Dependency changelog tool

[thampiotr]

PR Description

This PR enhances the key dependency update process by introducing a new final step that requires inspecting upstream changelogs for breaking changes and Alloy-relevant new features.

To facilitate this, a new dependency-changelog CLI tool is added. This tool automates fetching GitHub release notes or commit comparisons between specified versions for key dependencies, including special handling for Prometheus version mapping and Grafana forks. Identified breaking changes must now be documented in both CHANGELOG.md and docs/sources/release-notes.md.

Which issue(s) this PR fixes

Notes to the Reviewer

• The new dependency-changelog tool is located in tools/dependency-changelog.
• It supports common aliases (e.g., otelcol, prometheus, loki) and module paths.
• Specific logic is included for mapping Prometheus Go module versions (e.g., v0.308.0) to upstream release tags (e.g., v3.8.0).
• Grafana forks for obi and ebpf-profiler are correctly resolved.
• The tool prioritizes fetching GitHub Releases but falls back to a commit comparison if releases are not found or semver tags are not applicable.

PR Checklist

• CHANGELOG.md updated
• Documentation added
• Tests updated
• Config converters updated

---

 

[cursor]

Cursor Agent can help with this pull request. Just @cursor in comments and I'll start working on changes in this branch.
_{Learn more about Cursor Agents}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

This PR has not had any activity in the past 90 days, so the needs-attention label has been added to it.
If you do not have enough time to follow up on this PR or you think it's no longer relevant, consider closing it.
The needs-attention label signals to maintainers that something has fallen through the cracks. No action is needed by you; your PR will be kept open and you do not have to respond to this comment. The label will be removed the next time this job runs if there is new activity.
Thank you for your contributions!