How We Built an Automated Git Changelog & Roadmap Engine (Zero SaaS, Zero Manual Work)

Maintaining customer-facing changelogs and public roadmaps is one of the most tedious administrative friction points for technical founders and engineering teams. You ship features and bug fixes daily, but translating git history into clean marketing updates, avoiding infrastructure leaks, and keeping a visual roadmap up to date usually falls through the cracks—or forces you into paying $50 to $200 every month for hosted SaaS platforms like Canny, LaunchNotes, or Beamer.

At Wolfitway, our sovereign design principle is simple: Git is the single source of truth. If a feature, fix, or performance optimization ships in a Git commit, it should automatically sanitize itself, categorize into human benefit pillars, and publish to both a live interactive changelog and visual roadmap with zero manual toil and zero monthly subscriptions. Here is how we engineered our internal Velocity Kit engine to run entirely on Git hooks, git-cliff, and Nuxt 4.

Watch the Video Walkthrough

In the companion video walkthrough below, Dan-Ioan Drăguța demonstrates how our automated shipping pipeline works in real time—from local Git commit to live public deployment on wolfitway.com.

The Architecture: Inside Velocity Kit

Velocity Kit (tooling/velocity-kit/) is our self-hosted, monorepo-native engine designed for projects combining Nuxt 4, Rust backend services, and static marketing sites. The entire pipeline operates locally on developer workstations and CI environments without external databases or proprietary APIs:

[ Git Commit ] (feat, fix, perf with conventional scopes)
       │
       ▼
[ hooks/post-commit ] (npm run velocity:install-hook)
       │
       ▼
[ tooling/velocity-kit/scripts/generate-changelog.mjs ]
  ├── 1. Internal Log: git-cliff -> CHANGELOG.internal.md (uncut developer audit)
  ├── 2. OpSec Hard Blocklist: filters out Hetzner, Caddy, UFW, Docker, tokens
  ├── 3. Vendor Masking: translates API keys & internal jargon to user benefits
  ├── 4. Semantic Categorizer: groups commits into 5 Human Value Pillars
  ├── 5. Public Markdown: git-cliff -> CHANGELOG.md
  ├── 6. Nuxt 4 Telemetry: emits apps/web/app/data/changelog.json & roadmap.json
  └── 7. OpSec Audit Gate: halts and flags if any sensitive keywords escape
       │
       ▼
[ Public Nuxt 4 UI ] -> Instant reactive filtering on /changelog and /roadmap

1. Zero-Toil Git Hooks (Without Infinite Commit Loops)

The fundamental flaw with many custom changelog scripts is that they require manual execution or complex CI webhooks. We wanted instant feedback: the moment code is committed locally, the changelog and roadmap must immediately update.

However, writing a post-commit hook that commits updated changelog files presents an infamous trap: the infinite commit loop. Every time the hook commits, Git triggers the post-commit hook again. Here is how our post-commit hook (tooling/velocity-kit/hooks/post-commit) elegantly prevents loops, skips interactive git states, and handles errors safely:

#!/bin/sh
# Velocity Kit post-commit hook: regenerate changelog + roadmap after every
# commit and record them in a follow-up "chore: regenerate changelogs" commit.

# 1. Break recursion if already running inside the hook or flagged to skip
[ -n "$VELOCITY_HOOK" ] && exit 0
[ -n "$VELOCITY_SKIP" ] && exit 0

git_dir=$(git rev-parse --git-dir)
# 2. Never run during rebase, merge conflict resolution, cherry-pick, or bisect
for f in rebase-merge rebase-apply MERGE_HEAD CHERRY_PICK_HEAD BISECT_LOG; do
  [ -e "$git_dir/$f" ] && exit 0
done

# 3. Skip if the previous commit was already our automated changelog commit
case "$(git log -1 --format=%s)" in "chore: regenerate changelogs"*) exit 0 ;; esac

root=$(git rev-parse --show-toplevel)
cd "$root" || exit 0
files="CHANGELOG.md apps/web/app/data/changelog.json apps/web/app/data/roadmap.json tooling/velocity-kit/CHANGELOG.internal.md"

echo "⚡ [Velocity Kit] syncing changelog + roadmap..."
if ! node tooling/velocity-kit/scripts/generate-changelog.mjs >/tmp/velocity-hook.log 2>&1; then
  echo "⚠️ [Velocity Kit] sync failed; commit kept, changelog not updated."
  exit 0
fi

# 4. If files changed, commit cleanly without triggering hooks recursively
git diff --quiet -- $files && exit 0
git add -- $files
VELOCITY_HOOK=1 git commit -q --no-verify -m "chore: regenerate changelogs" -- $files \
  && echo "✅ [Velocity Kit] committed regenerated changelogs ($(git rev-parse --short HEAD))"
exit 0

Engineers simply run npm run velocity:install-hook once, configuring git config core.hooksPath tooling/velocity-kit/hooks. From that moment forward, every single feature or fix automatically updates the public timeline without touching an admin dashboard.

