plus any dashboards or screenshots. -->
+
+# Success / Failure Criteria
+
+<!-- Metric-based where possible. Reaching a failure criterion signals: revert. -->
+
+# Rollback Plan
+
+<!-- Step-by-step. Example: revert this PR and re-apply, returning the resource to its previous configuration. -->
+
+# Checklist
+
+- [ ] **Tagging:** All resources are properly tagged in the metadata.hcl file for the directory being modified. Follow the tagging instructions [here](https://github.com/smartcontractkit/infra/tree/master?tab=readme-ov-file#tagging)
+- [ ] **Code Owners:** The [CODEOWNERS file](https://github.com/smartcontractkit/infra/blob/master/.github/CODEOWNERS) is updated to ensure the correct team is assigned for reviewing this PR. If you're unfamiliar with Code Owners, see the GitHub [documentation](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners).
+
+<!--
+# Additional Notes
+
+Any additional information or context relevant to this PR.
+-->
+`;
+
+// infra-management pull_request_template.md at origin/main, 2026-10-20.
+const INFRA_MGMT_TEMPLATE = `## Why is this change necessary?
+<!-- Briefly explain the reason for this PR and link the Jira ticket -->
+Jira Ticket: https://smartcontract-it.atlassian.net/browse/<ticket>
+
+## What's changing?
+<!-- List main changes clearly and concisely -->
+
+## How was this tested?
+<!-- Confirm you've tested your changes in lower environments (e.g., dev, stage) and link those PRs -->
+- [] Tested successfully in dev/stage or I'm releasing to dev only.
+  - testing evidence:
+
+## What are the success / failure criteria?
+<!-- Metric-based where possible. Reaching a failure criterion signals: revert. -->
+
+## What is the rollback plan?
+<!-- Step-by-step. Usually "revert this PR"; add steps if a revert alone is not enough. -->
+
+<!--
+## Additional Notes (Uncomment if applicable)
+- [ ] Documentation updates required
+- [ ] Notify affected users or teams
+- [ ] Backward compatibility verified
+-->
+`;
+
+const SPECS = parseSectionSpec(`Testing evidence: testing evidence
+Success / failure criteria: success / failure criteria
+Rollback plan: rollback plan`);
+
+const MGMT_SPECS = parseSectionSpec(`Testing evidence: how was this tested?
+Success / failure criteria: what are the success / failure criteria?
+Rollback plan: what is the rollback plan?`);
+
+const MGMT_STRIP = [
+  "- [] Tested successfully in dev/stage or I'm releasing to dev only.",
+  "- testing evidence:",
+];
+
+const names = (missing) => missing.map((spec) => spec.display);
+
+test("glob: **/ matches the root and nested paths", () => {
+  const re = globToRegExp("**/*.md");
+  assert.ok(re.test("README.md"));
+  assert.ok(re.test("docs/guide/intro.md"));
+  assert.ok(!re.test("README.txt"));
+});
+
+test("glob: trailing /** matches under the directory only", () => {
+  const re = globToRegExp("projects/ingest-hub-preview/**");
+  assert.ok(re.test("projects/ingest-hub-preview/a.yaml"));
+  assert.ok(re.test("projects/ingest-hub-preview/apps/a.yaml"));
+  assert.ok(!re.test("projects/other/a.yaml"));
+});
+
+test("glob: * does not cross a slash", () => {
+  const re = globToRegExp("clusters/*.sand.yaml");
+  assert.ok(re.test("clusters/main.sand.yaml"));
+  assert.ok(!re.test("clusters/sub/main.sand.yaml"));
+  assert.ok(!re.test("clusters/main.prod.yaml"));
+});
+
+test("spec: parses display and alias", () => {
+  assert.deepEqual(parseSectionSpec("Testing evidence: testing evidence"), [
+    { display: "Testing evidence", alias: "testing evidence" },
+  ]);
+});
+
+test("spec: rejects a line without a colon", () => {
+  assert.throws(() => parseSectionSpec("Testing evidence"));
+});
+
+test("sections: any heading level, case-insensitive", () => {
+  const sections = splitSections("# TESTING EVIDENCE\n\nran in stage\n");
+  assert.deepEqual(sections.get("testing evidence"), ["", "ran in stage", ""]);
+});
+
+test("sections: fenced code is not scanned for headings", () => {
+  const body = "## Testing evidence\n\n```yaml\n# not a heading\n```\n";
+  const sections = splitSections(body);
+  assert.ok(sections.has("testing evidence"));
+  assert.ok(!sections.has("not a heading"));
+});
+
+test("fresh infra-k8s template: all three sections empty", () => {
+  assert.deepEqual(names(missingSections(INFRA_K8S_TEMPLATE, SPECS, [])), [
+    "Testing evidence",
+    "Success / failure criteria",
+    "Rollback plan",
+  ]);
+});
+
+test("fresh infra template: all three sections empty", () => {
+  assert.deepEqual(names(missingSections(INFRA_TEMPLATE, SPECS, [])), [
+    "Testing evidence",
+    "Success / failure criteria",
+    "Rollback plan",
+  ]);
+});
+
+test("fresh infra-management template: all three sections empty", () => {
+  assert.deepEqual(
+    names(missingSections(INFRA_MGMT_TEMPLATE, MGMT_SPECS, MGMT_STRIP)),
+    ["Testing evidence", "Success / failure criteria", "Rollback plan"],
+  );
+});
+
+test("infra-management template without strip-lines: defaults count", () => {
+  assert.deepEqual(
+    names(missingSections(INFRA_MGMT_TEMPLATE, MGMT_SPECS, [])),
+    ["Success / failure criteria", "Rollback plan"],
+  );
+});
+
+test("infra-management: text after the testing evidence label counts", () => {
+  const body = INFRA_MGMT_TEMPLATE.replace(
+    "  - testing evidence:",
+    "  - testing evidence: https://github.com/smartcontractkit/infra-management/pull/1",
+  );
+  assert.deepEqual(names(missingSections(body, MGMT_SPECS, MGMT_STRIP)), [
+    "Success / failure criteria",
+    "Rollback plan",
+  ]);
+});
+
+test("filled sections pass", () => {
+  const body = `# Testing Evidence
+
+Ran in stage: PR #1.
+
+# Success / Failure Criteria
+
+Error rate stays flat for 30 minutes.
+
+# Rollback Plan
+
+Revert this PR.
+`;
+  assert.deepEqual(missingSections(body, SPECS, []), []);
+});
+
+test("partial fill names only the missing section", () => {
+  const body = `## Testing evidence
+
+Ran in stage: PR #1.
+
+## Rollback plan
+
+Revert this PR.
+`;
+  assert.deepEqual(names(missingSections(body, SPECS, [])), [
+    "Success / failure criteria",
+  ]);
+});
+
+test("content inside an HTML comment does not count", () => {
+  const body = `## Testing evidence
+
+<!-- Ran in stage: PR #1 -->
+
+## Success / failure criteria
+
+<!-- metric -->
+
+## Rollback plan
+
+<!-- revert -->
+`;
+  assert.equal(missingSections(body, SPECS, []).length, 3);
+});
+
+test("commented-out headings are ignored", () => {
+  const body = `## Testing evidence
+
+ran in stage
+
+<!--
+## Notes
+- hidden
+-->
+`;
+  assert.deepEqual(names(missingSections(body, SPECS, [])), [
+    "Success / failure criteria",
+    "Rollback plan",
+  ]);
+});
+
+test("null body fails all sections", () => {
+  assert.equal(missingSections(null, SPECS, []).length, 3);
+});
+
+test("classifyFiles: docs-only, dev-only, mixed, empty", () => {
+  const docs = [globToRegExp("**/*.md")];
+  const dev = [globToRegExp("projects/ingest-hub-preview/**")];
+  assert.equal(classifyFiles(["README.md"], docs, dev), "docs-only");
+  assert.equal(classifyFiles(["a.md", "b.yaml"], docs, dev), null);
+  assert.equal(
+    classifyFiles(["projects/ingest-hub-preview/a.yaml"], docs, dev),
+    "dev-only",
+  );
+  assert.equal(classifyFiles(["README.md", "a.yaml"], docs, dev), null);
+  assert.equal(classifyFiles([], docs, dev), null);
+});
+
+const ENV_KEYS = [
+  "SECTIONS",
+  "STRIP_LINES",
+  "DOCS_PATHS",
+  "DEV_PATHS",
+  "HEAD_PREFIXES",
+  "STANDARD_URL",
+];
+
+function setEnv(env) {
+  for (const key of ENV_KEYS) delete process.env[key];
+  Object.assign(process.env, env);
+}
+
+function fakeCore() {
+  const calls = { failed: [], info: [], summary: [] };
+  return {
+    calls,
+    info: (msg) => calls.info.push(msg),
+    setFailed: (msg) => calls.failed.push(msg),
+    summary: { addRaw: (msg) => calls.summary.push(msg) },
+  };
+}
+
+function fakeContext({ ref = "feat/x", body = "", number = 1 } = {}) {
+  return {
+    repo: { owner: "o", repo: "r" },
+    payload: { pull_request: { number, body, head: { ref } } },
+  };
+}
+
+function fakeGithub(filenames) {
+  return {
+    rest: {
+      pulls: {
+        listFiles: async () =>
+          filenames.length
+            ? { data: filenames.map((filename) => ({ filename })) }
+            : { data: [] },
+      },
+    },
+  };
+}
+
+const PROD_FILES = ["clusters/main.prod.yaml"];
+
+test("run: empty template fails and names every section", async () => {
+  setEnv({
+    SECTIONS:
+      "Testing evidence: testing evidence\nRollback plan: rollback plan",
+  });
+  const core = fakeCore();
+  await check({
+    context: fakeContext({ body: INFRA_K8S_TEMPLATE }),
+    core,
+    github: fakeGithub(PROD_FILES),
+  });
+  assert.equal(core.calls.failed.length, 1);
+  assert.match(
+    core.calls.failed[0],
+    /^Please fill in: Testing evidence, Rollback plan\. /,
+  );
+  assert.match(
+    core.calls.failed[0],
+    /Infrastructure\+Change\+Management\+Standard$/,
+  );
+  assert.match(core.calls.summary[0], /- Testing evidence: empty/);
+});
+
+test("run: filled body passes", async () => {
+  setEnv({
+    SECTIONS:
+      "Testing evidence: testing evidence\nRollback plan: rollback plan",
+  });
+  const body =
+    "# Testing Evidence\n\nRan in stage: PR #1.\n\n# Rollback Plan\n\nRevert.\n";
+  const core = fakeCore();
+  await check({
+    context: fakeContext({ body }),
+    core,
+    github: fakeGithub(PROD_FILES),
+  });
+  assert.equal(core.calls.failed.length, 0);
+  assert.deepEqual(core.calls.info, [
+    "All change-management sections are present.",
+  ]);
+});
+
+test("run: renovate branch is exempt without an API call", async () => {
+  setEnv({ SECTIONS: "Testing evidence: testing evidence" });
+  const core = fakeCore();
+  const github = {
+    rest: {
+      pulls: {
+        listFiles: async () => {
+          throw new Error("must not be called");
+        },
+      },
+    },
+  };
+  await check({
+    context: fakeContext({ ref: "renovate/lodash-4.x", body: "" }),
+    core,
+    github,
+  });
+  assert.equal(core.calls.failed.length, 0);
+  assert.match(
+    core.calls.info[0],
+    /^Exempt \(head branch starts with renovate\/\)/,
+  );
+});
+
+test("run: docs-only PR is exempt", async () => {
+  setEnv({ SECTIONS: "Testing evidence: testing evidence" });
+  const core = fakeCore();
+  await check({
+    context: fakeContext({ body: "" }),
+    core,
+    github: fakeGithub(["docs/readme.md"]),
+  });
+  assert.equal(core.calls.failed.length, 0);
+  assert.match(core.calls.info[0], /^Exempt \(docs-only\)/);
+});
+
+test("run: dev-only PR is exempt when dev-paths are set", async () => {
+  setEnv({
+    SECTIONS: "Testing evidence: testing evidence",
+    DEV_PATHS: "projects/ingest-hub-preview/**",
+  });
+  const core = fakeCore();
+  await check({
+    context: fakeContext({ body: "" }),
+    core,
+    github: fakeGithub(["projects/ingest-hub-preview/apps/a.yaml"]),
+  });
+  assert.equal(core.calls.failed.length, 0);
+  assert.match(core.calls.info[0], /^Exempt \(dev-only\)/);
+});
+
+test("run: non-pull-request payload is skipped", async () => {
+  const core = fakeCore();
+  await check({
+    context: { repo: { owner: "o", repo: "r" }, payload: {} },
+    core,
+    github: fakeGithub(PROD_FILES),
+  });
+  assert.equal(core.calls.failed.length, 0);
+  assert.equal(
+    core.calls.info[0],
+    "This action is only applicable to pull requests.",
+  );
+});
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 804c82bd1..ab188a68e 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -192,6 +192,8 @@ importers:
 
   actions/bump-mcms-tools: {}
 
+  actions/change-management-check: {}
+
   actions/changed-modules-go:
     dependencies:
       '@actions/core':

From e98321783ca1730b30f81bfc93d7e179b619683c Mon Sep 17 00:00:00 2001
From: Jeff Welling <tvc-jeff.welling@smartcontract.com>
Date: Tue, 20 Oct 2026 14:45:17 -0700
Subject: [PATCH 2/8] fix: write the job summary and harden comment stripping

Strip HTML comments with an indexOf loop instead of a regex (CodeQL js/incomplete-multi-character-sanitization). An unterminated comment now drops the rest of the body, matching how GitHub renders it. Call core.summary.write(); addRaw alone leaves the buffer unwritten. Treat an explicit empty docs-paths or head-prefixes input as no exemption instead of falling back to a default.
---
 .../change-management-check/scripts/check.js  | 27 +++++++---
 .../scripts/check.test.js                     | 53 +++++++++++++++++--
 2 files changed, 70 insertions(+), 10 deletions(-)

diff --git a/actions/change-management-check/scripts/check.js b/actions/change-management-check/scripts/check.js
index 8bc2305a0..f8c24e375 100644
--- a/actions/change-management-check/scripts/check.js
+++ b/actions/change-management-check/scripts/check.js
@@ -17,7 +17,6 @@ const DEFAULT_STANDARD_URL =
 
 const HEADING_RE = /^ {0,3}#{1,6}\s+(.*?)\s*#*\s*$/;
 const FENCE_RE = /^\s{0,3}(```|~~~)/;
-const COMMENT_RE = /<!--[\s\S]*?-->/g;
 
 function splitLines(value) {
   return (value || "")
@@ -90,9 +89,24 @@ function splitSections(body) {
   return sections;
 }
 
