Include engine pull requests in the changelog

A fix in community-scripts/core reaches every script here, and none of it
appears in this changelog: the workflow only ever listed pull requests from
this repository. The "💾 Core" category already existed, fed by ProxmoxVE
PRs labelled `core`; engine PRs now land in the same place.

Entries read `([core#10](https://github.com/community-scripts/core/pull/10))`
rather than a bare `#10`, which would read as a pull request here and send
the reader somewhere other than the text promises.

core carries GitHub's default labels and most of its pull requests carry
none, so `bug` and `enhancement` map onto the bugfix and feature
subcategories and everything else sits directly under the category. The
fetch is wrapped: the engine repository being unreachable must not cost
this repository its changelog.

Also accepts a repository_dispatch, so core can ask for a run when a PR is
merged there instead of waiting for the next push here. Optional -- engine
PRs are collected on every run either way, this only decides how soon.

.github/workflows/changelog-pr.yml

@@ -4,6 +4,11 @@ on:
   push:
     branches: ["main"]
   workflow_dispatch:
+  # Fired by community-scripts/core when an engine pull request is merged, so a
+  # change there does not wait for the next push here. Optional: engine PRs are
+  # collected on every run regardless, this only decides how soon.
+  repository_dispatch:
+    types: [core-pr-merged]
 
 jobs:
   update-changelog-pull-request:
@@ -207,6 +212,77 @@ jobs:
 
               }
 
+              // ── Engine pull requests ────────────────────────────────────────
+              // The engine lives in community-scripts/core, so its changes never
+              // show up in this repository's PR list -- and a fix there reaches
+              // every script here. The "💾 Core" category already existed for
+              // ProxmoxVE PRs labelled `core`; engine PRs land in the same place.
+              try {
+                const { data: corePulls } = await github.rest.pulls.list({
+                  owner: context.repo.owner,
+                  repo: "core",
+                  base: "main",
+                  state: "closed",
+                  sort: "updated",
+                  direction: "desc",
+                  per_page: 100,
+                });
+
+                const coreCategory = categorizedPRs.find(category =>
+                  category.title.includes("Core") || category.labels.includes("core"));
+
+                // core carries GitHub's default label set, and most of its pull
+                // requests carry none at all, so map what maps and let the rest
+                // sit directly under the category.
+                const coreLabelAliases = {
+                  bug: "bugfix",
+                  bugfix: "bugfix",
+                  enhancement: "feature",
+                  feature: "feature",
+                  refactor: "refactor",
+                  "breaking change": "breaking change",
+                };
+                const corePriority = ["breaking change", "bugfix", "feature", "refactor"];
+
+                for (const pr of corePulls) {
+                  if (!pr.merged_at) continue;
+                  if (new Date(pr.merged_at) <= latestDateInChangelog) continue;
+
+                  const rawLabels = pr.labels.map(label => label.name.toLowerCase());
+                  if (rawLabels.some(l => ["invalid", "wontdo", "wontfix", "duplicate"].includes(l))) continue;
+
+                  if (!coreCategory) {
+                    console.log(`No Core category configured; skipping core#${pr.number}`);
+                    continue;
+                  }
+
+                  // core#N rather than #N: a bare number reads as a pull request
+                  // in this repository, so the link would lead somewhere other
+                  // than the text promises.
+                  const coreNote = `- ${pr.title} [@${pr.user.login}](https://github.com/${pr.user.login}) ([core#${pr.number}](${pr.html_url}))`;
+
+                  const mapped = rawLabels.map(l => coreLabelAliases[l]).filter(Boolean);
+                  let placed = false;
+                  if (coreCategory.subCategories && coreCategory.subCategories.length > 0) {
+                    for (const priorityLabel of corePriority) {
+                      if (!mapped.includes(priorityLabel)) continue;
+                      const subCategory = coreCategory.subCategories.find(sub =>
+                        sub.labels.includes(priorityLabel));
+                      if (subCategory) {
+                        subCategory.notes.push(coreNote);
+                        placed = true;
+                        break;
+                      }
+                    }
+                  }
+                  if (!placed) coreCategory.notes.push(coreNote);
+                }
+              } catch (error) {
+                // The engine repository being unreachable must not cost this
+                // repository its changelog.
+                console.error(`Could not read core pull requests: ${error}`);
+              }
+
               return categorizedPRs;
             }
 

