chore(deps): update changesets/action action to v2 - #42
Merged
Conversation
|
|
Tick the box to add this pull request to the merge queue (same as
|
This was referenced Aug 12, 2026
unional
added a commit
that referenced
this pull request
Aug 13, 2026
… and split into v1/v2 lines (#45) * fix(pnpm-release-changeset): restore changesets/action v1 Reverts the one-line change from #42, which Renovate opened and Mergify auto-merged on 2026-08-12. changesets/action v2 validates the consumer's @changesets/cli major and aborts on v2: This version of the Changesets action is designed to work with Changesets CLI v3. Changesets CLI v2 is not supported; use Changesets action v1 instead, which is compatible with CLI v2. Four of the five consumers of this workflow are on @changesets/cli v2 (storybook ^2.29.7, visual-testing ^2.29.8, rolldown-inline-type-exports ^2.29.8, jest-watch-toggle-config-2 ^2.25.2). All four pin @main, so all four have a broken release path right now; none has noticed because none has released since #42 merged. This branch is the v1 line and stays paired with CLI v2. The v3-compatible variant lives on v2.x and is published as the v2 tag, which is what repobuddy/repobuddy (now on ^3.0.0) will pin. Refs: #43 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(pnpm-release-changeset-oidc): add a secretless release workflow Mirrors pnpm-release-changeset.yml but authenticates without long-lived credentials: the built-in GITHUB_TOKEN with elevated permissions instead of CI_GITHUB_TOKEN, and npm trusted publishing (OIDC) instead of NPM_TOKEN. Trusted publishing also emits provenance attestations. Both tokens it replaces are long-lived, silently expiring, and worth stealing. An expired NPM_TOKEN fails in a way nobody notices until a release has been missing from the registry for a long time. Added alongside the token-based workflow rather than replacing it, so repos keep working until they have registered trusted publishers. Each published package needs one registered against the *caller* workflow's filename before its first OIDC publish. Known trade-off, documented in the file: a PR opened with GITHUB_TOKEN does not trigger on: pull_request, so the version PR gets no status checks. Every consumer in this org already suppresses those checks with branches-ignore: ['changeset-release/*'], so this gives up nothing new. Stays on changesets/action@v1 to match this line's CLI v2 pairing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs: define the two-line tagging scheme for the shared workflows This repo has never been tagged and every consumer pins @main, so every change reaches all of them the instant it merges — including breaking ones nobody reviewed. That is how #42 broke the release path of five repos at once. Adopt semver tags plus a moving major alias (v1.0.0 immutable, v1 re-pointed on each compatible release), and split the changesets release path into two parallel lines because changesets/action and @changesets/cli are strictly paired and the action enforces it: v1 (main) -> changesets/action@v1 -> @changesets/cli v2 v2 (v2.x) -> changesets/action@v2 -> @changesets/cli v3 Consumers pick a tag by their CLI major, not by recency. The lines run in parallel rather than one being a deadline; v2.x merges down into main when the last consumer reaches CLI v3. Documents the per-consumer pin table, why v1.0.0 rather than v0.x, what one tag covers, what counts as breaking, the OIDC adoption steps, the manual release procedure for both lines, and the known gap that internal setup-playwright refs still float on @main. Also records that Mergify's `head~=^(?!major-)` guard does not match the branch names Renovate produces, so majors merge unreviewed. That is a separate defect and should be fixed on its own. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This was referenced Aug 13, 2026
unional
added a commit
to repobuddy/repobuddy
that referenced
this pull request
Aug 13, 2026
repobuddy/.github is now tagged, and this repo needs to move off `@main`. Two parallel lines exist there, because `changesets/action` and `@changesets/cli` are a matched pair that the action validates at runtime: | Line | action | CLI | | --- | --- | --- | | `@v1` | `changesets/action@v1` | v2 | | `@v2` | `changesets/action@v2` | v3 | This repo is on `@changesets/cli@^3.0.0`, so it belongs on **`@v2`**. Right now it is mismatched in the *opposite* direction from the original break: `repobuddy/.github@main` was reverted to `changesets/action@v1` to unbreak the four consumers still on CLI v2, and this repo pins `@main`. Pinning `@v2` fixes that and stops this repo tracking a branch it should not follow. Also pins `setup-playwright` to `@v2`. Left at `@main` the pin leaks — a tagged workflow ref that pulls a floating composite action is only half a pin. Once this lands, the release path should be fully green for the first time since changesets/action v2 was auto-merged into `.github` (repobuddy/.github#42).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1→v2.0.0Release Notes
changesets/action (changesets/action)
v2.0.0Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.