+// Removes HTML comments, including multiline ones. An unterminated comment
+// drops the rest of the text, matching how GitHub renders the body.
+function stripComments(text) {
+  let out = "";
+  let i = 0;
+  for (;;) {
+    const start = text.indexOf("<!--", i);
+    if (start === -1) return out + text.slice(i);
+    out += text.slice(i, start);
+    const end = text.indexOf("-->", start + 4);
+    if (end === -1) return out;
+    i = end + 3;
+  }
+}
+
 // Specs whose section body is empty after comment and strip-line removal.
 function missingSections(body, specs, stripLines) {
-  const sections = splitSections(String(body || "").replace(COMMENT_RE, ""));
+  const sections = splitSections(stripComments(String(body || "")));
   const strip = new Set((stripLines || []).map((line) => line.trim()));
   return specs.filter((spec) => {
     const content = (sections.get(spec.alias) || [])
@@ -169,11 +183,11 @@ module.exports = async ({ context, core, github }) => {
 
   const specs = parseSectionSpec(process.env.SECTIONS);
   const stripLines = splitLines(process.env.STRIP_LINES);
-  const docsPaths = splitLines(process.env.DOCS_PATHS || "**/*.md").map(
-    globToRegExp,
-  );
+  // action.yml supplies the defaults. An explicit empty input disables the
+  // exemption.
+  const docsPaths = splitLines(process.env.DOCS_PATHS).map(globToRegExp);
   const devPaths = splitLines(process.env.DEV_PATHS).map(globToRegExp);
-  const headPrefixes = (process.env.HEAD_PREFIXES || "renovate/")
+  const headPrefixes = (process.env.HEAD_PREFIXES || "")
     .split(",")
     .map((prefix) => prefix.trim())
     .filter(Boolean);
@@ -195,6 +209,7 @@ module.exports = async ({ context, core, github }) => {
 
   const missing = missingSections(pr.body, specs, stripLines);
   core.summary.addRaw(summarize(specs, missing));
+  await core.summary.write();
 
   if (missing.length > 0) {
     core.setFailed(
diff --git a/actions/change-management-check/scripts/check.test.js b/actions/change-management-check/scripts/check.test.js
index 3f377645f..2be25f745 100644
--- a/actions/change-management-check/scripts/check.test.js
+++ b/actions/change-management-check/scripts/check.test.js
@@ -295,6 +295,14 @@ test("null body fails all sections", () => {
   assert.equal(missingSections(null, SPECS, []).length, 3);
 });
 
+test("an unterminated HTML comment drops the rest of the body", () => {
+  const body = `## Testing evidence
+
+<!-- ran in stage: PR #1
+`;
+  assert.equal(missingSections(body, SPECS, []).length, 3);
+});
+
 test("classifyFiles: docs-only, dev-only, mixed, empty", () => {
   const docs = [globToRegExp("**/*.md")];
   const dev = [globToRegExp("projects/ingest-hub-preview/**")];
@@ -323,12 +331,17 @@ function setEnv(env) {
 }
 
 function fakeCore() {
-  const calls = { failed: [], info: [], summary: [] };
+  const calls = { failed: [], info: [], summary: [], writes: 0 };
   return {
     calls,
     info: (msg) => calls.info.push(msg),
     setFailed: (msg) => calls.failed.push(msg),
-    summary: { addRaw: (msg) => calls.summary.push(msg) },
+    summary: {
+      addRaw: (msg) => calls.summary.push(msg),
+      write: async () => {
+        calls.writes += 1;
+      },
+    },
   };
 }
 
@@ -375,6 +388,7 @@ test("run: empty template fails and names every section", async () => {
     /Infrastructure\+Change\+Management\+Standard$/,
   );
   assert.match(core.calls.summary[0], /- Testing evidence: empty/);
+  assert.equal(core.calls.writes, 1);
 });
 
 test("run: filled body passes", async () => {
@@ -397,7 +411,10 @@ test("run: filled body passes", async () => {
 });
 
 test("run: renovate branch is exempt without an API call", async () => {
-  setEnv({ SECTIONS: "Testing evidence: testing evidence" });
+  setEnv({
+    SECTIONS: "Testing evidence: testing evidence",
+    HEAD_PREFIXES: "renovate/",
+  });
   const core = fakeCore();
   const github = {
     rest: {
@@ -421,7 +438,10 @@ test("run: renovate branch is exempt without an API call", async () => {
 });
 
 test("run: docs-only PR is exempt", async () => {
-  setEnv({ SECTIONS: "Testing evidence: testing evidence" });
+  setEnv({
+    SECTIONS: "Testing evidence: testing evidence",
+    DOCS_PATHS: "**/*.md",
+  });
   const core = fakeCore();
   await check({
     context: fakeContext({ body: "" }),
@@ -447,6 +467,31 @@ test("run: dev-only PR is exempt when dev-paths are set", async () => {
   assert.match(core.calls.info[0], /^Exempt \(dev-only\)/);
 });
 
+test("run: empty head-prefixes disables the prefix exemption", async () => {
+  setEnv({
+    SECTIONS: "Testing evidence: testing evidence",
+    HEAD_PREFIXES: "",
+  });
+  const core = fakeCore();
+  await check({
+    context: fakeContext({ ref: "renovate/lodash-4.x", body: "" }),
+    core,
+    github: fakeGithub(PROD_FILES),
+  });
+  assert.equal(core.calls.failed.length, 1);
+});
+
+test("run: empty docs-paths disables the docs exemption", async () => {
+  setEnv({ SECTIONS: "Testing evidence: testing evidence", DOCS_PATHS: "" });
+  const core = fakeCore();
+  await check({
+    context: fakeContext({ body: "" }),
+    core,
+    github: fakeGithub(["docs/readme.md"]),
+  });
+  assert.equal(core.calls.failed.length, 1);
+});
+
 test("run: non-pull-request payload is skipped", async () => {
   const core = fakeCore();
   await check({

From 408eaccea8a45ee2b3ce6124cc410126bde54a57 Mon Sep 17 00:00:00 2001
From: Jeff Welling <tvc-jeff.welling@smartcontract.com>
Date: Tue, 20 Oct 2026 15:09:11 -0700
Subject: [PATCH 3/8] refactor: rewrite globToRegExp as a token table

Same matching behavior, one loop, no index arithmetic. Adds a test for the ? token.
---
 .../change-management-check/scripts/check.js  | 45 ++++++++++---------
 .../scripts/check.test.js                     |  7 +++
 2 files changed, 30 insertions(+), 22 deletions(-)

diff --git a/actions/change-management-check/scripts/check.js b/actions/change-management-check/scripts/check.js
index f8c24e375..65edca76c 100644
--- a/actions/change-management-check/scripts/check.js
+++ b/actions/change-management-check/scripts/check.js
@@ -25,32 +25,33 @@ function splitLines(value) {
     .filter(Boolean);
 }
 
-// Converts a glob to an anchored RegExp. `**` crosses `/`, `*` does not.
+// Glob tokens, in match order. `**` crosses `/`, `*` does not.
+const GLOB_TOKENS = [
+  { glob: "**/", regexp: "(?:.*/)?" },
+  { glob: "**", regexp: ".*" },
+  { glob: "*", regexp: "[^/]*" },
+  { glob: "?", regexp: "[^/]" },
+];
+
+function escapeRegexpChar(char) {
+  return "\\^$.|+()[]{}".includes(char) ? `\\${char}` : char;
+}
+
+// Converts a glob to an anchored RegExp.
 function globToRegExp(glob) {
-  let out = "";
-  for (let i = 0; i < glob.length; i++) {
-    const c = glob[i];
-    if (c === "*") {
-      if (glob[i + 1] === "*") {
-        if (glob[i + 2] === "/") {
-          out += "(?:.*/)?";
-          i += 2;
-        } else {
-          out += ".*";
-          i += 1;
-        }
-      } else {
-        out += "[^/]*";
-      }
-    } else if (c === "?") {
-      out += "[^/]";
-    } else if ("\\^$.|+()[]{}".includes(c)) {
-      out += `\\${c}`;
+  let pattern = "";
+  let i = 0;
+  while (i < glob.length) {
+    const token = GLOB_TOKENS.find((t) => glob.startsWith(t.glob, i));
+    if (token) {
+      pattern += token.regexp;
+      i += token.glob.length;
     } else {
-      out += c;
+      pattern += escapeRegexpChar(glob[i]);
+      i += 1;
     }
   }
-  return new RegExp(`^${out}$`);
+  return new RegExp(`^${pattern}$`);
 }
 
 function parseSectionSpec(sections) {
diff --git a/actions/change-management-check/scripts/check.test.js b/actions/change-management-check/scripts/check.test.js
index 2be25f745..c075da269 100644
--- a/actions/change-management-check/scripts/check.test.js
+++ b/actions/change-management-check/scripts/check.test.js
@@ -166,6 +166,13 @@ test("glob: * does not cross a slash", () => {
   assert.ok(!re.test("clusters/main.prod.yaml"));
 });
 
+test("glob: ? matches one character that is not a slash", () => {
+  const re = globToRegExp("clusters/?.yaml");
+  assert.ok(re.test("clusters/a.yaml"));
+  assert.ok(!re.test("clusters/ab.yaml"));
+  assert.ok(!re.test("clusters/a/b.yaml"));
+});
+
 test("spec: parses display and alias", () => {
   assert.deepEqual(parseSectionSpec("Testing evidence: testing evidence"), [
     { display: "Testing evidence", alias: "testing evidence" },

From cc9b3cd139f571df1b9fe5e08ce88a1d2eb7d3b5 Mon Sep 17 00:00:00 2001
From: Jeff Welling <tvc-jeff.welling@smartcontract.com>
Date: Tue, 20 Oct 2026 15:19:32 -0700
Subject: [PATCH 4/8] refactor: convert globs in a single regex pass

Replace the token loop with a replace() over an ordered token regex and a lookup map. Same behavior, fewer lines.
---
 .../change-management-check/scripts/check.js  | 29 +++++++------------
 1 file changed, 11 insertions(+), 18 deletions(-)

diff --git a/actions/change-management-check/scripts/check.js b/actions/change-management-check/scripts/check.js
index 65edca76c..b1b511714 100644
--- a/actions/change-management-check/scripts/check.js
+++ b/actions/change-management-check/scripts/check.js
@@ -26,12 +26,13 @@ function splitLines(value) {
 }
 
 // Glob tokens, in match order. `**` crosses `/`, `*` does not.
-const GLOB_TOKENS = [
-  { glob: "**/", regexp: "(?:.*/)?" },
-  { glob: "**", regexp: ".*" },
-  { glob: "*", regexp: "[^/]*" },
-  { glob: "?", regexp: "[^/]" },
-];
+const GLOB_TOKENS = {
+  "**/": "(?:.*/)?",
+  "**": ".*",
+  "*": "[^/]*",
+  "?": "[^/]",
+};
+const GLOB_TOKEN_RE = /\*\*\/|\*\*|\*|\?|[\s\S]/g;
 
 function escapeRegexpChar(char) {
   return "\\^$.|+()[]{}".includes(char) ? `\\${char}` : char;
@@ -39,18 +40,10 @@ function escapeRegexpChar(char) {
 
 // Converts a glob to an anchored RegExp.
 function globToRegExp(glob) {
-  let pattern = "";
-  let i = 0;
-  while (i < glob.length) {
-    const token = GLOB_TOKENS.find((t) => glob.startsWith(t.glob, i));
-    if (token) {
-      pattern += token.regexp;
-      i += token.glob.length;
-    } else {
-      pattern += escapeRegexpChar(glob[i]);
-      i += 1;
-    }
-  }
+  const pattern = glob.replace(
+    GLOB_TOKEN_RE,
+    (token) => GLOB_TOKENS[token] ?? escapeRegexpChar(token),
+  );
   return new RegExp(`^${pattern}$`);
 }
 

From a2b4941edd96f7d4af1d578aadab82685aafc080 Mon Sep 17 00:00:00 2001
From: Jeff Welling <tvc-jeff.welling@smartcontract.com>
Date: Tue, 20 Oct 2026 15:20:21 -0700
Subject: [PATCH 5/8] docs: document the change-management-check inputs and
 usage

Adds the Standard link, a copy-paste workflow, the inputs table, the exemption rules, and the known limitations.
---
 actions/change-management-check/README.md | 55 +++++++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/actions/change-management-check/README.md b/actions/change-management-check/README.md
index 759a19abb..bfe8e6e1f 100644
--- a/actions/change-management-check/README.md
+++ b/actions/change-management-check/README.md
@@ -2,3 +2,58 @@
 
 > Fails the check when a change-management section in the PR body is empty or
 > missing
+
+Fails when a section required by the
+[Infrastructure Change Management Standard](https://smartcontract-it.atlassian.net/wiki/spaces/ENG/pages/1417445401/Infrastructure+Change+Management+Standard)
+is empty or missing. The failure message names the empty sections.
+
+## Usage
+
+Call the action from a `pull_request_target` workflow, then add the job name
+(`change-management-sections`) as a required status check. The job needs the
+`pull-requests: read` permission.
+
+```yaml
+name: Change management check
+on:
+  pull_request_target:
+    types: [opened, edited, synchronize, reopened, ready_for_review]
+
+permissions:
+  pull-requests: read
+
+jobs:
+  change-management-sections:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: smartcontractkit/.github/actions/change-management-check@change-management-check/v1
+        with:
+          sections: |
+            Testing evidence: testing evidence
+            Success / failure criteria: success / failure criteria
+            Rollback plan: rollback plan
+```
+
+## Inputs
+
+| Input           | Default      | Description                                                                                                                        |
+| --------------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------- |
+| `sections`      | required     | Lines of `Display name: heading text`, one per required section. The heading text matches case-insensitively at any heading level. |
+| `strip-lines`   | `""`         | Lines removed from a section before the empty test. Use for template default lines.                                                |
+| `docs-paths`    | `**/*.md`    | Glob lines. A PR whose files all match is exempt (docs-only). An empty value disables the exemption.                               |
+| `dev-paths`     | `""`         | Glob lines. A PR whose files all match is exempt (dev-only).                                                                       |
+| `head-prefixes` | `renovate/`  | Comma-separated head-branch prefixes that are exempt. An empty value disables the exemption.                                       |
+| `standard-url`  | the Standard | Link included in the failure message.                                                                                              |
+
+## Exemptions
+
+A pull request is skipped when its head branch starts with an exempt prefix, or
+when every changed file matches a docs or dev glob. Content inside HTML comments
+does not count.
+
+## Limitations
+
+- An unbalanced code fence hides later sections, the same way GitHub renders the
+  body.
+- The files API returns at most 3000 files; exemptions classify on those.
+- Heading text matches exactly, so a renamed heading reads as missing.