ct/defguard.sh

@@ -1,57 +0,0 @@
-#!/usr/bin/env bash
-_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/DefGuard/defguard
-
-APP="Defguard"
-var_tags="${var_tags:-vpn;wireguard;sso}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-8}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -f /etc/defguard/core.conf ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  msg_info "Updating ${APP}"
-  $STD apt update
-  $STD apt install -y defguard defguard-proxy
-  msg_ok "Updated ${APP}"
-
-  msg_info "Restarting Services"
-  systemctl restart defguard defguard-proxy
-  msg_ok "Restarted Services"
-  msg_ok "Updated successfully!"
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
-echo -e "${INFO}${YW}In the setup wizard, enter this as the Edge address:${CL}"
-echo -e "${TAB}${DEFAULT}${BGN}127.0.0.1:50051${CL}"
-echo -e "${INFO}${YW}The generated admin password is in /etc/defguard/core.conf${CL}"

ct/headers/defguard

@@ -1,6 +0,0 @@
-    ____       ____                           __
-   / __ \___  / __/___ ___  ______ __________/ /
-  / / / / _ \/ /_/ __ `/ / / / __ `/ ___/ __  / 
- / /_/ /  __/ __/ /_/ / /_/ / /_/ / /  / /_/ /  
-/_____/\___/_/  \__, /\__,_/\__,_/_/   \__,_/   
-               /____/                           

install/defguard-install.sh

@@ -1,78 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/DefGuard/defguard
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-PG_VERSION="17" setup_postgresql
-PG_DB_NAME="defguard" PG_DB_USER="defguard" setup_postgresql_db
-
-setup_deb822_repo \
-  "defguard" \
-  "https://apt.defguard.net/defguard.asc" \
-  "https://apt.defguard.net" \
-  "$(get_os_info codename)" \
-  "release-2.0"
-
-msg_info "Installing Defguard"
-$STD apt install -y defguard
-msg_ok "Installed Defguard"
-
-msg_info "Configuring Defguard"
-DEFGUARD_ADMIN_PASSWORD=$(openssl rand -base64 18)
-cat <<EOF >/etc/defguard/core.conf
-DEFGUARD_DB_HOST=localhost
-DEFGUARD_DB_PORT=5432
-DEFGUARD_DB_NAME=defguard
-DEFGUARD_DB_USER=defguard
-DEFGUARD_DB_PASSWORD=${PG_DB_PASS}
-
-DEFGUARD_URL=http://${LOCAL_IP}:8000
-DEFGUARD_HTTP_PORT=8000
-DEFGUARD_GRPC_PORT=50055
-
-DEFGUARD_DEFAULT_ADMIN_PASSWORD=${DEFGUARD_ADMIN_PASSWORD}
-DEFGUARD_COOKIE_INSECURE=true
-DEFGUARD_LOG_LEVEL=info
-EOF
-chown root:defguard /etc/defguard/core.conf
-chmod 640 /etc/defguard/core.conf
-systemctl restart defguard
-msg_ok "Configured Defguard"
-
-msg_info "Installing Defguard Edge"
-$STD apt install -y defguard-proxy
-mkdir -p /etc/defguard/certs
-cat <<EOF >/etc/defguard/proxy.toml
-# Defguard Edge (proxy) configuration
-# Apply changes with: systemctl restart defguard-proxy
-
-# Port the API/enrollment HTTP server listens on
-http_port = 8080
-# Port the HTTPS server listens on (used after Core provisions TLS)
-https_port = 8443
-# Port the gRPC server listens on. Core connects here to adopt and manage the Edge.
-grpc_port = 50051
-# Directory where adoption-provisioned mTLS certificates are stored
-cert_dir = "/etc/defguard/certs"
-
-log_level = "info"
-rate_limit_per_second = 0
-rate_limit_burst = 0
-EOF
-chown -R defguard:defguard /etc/defguard/certs /etc/defguard/proxy.toml
-systemctl enable -q --now defguard-proxy
-msg_ok "Installed Defguard Edge"
-
-motd_ssh
-customize
-cleanup_lxc