add explicit files

* Update vscode settings

* Update launch.json

.changeset/plenty-areas-tie.md

@@ -1,5 +0,0 @@
----
-"@changesets/action": patch
----
-
-Fixed initial `.changeset` state being picked up, when `cwd` parameter is provided

.changeset/splendid-facts-like.md

@@ -1,5 +0,0 @@
----
-"@changesets/action": patch
----
-
-Fixed `.changeset` state being picked for the version command when `cwd` parameter is provided

.github/CODEOWNERS

@@ -1,5 +1,4 @@
-/.github/workflows/** @Andarist @emmatown
+/.github/workflows/** @Andarist @bluwy @emmatown
-/action.yml @Andarist @emmatown
+/action.yml @Andarist @bluwy @emmatown
-/scripts/bump.ts @Andarist @emmatown
+/scripts/bump.ts @Andarist @bluwy @emmatown
-/scripts/release.ts @Andarist @emmatown
+/scripts/release.ts @Andarist @bluwy @emmatown
-/scripts/release-pr.ts @Andarist @emmatown

.github/actions/ci-setup/action.yml

@@ -1,14 +1,24 @@
 name: Setup CI
+description: Setup CI
+
+inputs:
+  skip-cache:
+    description: "Whether to skip the cache"
+    required: false
+    default: "false"
 
 runs:
   using: composite
   steps:
-    - name: Setup Node.js
+    - name: Set up pnpm
-      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+      uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6.0.5
+
+    - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version-file: ".node-version"
-        cache: yarn
+        package-manager-cache: ${{ inputs.skip-cache != 'true' }}
+        cache: ${{ inputs.skip-cache != 'true' && 'pnpm' || '' }}
 
     - name: Install dependencies
       shell: bash
-      run: yarn install --frozen-lockfile
+      run: pnpm install --frozen-lockfile

.github/dependabot.yml

@@ -9,3 +9,5 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/ci.yml

@@ -2,26 +2,54 @@ name: CI
 
 on:
   pull_request:
-  push:
+  # merge queue is required so all commits on target branches trigger this workflow
-    branches: [main]
+  # despite lack of the push event trigger here
   merge_group:
-    branches: [main]
+    branches:
+      - main
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.sha }}
+  cancel-in-progress: true
+
 jobs:
+  lint-workflows:
+    name: Lint workflows
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read # only required in private repos
+      security-events: write # allow writing security events
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        with:
+          persona: pedantic
+          annotations: true
+          advanced-security: false
+
   test:
     name: Test
     timeout-minutes: 20
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Check out repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
       - uses: ./.github/actions/ci-setup
 
       - name: Test
-        run: yarn test
+        run: pnpm test
 
   typecheck:
     name: Typecheck
@@ -29,18 +57,22 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Check out repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
       - uses: ./.github/actions/ci-setup
 
       - name: Typecheck
-        run: yarn typecheck
+        run: pnpm typecheck
 
   ci-ok:
     name: CI OK
     runs-on: ubuntu-latest
     if: always()
-    needs: [test, typecheck]
+    needs: [lint-workflows, test, typecheck]
     steps:
       - name: Exit with error if some jobs are not successful
         run: exit 1
-        if: ${{ always() && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'skipped') || contains(needs.*.result, 'cancelled')) }}
+        if: ${{ always() && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) }}

.github/workflows/pkg-pr-new.yml

@@ -0,0 +1,31 @@
+name: pkg-pr-new
+
+on: pull_request
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  publish:
+    name: Publish
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/ci-setup
+        with:
+          skip-cache: true # avoid cache poisoning attacks
+
+      - name: Build
+        run: pnpm build
+
+      - run:
+          | # zizmor: ignore[use-trusted-publishing] we're not publishing to npm here
+          pnpm exec pkg-pr-new publish --pnpm --packageManager=pnpm --commentWithDev --commentWithSha --no-compact --no-template

.github/workflows/publish.yml

@@ -5,7 +5,10 @@ on:
     branches:
       - main
 
-concurrency: ${{ github.workflow }}-${{ github.ref }}
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+  queue: max
 
 permissions: {} # each job should define its own permission explicitly
 
@@ -21,17 +24,23 @@ jobs:
       issues: write # to post issue comments (changesets/action)
       pull-requests: write # to create pull request (changesets/action)
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Check out repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
       - uses: ./.github/actions/ci-setup
+        with:
+          skip-cache: true # avoid cache poisoning attacks
 
