There is no reason to build tests on these as they are automated
and not often checked, plus, they do not modify code and the
changelog yaml should already be verified when it was merged
[ci skip]
I already use this, but it occurred to me that without hooksecret, that somebody could craft a fake event with a "changelog" and a `$payload['pull_request']['base']['repo']['url']` set to a script they controlled, and use that to extract the private key.