From 0c61c6faee97c8fbc3246fcd383f7256b37deb04 Mon Sep 17 00:00:00 2001
From: Jeff Welling <tvc-jeff.welling@smartcontract.com>
Date: Tue, 20 Oct 2026 16:26:26 -0700
Subject: [PATCH 6/8] fix: bound the heading regex and keep subheadings in
 their section

The old heading regex backtracked super-linearly on a hostile body line: 2.5 s for a 4 KB line, hours extrapolated for 64 KB. The new one is linear and handles CommonMark closing hashes. A section now ends at a heading of the same or higher level, or at a configured alias, so subheadings no longer read as empty.
---
 .../change-management-check/scripts/check.js  | 30 +++++++--
 .../scripts/check.test.js                     | 63 +++++++++++++++++++
 2 files changed, 87 insertions(+), 6 deletions(-)

diff --git a/actions/change-management-check/scripts/check.js b/actions/change-management-check/scripts/check.js
index b1b511714..be3347e54 100644
--- a/actions/change-management-check/scripts/check.js
+++ b/actions/change-management-check/scripts/check.js
@@ -15,7 +15,7 @@ const DEFAULT_STANDARD_URL =
   "https://smartcontract-it.atlassian.net/wiki/spaces/ENG/pages/1417445401" +
   "/Infrastructure+Change+Management+Standard";
 
-const HEADING_RE = /^ {0,3}#{1,6}\s+(.*?)\s*#*\s*$/;
+const HEADING_RE = /^ {0,3}(#{1,6})[ \t]+(.*)$/;
 const FENCE_RE = /^\s{0,3}(```|~~~)/;
 
 function splitLines(value) {
@@ -65,18 +65,35 @@ function parseSectionSpec(sections) {
   });
 }
 
+// Heading text: drop a CommonMark closing sequence, then normalize.
+function headingText(match) {
+  return match[2]
+    .replace(/\s+#+\s*$/, "")
+    .trim()
+    .toLowerCase();
+}
+
 // Section bodies keyed by lowercased heading text. Fenced code is not scanned.
-function splitSections(body) {
+// A heading starts a new section when it matches an alias or when its level is
+// the same or higher than the current section's. Deeper headings are content.
+function splitSections(body, aliases) {
   const sections = new Map();
   let current = null;
+  let level = 0;
   let fenced = false;
   for (const line of body.split("\n")) {
     if (FENCE_RE.test(line)) fenced = !fenced;
     const heading = fenced ? null : line.match(HEADING_RE);
     if (heading) {
-      current = heading[1].trim().toLowerCase();
-      if (!sections.has(current)) sections.set(current, []);
-      continue;
+      const text = headingText(heading);
+      const startSection =
+        current === null || heading[1].length <= level || aliases?.has(text);
+      if (startSection) {
+        current = text;
+        level = heading[1].length;
+        if (!sections.has(current)) sections.set(current, []);
+        continue;
+      }
     }
     if (current !== null) sections.get(current).push(line);
   }
@@ -100,7 +117,8 @@ function stripComments(text) {
 
 // Specs whose section body is empty after comment and strip-line removal.
 function missingSections(body, specs, stripLines) {
-  const sections = splitSections(stripComments(String(body || "")));
+  const aliases = new Set(specs.map((spec) => spec.alias));
+  const sections = splitSections(stripComments(String(body || "")), aliases);
   const strip = new Set((stripLines || []).map((line) => line.trim()));
   return specs.filter((spec) => {
     const content = (sections.get(spec.alias) || [])
diff --git a/actions/change-management-check/scripts/check.test.js b/actions/change-management-check/scripts/check.test.js
index c075da269..cd9f19b76 100644
--- a/actions/change-management-check/scripts/check.test.js
+++ b/actions/change-management-check/scripts/check.test.js
@@ -195,6 +195,69 @@ test("sections: fenced code is not scanned for headings", () => {
   assert.ok(!sections.has("not a heading"));
 });
 
+test("sections: subheadings stay in the parent section", () => {
+  const body = `## Testing evidence
+
+### Dev
+
+ran in dev: PR #1
+
+### Stage
+
+ran in stage: PR #2
+
+## Rollback plan
+
+Revert this PR.
+`;
+  assert.deepEqual(names(missingSections(body, SPECS, [])), [
+    "Success / failure criteria",
+  ]);
+});
+
+test("sections: a peer heading ends the section", () => {
+  const body = `## Testing evidence
+
+## Checklist
+
+- [ ] done
+`;
+  assert.deepEqual(names(missingSections(body, SPECS, [])), [
+    "Testing evidence",
+    "Success / failure criteria",
+    "Rollback plan",
+  ]);
+});
+
+test("sections: an alias starts its section at any level", () => {
+  const body = `# Testing Evidence
+
+ran in stage: PR #1
+
+### Rollback plan
+
+Revert this PR.
+`;
+  assert.deepEqual(names(missingSections(body, SPECS, [])), [
+    "Success / failure criteria",
+  ]);
+});
+
+test("sections: trailing hashes are handled like CommonMark", () => {
+  const sections = splitSections(
+    "## C#\n\nbody\n\n## Rollback plan ##\n\nrevert\n",
+  );
+  assert.ok(sections.has("c#"));
+  assert.ok(sections.has("rollback plan"));
+});
+
+test("heading parsing stays linear on a hostile line", () => {
+  const hostile = `## a${" ".repeat(2000)}b${" ".repeat(2000)}x\n`;
+  const started = Date.now();
+  missingSections(hostile, SPECS, []);
+  assert.ok(Date.now() - started < 1000, "heading scan took too long");
+});
+
 test("fresh infra-k8s template: all three sections empty", () => {
   assert.deepEqual(names(missingSections(INFRA_K8S_TEMPLATE, SPECS, [])), [
     "Testing evidence",

From 2409b3812ab19537dbc5e4c77a871e6117799bfe Mon Sep 17 00:00:00 2001
From: Jeff Welling <tvc-jeff.welling@smartcontract.com>
Date: Tue, 20 Oct 2026 16:26:38 -0700
Subject: [PATCH 7/8] chore: start the package at 0.0.1

Avoids the 0.0.0 placeholder. The major changeset still takes the first release to 1.0.0.
---
 actions/change-management-check/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/actions/change-management-check/package.json b/actions/change-management-check/package.json
index 9c1d47391..3ab7665ed 100644
--- a/actions/change-management-check/package.json
+++ b/actions/change-management-check/package.json
@@ -1,6 +1,6 @@
 {
   "name": "change-management-check",
-  "version": "0.0.0",
+  "version": "0.0.1",
   "description": "",
   "private": true,
   "scripts": {},

From b589330076f0026425ed7e4a76a1ed3a2c854dea Mon Sep 17 00:00:00 2001
From: Jeff Welling <tvc-jeff.welling@smartcontract.com>
Date: Wed, 21 Oct 2026 10:55:59 -0700
Subject: [PATCH 8/8] fix: check the PR body only; move exemptions to the
 caller workflow

- check.js: drop the files API, glob engine, and exemption inputs.
- check.js: parse CRLF bodies; fail when the sections input is empty.
- check.js: blank comment spans in place instead of deleting them.
- README.md: usage example uses dorny/paths-filter with a conditional
  step; document the required-check skip rules.
- action.yml: remove the docs-paths, dev-paths, and head-prefixes inputs.
---
 actions/change-management-check/README.md     |  55 +++--
 actions/change-management-check/action.yml    |  17 +-
 .../change-management-check/scripts/check.js  | 115 ++---------
 .../scripts/check.test.js                     | 188 +++---------------
 4 files changed, 84 insertions(+), 291 deletions(-)

diff --git a/actions/change-management-check/README.md b/actions/change-management-check/README.md
index bfe8e6e1f..e9d4daf7b 100644
--- a/actions/change-management-check/README.md
+++ b/actions/change-management-check/README.md
@@ -5,13 +5,19 @@
 
 Fails when a section required by the
 [Infrastructure Change Management Standard](https://smartcontract-it.atlassian.net/wiki/spaces/ENG/pages/1417445401/Infrastructure+Change+Management+Standard)
-is empty or missing. The failure message names the empty sections.
+is empty or missing. The failure message names the empty sections. The action
+reads only the pull request body from the event payload.
 