       - name: Build
-        run: yarn build
+        run: pnpm build
 
       - name: Create or update release pull request
         id: changesets
         uses: ./
         with:
-          version: yarn bump
+          version: pnpm bump
 
   publish:
     name: Publish
@@ -40,6 +49,8 @@ jobs:
     runs-on: ubuntu-latest
     environment: marketplace
     timeout-minutes: 20
+    permissions:
+      contents: write # to create release and have it authored by github-actions (changesets/action)
     steps:
       - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
         id: app-token
@@ -47,16 +58,21 @@ jobs:
           client-id: ${{ vars.APP_CLIENT_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Check out repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: true
+          # we need this token to bypass the branch and tag protection rules
           token: ${{ steps.app-token.outputs.token }}
 
       - uses: ./.github/actions/ci-setup
+        with:
+          skip-cache: true # avoid cache poisoning attacks
 
       - name: Build
-        run: yarn build
+        run: pnpm build
 
       - name: Publish to marketplace
         uses: ./
         with:
-          publish: yarn release
+          publish: pnpm release

.github/workflows/release-pr.yml

@@ -1,183 +0,0 @@
-name: Release PR
-
-on:
-  issue_comment:
-    types: [created]
-
-permissions: {}
-
-jobs:
-  release_check:
-    if: github.repository == 'changesets/action' && github.event.issue.pull_request && startsWith(github.event.comment.body, '/release-pr')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      issues: write
-      pull-requests: read
-    steps:
-      - id: report_in_progress
-        run: |
-          echo "in_progress_reaction_id=$(gh api /repos/${{github.repository}}/issues/comments/${{github.event.comment.id}}/reactions -f content='eyes' --jq '.id')" >> "$GITHUB_OUTPUT"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - id: parse_command
-        run: |
-          if [[ "$COMMENT_BODY" =~ ^/release-pr[[:space:]]+([0-9a-fA-F]{7,40})[[:space:]]*$ ]]
-          then
-            echo "requested_sha=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT"
-          else
-            echo "Expected '/release-pr <sha>' where <sha> is a 7-40 character commit SHA."
-            exit 1
-          fi
-        env:
-          COMMENT_BODY: ${{ github.event.comment.body }}
-
-      - id: check_authorization
-        run: |
-          if [[ $AUTHOR_ASSOCIATION == 'MEMBER' || $AUTHOR_ASSOCIATION == 'OWNER' || $AUTHOR_ASSOCIATION == 'COLLABORATOR' ]]
-          then
-            echo "User is authorized to release"
-          else
-            echo "User is not authorized to release"
-            exit 1
-          fi
-        env:
-          AUTHOR_ASSOCIATION: ${{ github.event.comment.author_association }}
-
-      - id: resolve_requested_sha
-        run: |
-          requested_sha=$(echo "$REQUESTED_SHA" | tr '[:upper:]' '[:lower:]')
-
-          mapfile -t matches < <(
-            gh api /repos/${{ github.repository }}/pulls/${{ github.event.issue.number }}/commits --paginate --jq '.[].sha' |
-              awk -v sha="$requested_sha" 'index(tolower($0), sha) == 1 { print $0 }'
-          )
-
-          if [[ ${#matches[@]} -eq 0 ]]
-          then
-            echo "Requested SHA $REQUESTED_SHA is not part of this pull request."
-            exit 1
-          fi
-
-          if [[ ${#matches[@]} -gt 1 ]]
-          then
-            echo "Requested SHA $REQUESTED_SHA is ambiguous for this pull request."
-            exit 1
-          fi
-
-          resolved_sha="${matches[0]}"
-          pr_head_sha=$(gh pr view ${{ github.event.issue.number }} --json headRefOid --jq '.headRefOid')
-
-          if [[ "$resolved_sha" != "$pr_head_sha" ]]
-          then
-            echo "Requested SHA $resolved_sha is not the current PR head $pr_head_sha."
-            exit 1
-          fi
-
-          echo "resolved_sha=$resolved_sha" >> "$GITHUB_OUTPUT"
-          echo "pr_head_sha=$pr_head_sha" >> "$GITHUB_OUTPUT"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REQUESTED_SHA: ${{ steps.parse_command.outputs.requested_sha }}
-
-      - id: get_pr_head_repository
-        run: |
