fix(pnpm-release-changeset): restore action v1, add the OIDC variant, and split into v1/v2 lines - #45
Merged
Merged
Conversation
Reverts the one-line change from #42, which Renovate opened and Mergify auto-merged on 2026-08-12. changesets/action v2 validates the consumer's @changesets/cli major and aborts on v2: This version of the Changesets action is designed to work with Changesets CLI v3. Changesets CLI v2 is not supported; use Changesets action v1 instead, which is compatible with CLI v2. Four of the five consumers of this workflow are on @changesets/cli v2 (storybook ^2.29.7, visual-testing ^2.29.8, rolldown-inline-type-exports ^2.29.8, jest-watch-toggle-config-2 ^2.25.2). All four pin @main, so all four have a broken release path right now; none has noticed because none has released since #42 merged. This branch is the v1 line and stays paired with CLI v2. The v3-compatible variant lives on v2.x and is published as the v2 tag, which is what repobuddy/repobuddy (now on ^3.0.0) will pin. Refs: #43 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Mirrors pnpm-release-changeset.yml but authenticates without long-lived credentials: the built-in GITHUB_TOKEN with elevated permissions instead of CI_GITHUB_TOKEN, and npm trusted publishing (OIDC) instead of NPM_TOKEN. Trusted publishing also emits provenance attestations. Both tokens it replaces are long-lived, silently expiring, and worth stealing. An expired NPM_TOKEN fails in a way nobody notices until a release has been missing from the registry for a long time. Added alongside the token-based workflow rather than replacing it, so repos keep working until they have registered trusted publishers. Each published package needs one registered against the *caller* workflow's filename before its first OIDC publish. Known trade-off, documented in the file: a PR opened with GITHUB_TOKEN does not trigger on: pull_request, so the version PR gets no status checks. Every consumer in this org already suppresses those checks with branches-ignore: ['changeset-release/*'], so this gives up nothing new. Stays on changesets/action@v1 to match this line's CLI v2 pairing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This repo has never been tagged and every consumer pins @main, so every change reaches all of them the instant it merges — including breaking ones nobody reviewed. That is how #42 broke the release path of five repos at once. Adopt semver tags plus a moving major alias (v1.0.0 immutable, v1 re-pointed on each compatible release), and split the changesets release path into two parallel lines because changesets/action and @changesets/cli are strictly paired and the action enforces it: v1 (main) -> changesets/action@v1 -> @changesets/cli v2 v2 (v2.x) -> changesets/action@v2 -> @changesets/cli v3 Consumers pick a tag by their CLI major, not by recency. The lines run in parallel rather than one being a deadline; v2.x merges down into main when the last consumer reaches CLI v3. Documents the per-consumer pin table, why v1.0.0 rather than v0.x, what one tag covers, what counts as breaking, the OIDC adoption steps, the manual release procedure for both lines, and the known gap that internal setup-playwright refs still float on @main. Also records that Mergify's `head~=^(?!major-)` guard does not match the branch names Renovate produces, so majors merge unreviewed. That is a separate defect and should be fixed on its own. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
|
Tick the box to add this pull request to the merge queue (same as
|
This was referenced Aug 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #43, and replaces #44 (same input fix, corrected scheme — see below).
What was broken
Renovate PR #42 changed one line —
changesets/action@v1→@v2.0.0— and Mergify auto-merged it on 2026-08-12T00:58Z. That major renamed every input and added a hard check on the consumer's@changesets/climajor.Every consumer pins
@main, so all five broke at once. Verified in real logs:repobuddy/repobuddy(CLI v3) —Error: The following inputs have been renamedThis version of the Changesets action is designed to work with Changesets CLI v3. Changesets CLI v2 is not supported; use Changesets action v1 instead.The four CLI-v2 repos are broken right now and none has noticed, because none has released since #42 merged. Their last green releases (storybook 2026-08-11 21:44, visual-testing 22:07) predate it.
Why this needs two lines, not one fix
changesets/actionand@changesets/cliare strictly paired, and the action enforces it:v1version,publish,commitv2version-script,publish-script,commit-messageNo single workflow serves both. Consumers are split across both CLI majors:
@changesets/clirepobuddy/repobuddy^3.0.0@v2repobuddy/storybook^2.29.7@v1repobuddy/visual-testing^2.29.8@v1repobuddy/rolldown-inline-type-exports^2.29.8@v1repobuddy/jest-watch-toggle-config-2^2.25.2@v1This is where #44 went wrong. It applied the action-v2 input fix to
mainand put every consumer on@v1— which would have left the four CLI-v2 repos exactly as broken as they are today, just with a tag on it. Its input fix and its README are otherwise sound and are carried forward here.What this PR does
mainbecomes the v1 line:changesets/action@v1. This alone unbreaks the four CLI-v2 consumers.pnpm-release-changeset-oidc.yml— secretless variant: built-inGITHUB_TOKENinstead ofCI_GITHUB_TOKEN, npm trusted publishing (OIDC) instead ofNPM_TOKEN, plus provenance attestations. Added alongside the token-based workflow, not replacing it, so nothing breaks before trusted publishers are registered.The v2 line is on the
v2.xbranch (pushed, not part of this PR): both workflows onchangesets/action@v2.0.0with renamed inputs,github-tokenpassed as an input rather than only as env, andcontents: write+pull-requests: writesince v2 pushes via the GitHub API.Tagging
After merge:
Then consumers move off
@mainto their line's tag.Verified
Both workflows on both lines parse, and every
with:key on the v2 line was checked againstchangesets/action@v2.0.0's actualaction.yml— no unknown inputs. (Its own error message misspells the target ascommit-mesage; the real input iscommit-message. Don't copy the message.)Not fixed here
Mergify's
head~=^(?!major-)guard is meant to hold majors back, but Renovate doesn't prefix these branches withmajor-, so the guard never matches and majors merge unreviewed — which is how #42 landed. Separate defect, recorded in the README, worth its own fix.Also note: pinning
@v1does not fully isolate consumers yet, because two workflows reference this repo's ownsetup-playwright@main. Documented as a known gap; it can only be re-pointed oncev1exists.