 ## Usage
 
 Call the action from a `pull_request_target` workflow, then add the job name
-(`change-management-sections`) as a required status check. The job needs the
-`pull-requests: read` permission.
+(`change-management-sections`) as a required status check. The workflow decides
+whether the check applies: skip it for exempt head branches and when every
+changed file is a docs or dev path, using
+[dorny/paths-filter](https://github.com/dorny/paths-filter). The job needs the
+`pull-requests: read` permission for the path filter. The `timeout-minutes`
+setting turns a hung run into a fast failure; `concurrency` cancels stale runs
+when the body changes.
 
 ```yaml
 name: Change management check
@@ -22,11 +28,30 @@ on:
 permissions:
   pull-requests: read
 
+concurrency:
+  group: change-management-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
   change-management-sections:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
-      - uses: smartcontractkit/.github/actions/change-management-check@change-management-check/v1
+      - name: Filter changed paths
+        id: filter
+        if: ${{ !startsWith(github.head_ref, 'renovate/') }}
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4
+        with:
+          # The negation rules apply only with some-with-excludes.
+          predicate-quantifier: some-with-excludes
+          filters: |
+            check:
+              - '**'
+              - '!**/*.md'
+              - '!projects/ingest-hub-preview/**' # dev paths, per repo
+      - name: Check change management sections
+        if: ${{ steps.filter.outputs.check == 'true' }}
+        uses: smartcontractkit/.github/actions/change-management-check@change-management-check/v1
         with:
           sections: |
             Testing evidence: testing evidence
@@ -36,24 +61,22 @@ jobs:
 
 ## Inputs
 
-| Input           | Default      | Description                                                                                                                        |
-| --------------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------- |
-| `sections`      | required     | Lines of `Display name: heading text`, one per required section. The heading text matches case-insensitively at any heading level. |
-| `strip-lines`   | `""`         | Lines removed from a section before the empty test. Use for template default lines.                                                |
-| `docs-paths`    | `**/*.md`    | Glob lines. A PR whose files all match is exempt (docs-only). An empty value disables the exemption.                               |
-| `dev-paths`     | `""`         | Glob lines. A PR whose files all match is exempt (dev-only).                                                                       |
-| `head-prefixes` | `renovate/`  | Comma-separated head-branch prefixes that are exempt. An empty value disables the exemption.                                       |
-| `standard-url`  | the Standard | Link included in the failure message.                                                                                              |
+| Input          | Default      | Description                                                                                                                        |
+| -------------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------- |
+| `sections`     | required     | Lines of `Display name: heading text`, one per required section. The heading text matches case-insensitively at any heading level. |
+| `strip-lines`  | `""`         | Lines removed from a section before the empty test. Use for template default lines.                                                |
+| `standard-url` | the Standard | Link included in the failure message.                                                                                              |
 
 ## Exemptions
 
-A pull request is skipped when its head branch starts with an exempt prefix, or
-when every changed file matches a docs or dev glob. Content inside HTML comments
-does not count.
+The workflow decides whether the check applies, not the action. Skip the check
+step (or job) for exempt pull requests, for example `renovate/` head branches,
+docs-only changes, or dev-only changes. Use a condition on the step or job: a
+workflow skipped by path filtering leaves its check pending, which blocks a
+required check.
 
 ## Limitations
 
 - An unbalanced code fence hides later sections, the same way GitHub renders the
   body.
-- The files API returns at most 3000 files; exemptions classify on those.
 - Heading text matches exactly, so a renamed heading reads as missing.
diff --git a/actions/change-management-check/action.yml b/actions/change-management-check/action.yml
index 44c981219..e8845b00b 100644
--- a/actions/change-management-check/action.yml
+++ b/actions/change-management-check/action.yml
@@ -14,18 +14,6 @@ inputs:
       default lines."
     required: false
     default: ""
-  docs-paths:
-    description: "Glob lines. A PR whose files all match is exempt (docs-only)."
-    required: false
-    default: "**/*.md"
-  dev-paths:
-    description: "Glob lines. A PR whose files all match is exempt (dev-only)."
-    required: false
-    default: ""
-  head-prefixes:
-    description: "Comma separated head-branch prefixes that are exempt."
-    required: false
-    default: "renovate/"
   standard-url:
     description: "Link to the Standard, included in the failure message."
     required: false
@@ -39,11 +27,8 @@ runs:
       env:
         SECTIONS: ${{ inputs.sections }}
         STRIP_LINES: ${{ inputs.strip-lines }}
-        DOCS_PATHS: ${{ inputs.docs-paths }}
-        DEV_PATHS: ${{ inputs.dev-paths }}
-        HEAD_PREFIXES: ${{ inputs.head-prefixes }}
         STANDARD_URL: ${{ inputs.standard-url }}
       with:
         script: |
           const script = require(`${process.env.GITHUB_ACTION_PATH}/scripts/check.js`);
-          await script({ context, core, github });
+          await script({ context, core });
diff --git a/actions/change-management-check/scripts/check.js b/actions/change-management-check/scripts/check.js
index be3347e54..32093803d 100644
--- a/actions/change-management-check/scripts/check.js
+++ b/actions/change-management-check/scripts/check.js
@@ -1,13 +1,10 @@
 /**
  * Fails the check when a change-management section in the PR body is empty
- * or missing. Exempt: Renovate branches, docs-only PRs, dev-only PRs.
+ * or missing. The workflow decides whether the check applies.
  *
  * Inputs (via environment):
  *   SECTIONS:      lines of "Display name: heading text"
  *   STRIP_LINES:   lines removed from a section before the empty test
- *   DOCS_PATHS:    glob lines; a PR whose files all match is docs-only
- *   DEV_PATHS:     glob lines; a PR whose files all match is dev-only
- *   HEAD_PREFIXES: comma-separated head-branch prefixes that are exempt
  *   STANDARD_URL:  link included in the failure message
  */
 
@@ -25,28 +22,6 @@ function splitLines(value) {
     .filter(Boolean);
 }
 
-// Glob tokens, in match order. `**` crosses `/`, `*` does not.
-const GLOB_TOKENS = {
-  "**/": "(?:.*/)?",
-  "**": ".*",
-  "*": "[^/]*",
-  "?": "[^/]",
-};
-const GLOB_TOKEN_RE = /\*\*\/|\*\*|\*|\?|[\s\S]/g;
-
-function escapeRegexpChar(char) {
-  return "\\^$.|+()[]{}".includes(char) ? `\\${char}` : char;
-}
-
-// Converts a glob to an anchored RegExp.
-function globToRegExp(glob) {
-  const pattern = glob.replace(
-    GLOB_TOKEN_RE,
-    (token) => GLOB_TOKENS[token] ?? escapeRegexpChar(token),
-  );
-  return new RegExp(`^${pattern}$`);
-}
-
 function parseSectionSpec(sections) {
   return splitLines(sections).map((line) => {
     const i = line.indexOf(":");
@@ -81,7 +56,8 @@ function splitSections(body, aliases) {
   let current = null;
   let level = 0;
   let fenced = false;
-  for (const line of body.split("\n")) {
+  // Bodies can use CRLF line endings; parse them like LF bodies.
+  for (const line of body.replace(/\r\n?/g, "\n").split("\n")) {
     if (FENCE_RE.test(line)) fenced = !fenced;
     const heading = fenced ? null : line.match(HEADING_RE);
     if (heading) {
@@ -101,7 +77,7 @@ function splitSections(body, aliases) {
 }
 
 // Removes HTML comments, including multiline ones. An unterminated comment
-// drops the rest of the text, matching how GitHub renders the body.
+// blanks the rest of the text, matching how GitHub renders the body.
 function stripComments(text) {
   let out = "";
   let i = 0;
@@ -110,8 +86,10 @@ function stripComments(text) {
     if (start === -1) return out + text.slice(i);
     out += text.slice(i, start);
     const end = text.indexOf("-->", start + 4);
-    if (end === -1) return out;
-    i = end + 3;
+    const stop = end === -1 ? text.length : end + 3;
+    // Blank the span in place so the text before and after it cannot join.
+    out += text.slice(start, stop).replace(/[^\n]/g, " ");
+    i = stop;
   }
 }
 
@@ -129,51 +107,6 @@ function missingSections(body, specs, stripLines) {
   });
 }
 
-async function listFiles(github, context) {
-  const { owner, repo } = context.repo;
-  const pull_number = context.payload.pull_request.number;
-  const files = [];
-  // The API caps at 3000 files; 30 pages of 100.
-  for (let page = 1; page <= 30; page++) {
-    const { data } = await github.rest.pulls.listFiles({
-      owner,
-      repo,
-      pull_number,
-      per_page: 100,
-      page,
-    });
-    files.push(...data.map((file) => file.filename));
-    if (data.length < 100) break;
-  }
-  return files;
-}
-
-// Reason string when every changed file matches one glob set, else null.
-function classifyFiles(files, docsPaths, devPaths) {
-  if (files.length === 0) return null;
-  const allMatch = (regexps) =>
-    regexps.length > 0 &&
-    files.every((file) => regexps.some((re) => re.test(file)));
-  if (allMatch(docsPaths)) return "docs-only";
-  if (allMatch(devPaths)) return "dev-only";
-  return null;
-}
-
-// Reason string when the PR is exempt, else null.
-async function findExemption({
-  github,
-  context,
-  headPrefixes,
-  docsPaths,
-  devPaths,
-}) {
-  const headRef = context.payload.pull_request.head.ref || "";
-  const prefix = headPrefixes.find((p) => headRef.startsWith(p));
-  if (prefix) return `head branch starts with ${prefix}`;
-
-  return classifyFiles(await listFiles(github, context), docsPaths, devPaths);
-}
-
 function summarize(specs, missing) {
   const empty = new Set(missing.map((spec) => spec.display));
   return [
@@ -186,7 +119,7 @@ function summarize(specs, missing) {
   ].join("\n");
 }
 
-module.exports = async ({ context, core, github }) => {
+module.exports = async ({ context, core }) => {
   const pr = context.payload.pull_request;
   if (!pr) {
     core.info("This action is only applicable to pull requests.");
@@ -194,30 +127,13 @@ module.exports = async ({ context, core, github }) => {
   }
 
   const specs = parseSectionSpec(process.env.SECTIONS);
-  const stripLines = splitLines(process.env.STRIP_LINES);
-  // action.yml supplies the defaults. An explicit empty input disables the
-  // exemption.
-  const docsPaths = splitLines(process.env.DOCS_PATHS).map(globToRegExp);
-  const devPaths = splitLines(process.env.DEV_PATHS).map(globToRegExp);
-  const headPrefixes = (process.env.HEAD_PREFIXES || "")
-    .split(",")
-    .map((prefix) => prefix.trim())
-    .filter(Boolean);
-  const standardUrl = process.env.STANDARD_URL || DEFAULT_STANDARD_URL;
-
-  const exempt = await findExemption({
-    github,
-    context,
-    headPrefixes,
-    docsPaths,
-    devPaths,
-  });
-  if (exempt) {
-    core.info(
-      `Exempt (${exempt}): the change-management check does not apply.`,
+  if (specs.length === 0) {
+    throw new Error(
+      "The sections input is empty; at least one section is required.",
     );
-    return;
   }
+  const stripLines = splitLines(process.env.STRIP_LINES);
+  const standardUrl = process.env.STANDARD_URL || DEFAULT_STANDARD_URL;
 
   const missing = missingSections(pr.body, specs, stripLines);
   core.summary.addRaw(summarize(specs, missing));
@@ -234,8 +150,7 @@ module.exports = async ({ context, core, github }) => {
   core.info("All change-management sections are present.");
 };
 
-module.exports.classifyFiles = classifyFiles;
-module.exports.globToRegExp = globToRegExp;
 module.exports.missingSections = missingSections;
 module.exports.parseSectionSpec = parseSectionSpec;
 module.exports.splitSections = splitSections;
+module.exports.stripComments = stripComments;
diff --git a/actions/change-management-check/scripts/check.test.js b/actions/change-management-check/scripts/check.test.js
index cd9f19b76..3b41dfd9f 100644
--- a/actions/change-management-check/scripts/check.test.js
+++ b/actions/change-management-check/scripts/check.test.js
@@ -2,13 +2,8 @@ const test = require("node:test");
 const assert = require("node:assert/strict");
 
 const check = require("./check.js");
-const {
-  classifyFiles,
-  globToRegExp,
-  missingSections,
-  parseSectionSpec,
-  splitSections,
-} = check;
+const { missingSections, parseSectionSpec, splitSections, stripComments } =
+  check;
 
 // infra-k8s pull_request_template.md at origin/main, 2026-10-20.
 const INFRA_K8S_TEMPLATE = `## What
@@ -145,34 +140,6 @@ const MGMT_STRIP = [
 
 const names = (missing) => missing.map((spec) => spec.display);
 
-test("glob: **/ matches the root and nested paths", () => {
-  const re = globToRegExp("**/*.md");
-  assert.ok(re.test("README.md"));
-  assert.ok(re.test("docs/guide/intro.md"));
-  assert.ok(!re.test("README.txt"));
-});
-
-test("glob: trailing /** matches under the directory only", () => {
-  const re = globToRegExp("projects/ingest-hub-preview/**");
-  assert.ok(re.test("projects/ingest-hub-preview/a.yaml"));
-  assert.ok(re.test("projects/ingest-hub-preview/apps/a.yaml"));
-  assert.ok(!re.test("projects/other/a.yaml"));
-});
-
-test("glob: * does not cross a slash", () => {
-  const re = globToRegExp("clusters/*.sand.yaml");
-  assert.ok(re.test("clusters/main.sand.yaml"));