-          echo "head_repository=$(gh pr view ${{ github.event.issue.number }} --json headRepositoryOwner,headRepository --jq '.headRepositoryOwner.login + "/" + .headRepository.name')" >> "$GITHUB_OUTPUT"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-    outputs:
-      in_progress_reaction_id: ${{ steps.report_in_progress.outputs.in_progress_reaction_id }}
-      requested_sha: ${{ steps.parse_command.outputs.requested_sha }}
-      resolved_sha: ${{ steps.resolve_requested_sha.outputs.resolved_sha }}
-      pr_head_sha: ${{ steps.resolve_requested_sha.outputs.pr_head_sha }}
-      head_repository: ${{ steps.get_pr_head_repository.outputs.head_repository }}
-
-  release:
-    if: github.repository == 'changesets/action'
-    timeout-minutes: 20
-    runs-on: ubuntu-latest
-    needs: release_check
-    permissions:
-      contents: write
-      issues: write
-      pull-requests: write
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: ./.github/actions/ci-setup
-
-      - name: Fetch validated commit from pull request head repository
-        run: |
-          git remote add pr-head https://github.com/$HEAD_REPOSITORY.git
-          git fetch --no-tags pr-head $RESOLVED_SHA
-        env:
-          HEAD_REPOSITORY: ${{ needs.release_check.outputs.head_repository }}
-          RESOLVED_SHA: ${{ needs.release_check.outputs.resolved_sha }}
-
-      - name: Checkout validated commit
-        run: git checkout --detach $RESOLVED_SHA
-        env:
-          RESOLVED_SHA: ${{ needs.release_check.outputs.resolved_sha }}
-
-      - name: Check if Version Packages PR
-        id: check_version_packages
-        run: |
-          echo "version_packages=$(gh pr view ${{ github.event.issue.number }} --json headRefName --jq '.headRefName|startswith("changeset-release/")')" >> "$GITHUB_OUTPUT"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Reset Version Packages PR
-        if: steps.check_version_packages.outputs.version_packages == 'true'
-        run: git reset --hard HEAD~1
-
-      - run: yarn changeset version --snapshot pr${{ github.event.issue.number }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build
-        run: yarn build
-
-      - name: Setup Git user
-        run: |
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-
-      - name: Release snapshot version
-        run: yarn run release:pr
-
-      - run: gh api /repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions -f content='rocket'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - run: gh api -X DELETE /repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions/${{ needs.release_check.outputs.in_progress_reaction_id }}
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - run: |
-          gh pr comment ${{ github.event.issue.number }} --body "The release for \`${{ needs.release_check.outputs.resolved_sha }}\` triggered by [this comment](${{ github.event.comment.url }}) has [succeeded](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}). Published commit: [${{ github.repository }}@$(git rev-parse HEAD)](https://github.com/${{ github.repository }}/commit/$(git rev-parse HEAD))."
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  report-failure-if-needed:
-    needs: [release_check, release]
-    timeout-minutes: 2
-    runs-on: ubuntu-latest
-    if: failure() && github.repository == 'changesets/action' && (needs.release_check.result == 'failure' || needs.release.result == 'failure')
-    permissions:
-      issues: write
-      pull-requests: write
-    steps:
-      - run: gh api /repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions -f content='-1'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - run: gh api -X DELETE /repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions/${{ needs.release_check.outputs.in_progress_reaction_id }}
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - run: |
-          gh pr comment ${{ github.event.issue.number }} --body "The release for \`${{ needs.release_check.outputs.requested_sha }}\` triggered by [this comment](${{ github.event.comment.url }}) has [failed](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})."
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}

.oxfmtrc.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "printWidth": 80,
+  "sortImports": {
+    "newlinesBetween": false
+  }
+}

