[code-infra] Add util to fetch changelog commits from github

[brijeshb42]

and return it as a normalized object array. This can then be used in the product repos as the starting point to then process the commits as required to generate the changelog.

Update: Changed the fetching behaviour to start with graphql and only use rest as a fallback if gql fetching fails with a server error.

Edit: Turns out graphql api can be unreliable for inner node fetching as well, ie, top level data might come in the response, but nested data fetching might fail and just return null. So removed graphl altogether. See the example below of gql vs rest data -

Also added type generation to the code-infra package. Otherwise, getting Could not find a declaration file for module '@mui/internal-code-infra/changelog' when importing the module in an .mts file.

Another major change:

1. No need to pass token string to fetchCommitBetweenRefs() function. The token is now generated on-demand and stored in the os credential manager.
2. The Github token generation happens through device flow where the user opens a link and enters a code there (that is output in the terminal).

Screen.Recording.2025-09-25.at.4.37.09.PM.mov

Part of #639

TODOs -

• [code-infra] Update changelog script to use utils from code-infra base-ui#2823

[mui-bot]

Bundle size report

Bundle	Parsed size	Gzip size
@base-ui-components/react	0B(0.00%)	0B(0.00%)
@mui/x-charts-pro	0B(0.00%)	0B(0.00%)

Details of bundle changes

---

Check out the code infra dashboard for more information about this PR.

[Janpot]

Alternatively, using the -C option in git could avoid us from reinstantating execa.

[brijeshb42]

I don't see any major perf issue here. git has this option but what if it was some other command.

[Janpot]

• Is this really necessary for public repos?
• Is this also doable with git commands instead of the API?

If possible I'd like to discourage putting tokens in your environment if not strictly necessary.

[brijeshb42]

Is this really necessary for public repos

I am getting API rate limit exceeded for without the token. But perhaps this is because I have already done a lot of github api calls and it has tagged my ip as rate-limited. For one-off changelog generation (during release PR), it may work. One more scenario is that we do 1+n calls back to back (n calls are parallel actually). So this might result in rate limiting which we don't want for changelog generation.

What we can do is do the call without token and ask for token if any of the calls fail with 403.

Another idea would be do have a backend endpoint exposed somewhere in one of our backend services that abstracts the requirement for GITHUB_TOKEN which we can then call directly without worrying about individual devs exposing their tokens.

Is this also doable with git commands instead of the API?

We can get all the commits (given the local git history is updated). But our changelog filtering relies on Github labels. So essentially we'll be saving that 1 call and not the next n calls.

[Janpot]

Alternatively, we may be able to use the oauth device flow to obtain a token?

[brijeshb42]

I think web service makes more sense since it won't introduce a barrier (opening url in browser, entering the code etc) to invoking the cli and will continue the existing flow without requiring major changes.

[brijeshb42]

We could also use keychain store to store and access the tokens requiring passkeys to access it, but it'll be limited to macOS users.
Or in the cli, we can make sure that the token only has public_repo permission and nothing else since it only gets data that is already public. If it has other permissions, then throw an error asking user to generate another token.

[brijeshb42]

@Janpot Added a credential manager utility to provide security and protection from scripts trying to read env vars.
It provides reasonable security with convenience to the user in that they'll be prompted the first time to securely input the token which will be then saved into an encrypted file. Next time, the saved token will be used directly instead of prompting them again and again.
The file itself is encrypted using a locally stored key in a separate file.

[Copilot]

Pull Request Overview

Copilot reviewed 16 out of 19 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

[brijeshb42]

@Janpot I've addressed all of the comments.