-  assert.ok(!re.test("clusters/sub/main.sand.yaml"));
-  assert.ok(!re.test("clusters/main.prod.yaml"));
-});
-
-test("glob: ? matches one character that is not a slash", () => {
-  const re = globToRegExp("clusters/?.yaml");
-  assert.ok(re.test("clusters/a.yaml"));
-  assert.ok(!re.test("clusters/ab.yaml"));
-  assert.ok(!re.test("clusters/a/b.yaml"));
-});
-
 test("spec: parses display and alias", () => {
   assert.deepEqual(parseSectionSpec("Testing evidence: testing evidence"), [
     { display: "Testing evidence", alias: "testing evidence" },
@@ -315,6 +282,21 @@ Revert this PR.
   assert.deepEqual(missingSections(body, SPECS, []), []);
 });
 
+test("CRLF body: filled sections pass, empty template still fails", () => {
+  const filled =
+    "# Testing Evidence\r\n\r\nRan in stage: PR #1.\r\n\r\n" +
+    "# Success / Failure Criteria\r\n\r\nError rate stays flat.\r\n\r\n" +
+    "# Rollback Plan\r\n\r\nRevert this PR.\r\n";
+  assert.deepEqual(missingSections(filled, SPECS, []), []);
+  const crlfTemplate = INFRA_K8S_TEMPLATE.replace(/\n/g, "\r\n");
+  assert.ok(splitSections(crlfTemplate).has("testing evidence"));
+  assert.deepEqual(names(missingSections(crlfTemplate, SPECS, [])), [
+    "Testing evidence",
+    "Success / failure criteria",
+    "Rollback plan",
+  ]);
+});
+
 test("partial fill names only the missing section", () => {
   const body = `## Testing evidence
 
@@ -373,27 +355,11 @@ test("an unterminated HTML comment drops the rest of the body", () => {
   assert.equal(missingSections(body, SPECS, []).length, 3);
 });
 
-test("classifyFiles: docs-only, dev-only, mixed, empty", () => {
-  const docs = [globToRegExp("**/*.md")];
-  const dev = [globToRegExp("projects/ingest-hub-preview/**")];
-  assert.equal(classifyFiles(["README.md"], docs, dev), "docs-only");
-  assert.equal(classifyFiles(["a.md", "b.yaml"], docs, dev), null);
-  assert.equal(
-    classifyFiles(["projects/ingest-hub-preview/a.yaml"], docs, dev),
-    "dev-only",
-  );
-  assert.equal(classifyFiles(["README.md", "a.yaml"], docs, dev), null);
-  assert.equal(classifyFiles([], docs, dev), null);
+test("comment stripping cannot rebuild a comment opener", () => {
+  assert.ok(!stripComments("<!<!-- x -->!--").includes("<!--"));
 });
 
-const ENV_KEYS = [
-  "SECTIONS",
-  "STRIP_LINES",
-  "DOCS_PATHS",
-  "DEV_PATHS",
-  "HEAD_PREFIXES",
-  "STANDARD_URL",
-];
+const ENV_KEYS = ["SECTIONS", "STRIP_LINES", "STANDARD_URL"];
 
 function setEnv(env) {
   for (const key of ENV_KEYS) delete process.env[key];
@@ -415,39 +381,20 @@ function fakeCore() {
   };
 }
 
-function fakeContext({ ref = "feat/x", body = "", number = 1 } = {}) {
+function fakeContext({ body = "" } = {}) {
   return {
     repo: { owner: "o", repo: "r" },
-    payload: { pull_request: { number, body, head: { ref } } },
+    payload: { pull_request: { number: 1, body } },
   };
 }
 
-function fakeGithub(filenames) {
-  return {
-    rest: {
-      pulls: {
-        listFiles: async () =>
-          filenames.length
-            ? { data: filenames.map((filename) => ({ filename })) }
-            : { data: [] },
-      },
-    },
-  };
-}
-
-const PROD_FILES = ["clusters/main.prod.yaml"];
-
 test("run: empty template fails and names every section", async () => {
   setEnv({
     SECTIONS:
       "Testing evidence: testing evidence\nRollback plan: rollback plan",
   });
   const core = fakeCore();
-  await check({
-    context: fakeContext({ body: INFRA_K8S_TEMPLATE }),
-    core,
-    github: fakeGithub(PROD_FILES),
-  });
+  await check({ context: fakeContext({ body: INFRA_K8S_TEMPLATE }), core });
   assert.equal(core.calls.failed.length, 1);
   assert.match(
     core.calls.failed[0],
@@ -469,97 +416,21 @@ test("run: filled body passes", async () => {
   const body =
     "# Testing Evidence\n\nRan in stage: PR #1.\n\n# Rollback Plan\n\nRevert.\n";
   const core = fakeCore();
-  await check({
-    context: fakeContext({ body }),
-    core,
-    github: fakeGithub(PROD_FILES),
-  });
+  await check({ context: fakeContext({ body }), core });
   assert.equal(core.calls.failed.length, 0);
   assert.deepEqual(core.calls.info, [
     "All change-management sections are present.",
   ]);
 });
 
-test("run: renovate branch is exempt without an API call", async () => {
-  setEnv({
-    SECTIONS: "Testing evidence: testing evidence",
-    HEAD_PREFIXES: "renovate/",
-  });
+test("run: empty sections input fails loudly", async () => {
+  setEnv({ SECTIONS: "" });
   const core = fakeCore();
-  const github = {
-    rest: {
-      pulls: {
-        listFiles: async () => {
-          throw new Error("must not be called");
-        },
-      },
-    },
-  };
-  await check({
-    context: fakeContext({ ref: "renovate/lodash-4.x", body: "" }),
-    core,
-    github,
-  });
-  assert.equal(core.calls.failed.length, 0);
-  assert.match(
-    core.calls.info[0],
-    /^Exempt \(head branch starts with renovate\/\)/,
+  await assert.rejects(
+    check({ context: fakeContext({ body: "" }), core }),
+    /sections input is empty/,
   );
-});
-
-test("run: docs-only PR is exempt", async () => {
-  setEnv({
-    SECTIONS: "Testing evidence: testing evidence",
-    DOCS_PATHS: "**/*.md",
-  });
-  const core = fakeCore();
-  await check({
-    context: fakeContext({ body: "" }),
-    core,
-    github: fakeGithub(["docs/readme.md"]),
-  });
   assert.equal(core.calls.failed.length, 0);
-  assert.match(core.calls.info[0], /^Exempt \(docs-only\)/);
-});
-
-test("run: dev-only PR is exempt when dev-paths are set", async () => {
-  setEnv({
-    SECTIONS: "Testing evidence: testing evidence",
-    DEV_PATHS: "projects/ingest-hub-preview/**",
-  });
-  const core = fakeCore();
-  await check({
-    context: fakeContext({ body: "" }),
-    core,
-    github: fakeGithub(["projects/ingest-hub-preview/apps/a.yaml"]),
-  });
-  assert.equal(core.calls.failed.length, 0);
-  assert.match(core.calls.info[0], /^Exempt \(dev-only\)/);
-});
-
-test("run: empty head-prefixes disables the prefix exemption", async () => {
-  setEnv({
-    SECTIONS: "Testing evidence: testing evidence",
-    HEAD_PREFIXES: "",
-  });
-  const core = fakeCore();
-  await check({
-    context: fakeContext({ ref: "renovate/lodash-4.x", body: "" }),
-    core,
-    github: fakeGithub(PROD_FILES),
-  });
-  assert.equal(core.calls.failed.length, 1);
-});
-
-test("run: empty docs-paths disables the docs exemption", async () => {
-  setEnv({ SECTIONS: "Testing evidence: testing evidence", DOCS_PATHS: "" });
-  const core = fakeCore();
-  await check({
-    context: fakeContext({ body: "" }),
-    core,
-    github: fakeGithub(["docs/readme.md"]),
-  });
-  assert.equal(core.calls.failed.length, 1);
 });
 
 test("run: non-pull-request payload is skipped", async () => {
@@ -567,7 +438,6 @@ test("run: non-pull-request payload is skipped", async () => {
   await check({
     context: { repo: { owner: "o", repo: "r" }, payload: {} },
     core,
-    github: fakeGithub(PROD_FILES),
   });
   assert.equal(core.calls.failed.length, 0);
   assert.equal(