.vscode/launch.json

@@ -1,5 +1,4 @@
 {
-  // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
   "version": "0.2.0",
   "configurations": [
     {
@@ -7,6 +6,7 @@
       "request": "launch",
       "name": "Debug Current Test File",
       "autoAttachChildProcesses": true,
+      "skipFiles": [],
       "program": "${workspaceRoot}/node_modules/vitest/vitest.mjs",
       "args": ["run", "${relativeFile}"],
       "smartStep": true,

.vscode/settings.json

@@ -1,3 +1,4 @@
 {
-  "typescript.tsdk": "node_modules/typescript/lib"
+  "js/ts.tsdk.path": "node_modules/typescript/lib",
+  "editor.defaultFormatter": "oxc.oxc-vscode"
 }

CHANGELOG.md

@@ -1,5 +1,17 @@
 # @changesets/action
 
+## 1.8.0
+
+### Minor Changes
+
+- [#258](https://github.com/changesets/action/pull/258) [`f5dbf72`](https://github.com/changesets/action/commit/f5dbf72f96949cb0daf45152f0f63062df70e97d) Thanks [@tom-sherman](https://github.com/tom-sherman)! - Support draft version PR modes with a new `prDraft` input. Use `create` to create new version PRs as drafts, or `always` to also convert existing version PRs back to draft when updating them.
+
+### Patch Changes
+
+- [#502](https://github.com/changesets/action/pull/502) [`6002dbd`](https://github.com/changesets/action/commit/6002dbd987f49a3c0a134910d9c7bca975b79977) Thanks [@oshytiko](https://github.com/oshytiko)! - Fixed initial `.changeset` state being picked up, when `cwd` parameter is provided
+
+- [#536](https://github.com/changesets/action/pull/536) [`81b3f61`](https://github.com/changesets/action/commit/81b3f61ebffcb868f73e4c0b2682517149c834a2) Thanks [@radnan](https://github.com/radnan)! - Fixed `.changeset` state being picked for the version command when `cwd` parameter is provided
+
 ## 1.7.0
 
 ### Minor Changes

README.md

@@ -14,13 +14,14 @@ This action for [Changesets](https://github.com/changesets/changesets) creates a
 - createGithubReleases - A boolean value to indicate whether to create Github releases after `publish` or not. Default to `true`
 - commitMode - Specifies the commit mode. Use `"git-cli"` to push changes using the Git CLI, or `"github-api"` to push changes via the GitHub API. When using `"github-api"`, all commits and tags are GPG-signed and attributed to the user or app who owns the `GITHUB_TOKEN`. Default to `git-cli`.
 - cwd - Changes node's `process.cwd()` if the project is not located on the root. Default to `process.cwd()`
+- prDraft - Controls draft PR behavior. Use `create` to create new version PRs as draft, or `always` to also convert existing version PRs back to draft when updating them. By default, version PRs are not forced into draft mode.
 
 ### Outputs
 
 - published - A boolean value to indicate whether a publishing has happened or not
 - publishedPackages - A JSON array to present the published packages. The format is `[{"name": "@xx/xx", "version": "1.2.0"}, {"name": "@xx/xy", "version": "0.8.9"}]`
 
-### Example workflow:
+### Example workflow
 
 #### Without Publishing
 
@@ -42,15 +43,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
 
-      - name: Setup Node.js 20
+      - name: Setup pnpm
-        uses: actions/setup-node@v3
+        uses: pnpm/action-setup@v6
+
+      - name: Setup Node.js 26
+        uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 26
 
       - name: Install Dependencies
-        run: yarn
+        run: pnpm install --frozen-lockfile
 
       - name: Create Release Pull Request
         uses: changesets/action@v1
@@ -76,22 +80,25 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
 
-      - name: Setup Node.js 20.x
+      - name: Setup pnpm
-        uses: actions/setup-node@v3
+        uses: pnpm/action-setup@v6
+
+      - name: Setup Node.js 26
+        uses: actions/setup-node@v6
         with:
-          node-version: 20.x
+          node-version: 26
 
       - name: Install Dependencies
-        run: yarn
+        run: pnpm install --frozen-lockfile
 
       - name: Create Release Pull Request or Publish to npm
         id: changesets
         uses: changesets/action@v1
         with:
           # This expects you to have a script called release which does a build for your packages and calls changeset publish
-          publish: yarn release
+          publish: pnpm release
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 
@@ -103,7 +110,7 @@ jobs:
 
