Skip to content

chore(deps): update changesets/action action to v2 - #42

Merged
mergify[bot] merged 1 commit into
mainfrom
renovate/changesets-action-2.x
Aug 12, 2026
Merged

chore(deps): update changesets/action action to v2#42
mergify[bot] merged 1 commit into
mainfrom
renovate/changesets-action-2.x

Conversation

@renovate

@renovate renovate Bot commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
changesets/action action major v1v2.0.0

Release Notes

changesets/action (changesets/action)

v2.0.0

Compare Source


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@changeset-bot

changeset-bot Bot commented Aug 12, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 7baad95

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@mergify
mergify Bot merged commit ae1c2fb into main Aug 12, 2026
2 of 3 checks passed
@mergify

mergify Bot commented Aug 12, 2026

Copy link
Copy Markdown

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

@renovate
renovate Bot deleted the renovate/changesets-action-2.x branch August 12, 2026 00:59
unional added a commit that referenced this pull request Aug 13, 2026
… and split into v1/v2 lines (#45)

* fix(pnpm-release-changeset): restore changesets/action v1

Reverts the one-line change from #42, which Renovate opened and Mergify
auto-merged on 2026-08-12.

changesets/action v2 validates the consumer's @changesets/cli major and
aborts on v2:

  This version of the Changesets action is designed to work with
  Changesets CLI v3. Changesets CLI v2 is not supported; use Changesets
  action v1 instead, which is compatible with CLI v2.

Four of the five consumers of this workflow are on @changesets/cli v2
(storybook ^2.29.7, visual-testing ^2.29.8, rolldown-inline-type-exports
^2.29.8, jest-watch-toggle-config-2 ^2.25.2). All four pin @main, so all
four have a broken release path right now; none has noticed because none
has released since #42 merged.

This branch is the v1 line and stays paired with CLI v2. The v3-compatible
variant lives on v2.x and is published as the v2 tag, which is what
repobuddy/repobuddy (now on ^3.0.0) will pin.

Refs: #43

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat(pnpm-release-changeset-oidc): add a secretless release workflow

Mirrors pnpm-release-changeset.yml but authenticates without long-lived
credentials: the built-in GITHUB_TOKEN with elevated permissions instead
of CI_GITHUB_TOKEN, and npm trusted publishing (OIDC) instead of
NPM_TOKEN. Trusted publishing also emits provenance attestations.

Both tokens it replaces are long-lived, silently expiring, and worth
stealing. An expired NPM_TOKEN fails in a way nobody notices until a
release has been missing from the registry for a long time.

Added alongside the token-based workflow rather than replacing it, so
repos keep working until they have registered trusted publishers. Each
published package needs one registered against the *caller* workflow's
filename before its first OIDC publish.

Known trade-off, documented in the file: a PR opened with GITHUB_TOKEN
does not trigger on: pull_request, so the version PR gets no status
checks. Every consumer in this org already suppresses those checks with
branches-ignore: ['changeset-release/*'], so this gives up nothing new.

Stays on changesets/action@v1 to match this line's CLI v2 pairing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* docs: define the two-line tagging scheme for the shared workflows

This repo has never been tagged and every consumer pins @main, so every
change reaches all of them the instant it merges — including breaking
ones nobody reviewed. That is how #42 broke the release path of five
repos at once.

Adopt semver tags plus a moving major alias (v1.0.0 immutable, v1
re-pointed on each compatible release), and split the changesets release
path into two parallel lines because changesets/action and
@changesets/cli are strictly paired and the action enforces it:

  v1 (main)  -> changesets/action@v1 -> @changesets/cli v2
  v2 (v2.x)  -> changesets/action@v2 -> @changesets/cli v3

Consumers pick a tag by their CLI major, not by recency. The lines run in
parallel rather than one being a deadline; v2.x merges down into main
when the last consumer reaches CLI v3.

Documents the per-consumer pin table, why v1.0.0 rather than v0.x, what
one tag covers, what counts as breaking, the OIDC adoption steps, the
manual release procedure for both lines, and the known gap that internal
setup-playwright refs still float on @main.

Also records that Mergify's `head~=^(?!major-)` guard does not match the
branch names Renovate produces, so majors merge unreviewed. That is a
separate defect and should be fixed on its own.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
unional added a commit to repobuddy/repobuddy that referenced this pull request Aug 13, 2026
repobuddy/.github is now tagged, and this repo needs to move off
`@main`.

Two parallel lines exist there, because `changesets/action` and
`@changesets/cli` are a matched pair that the action validates at
runtime:

| Line | action | CLI |
| --- | --- | --- |
| `@v1` | `changesets/action@v1` | v2 |
| `@v2` | `changesets/action@v2` | v3 |

This repo is on `@changesets/cli@^3.0.0`, so it belongs on **`@v2`**.

Right now it is mismatched in the *opposite* direction from the original
break: `repobuddy/.github@main` was reverted to `changesets/action@v1`
to unbreak the four consumers still on CLI v2, and this repo pins
`@main`. Pinning `@v2` fixes that and stops this repo tracking a branch
it should not follow.

Also pins `setup-playwright` to `@v2`. Left at `@main` the pin leaks — a
tagged workflow ref that pulls a floating composite action is only half
a pin.

Once this lands, the release path should be fully green for the first
time since changesets/action v2 was auto-merged into `.github`
(repobuddy/.github#42).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants