Thinking this through, there's an issue of our package structure:
While it's called @wikimedia/codex, this package contains only the component (and soon pattern) library, while the CHANGELOG.md is overarching all three packages @wikimedia/codex, @wikimedia/codex-design-tokens and @wikimedia/codex-icons.
We can't reference the changelog out of the child's package.json. But even if we copy the changelog over in preparation of a release (in 'prepare-release.sh') it would contain changes of tokens and icons. That is slightly confusing, but might be ok in comparison to not have a changelog at all in the library.

For what it's worth, I think it that we can achieve this by using a Vite or Rollup "copy files plugin" that just takes the top-level markdown file and spits it out into the Codex dist/ folder during build.

I spent a little time today looking into this further.

As I mentioned above, it's very simple to use rollup-plugin-copy or something similar to just blindly the top-level CHANGELOG.md file into the dist folder for the Codex package.

However, I don't think this is 100% what we want to do. Ideally we'd be able to include the changelog alongside the README and LICENSE files, which are already included and appear outside of the dist folder in NPM. It looks like these files are automatically added by NPM based on the contents of package.json.

OOUI's NPM page does include a history.md file when you look at the "Code" tab:

Here's the corresponding snippet from OOUI's package.json file:

"files": [
    "/README.md",
    "/LICENSE-MIT",
    "/AUTHORS.txt",
    "/History.md",
    "/dist/"
],

So maybe all we need to do is make a similar change in Codex's package.json file. However, the one difference is that Codex is a mono-repo, and the file we want is 2 levels up in the folder hierarchy. I'm having a hard time finding much documentation about how this would work exactly; https://docs.npmjs.com/cli/v7/configuring-npm/package-json#files doesn't say anything about leading slashes or monorepos.

It's helpful to ship the changelog in a way that updates show the upstream planned changes

In the context of MediaWiki, how is information about changes in dependencies usually consumed?

Would a link to the CHANGELOG.md file at a remote source (e.g. https://gerrit.wikimedia.org/r/plugins/gitiles/design/codex/+/refs/heads/main/CHANGELOG.md) somewhere (e.g. in README.md) be as useful as packing the file with the tarball published to npm?

In T350790#9579741, @tyhopp wrote:

It's helpful to ship the changelog in a way that updates show the upstream planned changes

In the context of MediaWiki, how is information about changes in dependencies usually consumed?

Generally, we try to have the change log in the repo so that the diff shows up, e.g. https://gerrit.wikimedia.org/r/c/mediawiki/core/+/594266/2/resources/lib/moment/CHANGELOG.md or https://gerrit.wikimedia.org/r/c/mediawiki/vendor/+/1005040/8/wikimedia/less.php/CHANGES.md

Would a link to the CHANGELOG.md file at a remote source (e.g. https://gerrit.wikimedia.org/r/plugins/gitiles/design/codex/+/refs/heads/main/CHANGELOG.md) somewhere (e.g. in README.md) be as useful as packing the file with the tarball published to npm?

No, it won't be as useful. The request here is for the file to be included like it is for many of our other libraries. I'm surprised how much push-back this is getting.

Change 1007018 had a related patch set uploaded (by Eric Gardner; author: Eric Gardner):

[design/codex@main] build: Include CHANGELOG.md in codex package

https://gerrit.wikimedia.org/r/1007018

In T350790#9580337, @Jdforrester-WMF wrote:

No, it won't be as useful. The request here is for the file to be included like it is for many of our other libraries. I'm surprised how much push-back this is getting.

I have no issue including this, I just was not sure how best to do it when the CHANGELOG.md file lived in the top level of our monorepo, while we are publishing a sub-package.

As far as I know, entries in the files key in package.json cannot start with ../. Instead I'm relying on NPM's prepack and postpack hooks to ensure that a copy of the changelog gets included in the Codex tarball.

Let me know if you are aware of any cleaner way to do this. Otherwise, this will show up in the next Codex release.

In T350790#9582193, @egardner wrote:

In T350790#9580337, @Jdforrester-WMF wrote:

No, it won't be as useful. The request here is for the file to be included like it is for many of our other libraries. I'm surprised how much push-back this is getting.

I have no issue including this, I just was not sure how best to do it when the CHANGELOG.md file lived in the top level of our monorepo, while we are publishing a sub-package.

You're right, this is a lot more challenging for Codex than other repos because of the (sensible for Codex) sub-package model.

As far as I know, entries in the files key in package.json cannot start with ../. Instead I'm relying on NPM's prepack and postpack hooks to ensure that a copy of the changelog gets included in the Codex tarball.

Let me know if you are aware of any cleaner way to do this.

Neat way of doing it. For other repos (e.g. in OOUI) we have it as part of the build process, but I think this is better. Thank you!

In the context of MediaWiki, how is information about changes in dependencies usually consumed?

Would a link to the CHANGELOG.md file at a remote source (e.g. https://gerrit.wikimedia.org/r/plugins/gitiles/design/codex/+/refs/heads/main/CHANGELOG.md) somewhere (e.g. in README.md) be as useful as packing the file with the tarball published to npm?

No, it won't be as useful. The request here is for the file to be included like it is for many of our other libraries. I'm surprised how much push-back this is getting.

I asked these questions because I'm a volunteer and I lack a lot of contextual knowledge, not as a way to communicate push-back. Apologies if that was communicated that poorly 🙂

Change 1007018 merged by jenkins-bot:

[design/codex@main] build: use prepack/postpack to manage extra files

https://gerrit.wikimedia.org/r/1007018

Change 1008950 had a related patch set uploaded (by LWatson; author: LWatson):

[mediawiki/core@master] Update Codex from v1.3.3 to v1.3.4

https://gerrit.wikimedia.org/r/1008950

Test wiki created on Patch demo by ATomasevich (WMF) using patch(es) linked to this task:
https://patchdemo.wmflabs.org/wikis/cd11cbf23a/w

Change 1008950 merged by jenkins-bot:

[mediawiki/core@master] Update Codex from v1.3.3 to v1.3.4

https://gerrit.wikimedia.org/r/1008950

Did https://gerrit.wikimedia.org/r/c/design/codex/+/1007018 resolve this @egardner @Jdforrester-WMF ?

In T350790#9615509, @CCiufo-WMF wrote:

Did https://gerrit.wikimedia.org/r/c/design/codex/+/1007018 resolve this @egardner @Jdforrester-WMF ?

Yes, this is great, thank you all!