 By default the GitHub Action creates a `.npmrc` file with the following content:
 
-```
+```txt
 //registry.npmjs.org/:_authToken=${process.env.NPM_TOKEN}
 ```
 
@@ -140,15 +147,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
 
-      - name: Setup Node.js 20.x
+      - name: Setup pnpm
-        uses: actions/setup-node@v3
+        uses: pnpm/action-setup@v6
+
+      - name: Setup Node.js 26
+        uses: actions/setup-node@v6
         with:
-          node-version: 20.x
+          node-version: 26
 
       - name: Install Dependencies
-        run: yarn
+        run: pnpm install --frozen-lockfile
 
       - name: Create Release Pull Request or Publish to npm
         id: changesets
@@ -157,7 +167,7 @@ jobs:
       - name: Publish
         if: steps.changesets.outputs.hasChangesets == 'false'
         # You can do something when a publish should happen.
-        run: yarn publish
+        run: pnpm publish
 ```
 
 #### With version script
@@ -182,21 +192,24 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
 
-      - name: Setup Node.js 20.x
+      - name: Setup pnpm
-        uses: actions/setup-node@v3
+        uses: pnpm/action-setup@v6
+
+      - name: Setup Node.js 26
+        uses: actions/setup-node@v6
         with:
-          node-version: 20.x
+          node-version: 26
 
       - name: Install Dependencies
-        run: yarn
+        run: pnpm install --frozen-lockfile
 
       - name: Create Release Pull Request
         uses: changesets/action@v1
         with:
           # this expects you to have a npm script called version that runs some logic and then calls `changeset version`.
-          version: yarn version
+          version: pnpm version
 ```
 
 #### With Yarn 2 / Plug'n'Play
@@ -207,5 +220,5 @@ If you are using [Yarn Plug'n'Play](https://yarnpkg.com/features/pnp), you shoul
 - uses: changesets/action@v1
   with:
     version: yarn changeset version
-    ...
+    # ...
 ```

__fixtures__/ignored-package/.changeset/config.json

@@ -1,4 +0,0 @@
-{
-  "$schema": "https://unpkg.com/@changesets/config@1.3.0/schema.json",
-  "ignore": ["ignored-package-pkg-a"]
-}

__fixtures__/ignored-package/package.json

@@ -1,8 +0,0 @@
-{
-  "private": true,
-  "name": "ignored-package",
-  "version": "1.0.0",
-  "workspaces": [
-    "packages/*"
-  ]
-}

__fixtures__/ignored-package/packages/pkg-a/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "ignored-package-pkg-a",
-  "version": "1.0.0",
-  "dependencies": {
-    "ignored-package-pkg-b": "1.0.0"
-  }
-}

__fixtures__/ignored-package/packages/pkg-b/package.json

@@ -1,4 +0,0 @@
-{
-  "name": "ignored-package-pkg-b",
-  "version": "1.0.0"
-}

__fixtures__/simple-project/.changeset/config.json

@@ -1,3 +0,0 @@
-{
-  "$schema": "https://unpkg.com/@changesets/config@1.3.0/schema.json"
-}

__fixtures__/simple-project/package.json

@@ -1,8 +0,0 @@
-{
-  "private": true,
-  "name": "simple-project",
-  "version": "1.0.0",
-  "workspaces": [
-    "packages/*"
-  ]
-}

__fixtures__/simple-project/packages/pkg-a/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "simple-project-pkg-a",
-  "version": "1.0.0",
-  "dependencies": {
-    "simple-project-pkg-b": "1.0.0"
-  }
-}

__fixtures__/simple-project/packages/pkg-b/package.json

@@ -1,4 +0,0 @@
-{
-  "name": "simple-project-pkg-b",
-  "version": "1.0.0"
-}

action.yml

@@ -43,6 +43,9 @@ inputs:
   branch:
     description: Sets the branch in which the action will run. Default to `github.ref_name` if not provided
     required: false
+  prDraft:
+    description: 'Controls draft PR behavior. Use "create" to create new version PRs as draft, or "always" to also convert existing version PRs back to draft when updating them.'
+    required: false
 outputs:
   published:
     description: A boolean value to indicate whether a publishing is happened or not

