Repository: nodejs/node
Pull request: tools: validate release commit diff as part of `lint-release-proposal`

The goal is to make it easier to spot mismatch as recently happened with https://github.com/nodejs/node/pull/61369

<!--
Before submitting a pull request, please read:

- the CONTRIBUTING guide at https://github.com/nodejs/node/blob/HEAD/CONTRIBUTING.md
- the commit message formatting guidelines at
  https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md#commit-message-guidelines

For code changes:
1. Include tests for any bug fixes or new features.
2. Update documentation if relevant.
3. Ensure that `make -j4 test` (UNIX), or `vcbuild test` (Windows) passes.

If you believe this PR should be highlighted in the Node.js CHANGELOG
please add the `notable-change` label.

Developer's Certificate of Origin 1.1

By making a contribution to this project, I certify that:

(a) The contribution was created in whole or in part by me and I
    have the right to submit it under the open source license
    indicated in the file; or

(b) The contribution is based upon previous work that, to the best
    of my knowledge, is covered under an appropriate open source
    license and I have the right under that license to submit that
    work with modifications, whether created in whole or in part
    by me, under the same open source license (unless I am
    permitted to submit under a different license), as indicated
    in the file; or

(c) The contribution was provided directly to me by some other
    person who certified (a), (b) or (c) and I have not modified
    it.

(d) I understand and agree that this project and the contribution
    are public and that a record of the contribution (including all
    personal information I submit with it, including my sign-off) is
    maintained indefinitely and may be redistributed consistent with
    this project or the open source license(s) involved.
-->


Changed files:
filename: .github/workflows/lint-release-proposal.yml
patch: @@ -26,6 +26,7 @@ jobs:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
         with:
           persist-credentials: false
+          fetch-depth: 2
       - name: Lint release commit title format
         run: |
           EXPECTED_TITLE='^[[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2}, Version [[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+ (\(Current|'.+' \(LTS)\)$'
@@ -51,6 +52,29 @@ jobs:
       - name: Verify it's release-ready
         run: |
           SKIP_XZ=1 make release-only
+      - name: Lint release commit content
+        run: |
+          MAJOR="$(awk '/^#define NODE_MAJOR_VERSION / { print $3 }' src/node_version.h)"
+
+          echo "Checking for expected files in the release commit:"
+          missing_expected=
+          for expected in CHANGELOG.md src/node_version.h doc/changelogs/; do
+            if git diff --exit-code --quiet --diff-filter=M HEAD^ -- "$expected"; then
+              echo "Missing expected file in diff: $expected"
+              missing_expected=1
+            fi
+          done
+          [ -z "$missing_expected" ] || exit 1
+
+          echo "Checking for unexpected files in the release commit:"
+          set -ex
+          [ -z "$(git diff-tree --no-commit-id --name-only -r HEAD --\
+            . \
+            ':(exclude)CHANGELOG.md' \
+            ':(exclude)src/node_version.h' \
+            ':(exclude)test/parallel/test-process-release.js' \
+            ':(exclude)doc/api/' \
+            ":(exclude)doc/changelogs/CHANGELOG_V$MAJOR.md")" ]
       - name: Validate CHANGELOG
         id: releaser-info
         run: |