2. Dual-Pipeline & OpSec Sanitization

Publishing raw Git commits directly to customers is dangerous. You risk exposing internal infrastructure details (e.g. server hostnames, UFW firewall tweaks, Docker configs), internal auth mechanisms, secret keys, or raw devops chatter.

Velocity Kit solves this with a Dual-Pipeline Architecture:

• Pipeline 1 (Internal Audit Log): Runs git-cliff against cliff-internal.toml to output tooling/velocity-kit/CHANGELOG.internal.md. Every commit hash, refactor, and internal infrastructure adjustment is preserved for internal team review.
• Pipeline 2 (Public Marketing Velocity Log): Applies rigorous regex filters and vendor sanitization before emitting CHANGELOG.md and changelog.json.

Our OpSec blocklist strips out sensitive internal patterns automatically:

// OpSec Hard Blocklist in generate-changelog.mjs
const OPSEC_BLOCKLIST = [
  /superadmin|promote|revoke/i,
  /caddy|hetzner|ufw|firewall|nginx|docker|swap|oom|crontab|backup/i,
  /vault_keys|user_keys|secret_key|cookie_secret|api_key/i,
  /velocity-kit|tooling|release script|release tool/i,
  /internal|dep(s)?|pnpm|cargo workspace|bump/i
];

Simultaneously, a vendor translation layer turns developer jargon and third-party provider lock-in into customer-centric value propositions:

const VENDOR_REPLACEMENTS = [
  [/\bgemini\s+api\s+key\b/gi, 'AI provider key'],
  [/\bgemini\s+models\b/gi, 'creator AI models'],
  [/\bgemini\s+[\d.]+\s+flash\b/gi, 'high-speed multimodal AI'],
  [/\bchacha20-poly1305\b/gi, 'private device encryption (keys stay in your control)'],
  [/\bshadow dom\b/gi, 'isolated component view'],
  [/\bconventional commits?\b/gi, 'structured updates'],
  [/\bsub-100ms\b/gi, 'instant']
];

Before any output is written, an Automated OpSec Audit Gate scans the generated JSON releases. If any flagged keywords or tokens are detected, the build logs a high-priority warning to prevent accidental disclosure.

3. The 5 Human Pillars: Semantic Scope Mapping

Customers do not care about cryptic git scopes like refactor(sql) or chore(deps). They care about product value. Velocity Kit maps conventional commit scopes and commit messages dynamically into 5 Human Pillars:

1. 🛍️ Sovereign Commerce & Product Studio (commerce): Checkout flows, payments, products, vaults, orders.
2. ✨ Creator AI & Voice Superpowers (intelligence): Speech generation, Kokoro audio, transcription, multimodal AI assistants.
3. ♿ Inclusive Access & Smooth Mobile Flow (experience): WCAG accessibility, keyboard navigation, light/dark mode tokens, mobile responsiveness.
4. 🛡️ Sovereignty, Privacy & Direct Control (ownership): Authentication, local encryption, zero third-party telemetry, direct database sovereignty.
5. 🎮 3D Simulators & Interactive Experiences (simulators): Three.js 3D pavilion museum rooms, canvas physics, interactive audio players.

4. Monorepo Release Orchestration & Multi-Manifest Sync

In a sovereign monorepo combining TypeScript/Nuxt and Rust/Loco, version bumps are often tricky. You have to bump root package.json, apps/web/package.json, and apps/server/Cargo.toml.

Velocity Kit provides a unified release orchestrator (tooling/velocity-kit/scripts/release.mjs). Running npm run release:patch performs four atomic actions:

• Synchronizes Manifests: Bumps versions across all JSON and Cargo.toml files specified in velocity.config.json.
• Generates Dual Changelogs: Regenerates both markdown and JSON feeds with the new release version.
• Drafts Social Launch Announcement: Extracts the top user-facing bullet points and drafts ready-to-publish X/Twitter copy in tooling/velocity-kit/latest-announcement.txt.
• Roadmap Lockstep: Updates the timestamp of roadmap.json so roadmap items stay in sync with shipped releases.

5. Decoupled Reactive Nuxt 4 Architecture (Zero DB Hits)

Most changelog platforms force you to load client-heavy JavaScript embeds or query slow REST APIs on every page visit. Velocity Kit emits directly to apps/web/app/data/changelog.json during the Git hook.

In Nuxt 4, our /changelog and /roadmap pages import this JSON file directly at build/SSR time. The benefits are radical:

• Instant Load Velocity: 0 database connections opened, 0 external API calls, sub-15ms page rendering.
• Client-Side Interactive Filtering: Visitors can filter by scope (Commerce, AI, Experience, Privacy, 3D) or search commits instantly in memory.
• 100% Uptime & Privacy: No third-party tracking scripts, zero GDPR cookie banner requirements, and zero risk of your changelog going down because a SaaS vendor had an outage.

Live Proof & How to Try It

You can see Velocity Kit live in action right now on our public pages:

• Explore our verified release history: https://wolfitway.com/changelog
• Check out our public engineering roadmap: https://wolfitway.com/roadmap
• If you want bespoke, sovereign infrastructure and custom developer automation built for your business without monthly SaaS fees, explore our fixed-price MVP service: Build With Dan-Ioan Drăguța