package.json

@@ -1,51 +1,34 @@
 {
   "name": "@changesets/action",
-  "version": "1.7.0",
+  "version": "1.8.0",
-  "main": "dist/index.js",
-  "type": "module",
   "license": "MIT",
-  "devDependencies": {
+  "type": "module",
-    "@changesets/changelog-github": "^0.5.1",
+  "exports": "./dist/index.js",
-    "@changesets/cli": "^2.29.3",
+  "files": [
-    "@changesets/write": "^0.4.0",
+    "dist",
-    "@rollup/plugin-commonjs": "^28.0.3",
+    "action.yml"
-    "@rollup/plugin-json": "^6.1.0",
+  ],
-    "@rollup/plugin-node-resolve": "^16.0.1",
-    "@rollup/plugin-terser": "^0.4.4",
-    "@types/node": "^22.15.17",
-    "@types/semver": "^7.5.0",
-    "builtin-modules": "^5.0.0",
-    "esbuild": "^0.25.4",
-    "fixturez": "^1.1.0",
-    "husky": "^3.0.3",
-    "prettier": "^2.0.5",
-    "rollup": "^4.40.2",
-    "typescript": "^5.8.3",
-    "vitest": "^3.1.3"
-  },
   "scripts": {
-    "build": "rollup -c",
+    "build": "rolldown -c",
     "test": "vitest",
-    "test:watch": "yarn test --watch",
+    "test:watch": "pnpm test --watch",
     "typecheck": "tsc",
+    "format": "oxfmt --check",
+    "format:fix": "oxfmt",
     "changeset": "changeset",
     "bump": "node --experimental-strip-types ./scripts/bump.ts",
-    "release": "node --experimental-strip-types ./scripts/release.ts",
+    "release": "node --experimental-strip-types ./scripts/release.ts"
-    "release:pr": "node --experimental-strip-types ./scripts/release-pr.ts"
-  },
-  "engines": {
-    "node": ">= 24"
   },
   "dependencies": {
-    "@actions/core": "^1.11.1",
+    "@actions/core": "^3.0.1",
-    "@actions/exec": "^1.1.1",
+    "@actions/exec": "^3.0.0",
-    "@actions/github": "^6.0.1",
+    "@actions/github": "^9.1.1",
     "@changesets/ghcommit": "^2.0.1",
     "@changesets/pre": "^2.0.2",
     "@changesets/read": "^0.6.5",
     "@manypkg/get-packages": "^1.1.3",
-    "@octokit/core": "^5.2.1",
+    "@octokit/core": "^7.0.6",
-    "@octokit/plugin-throttling": "^8.0.0",
+    "@octokit/plugin-throttling": "^11.0.3",
     "@types/mdast": "^3.0.0",
     "mdast-util-to-string": "^1.0.6",
     "remark-parse": "^7.0.1",
@@ -53,13 +36,22 @@
     "semver": "^7.5.3",
     "unified": "^8.3.2"
   },
-  "husky": {
+  "devDependencies": {
-    "hooks": {}
+    "@changesets/changelog-github": "^0.5.1",
+    "@changesets/cli": "^2.29.3",
+    "@changesets/types": "^6.1.0",
+    "@changesets/write": "^0.4.0",
+    "@types/node": "^24.12.2",
+    "@types/semver": "^7.5.0",
+    "fs-fixture": "^2.13.0",
+    "oxfmt": "^0.48.0",
+    "pkg-pr-new": "^0.0.71",
+    "rolldown": "^1.0.1",
+    "typescript": "^5.8.3",
+    "vitest": "^4.1.6"
   },
-  "prettier": {},
+  "engines": {
-  "resolutions": {
+    "node": ">=24"
-    "trim": "^0.0.3",
-    "y18n": "^4.0.1"
   },
-  "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
+  "packageManager": "pnpm@11.1.1+sha512.d1fdf5f73c617b64fa1a56a81c3c8dfe0e966e33a6010aa256b517ae77be21d93e05affc0de1a83b0e4f29d569f68b446ae8f068cd7247c0bb3df0fb4d7bdf9a"
 }

pnpm-workspace.yaml

@@ -0,0 +1,17 @@
+blockExoticSubdeps: true
+dedupePeers: true
+dedupePeerDependents: true
+minimumReleaseAge: 10080
+minimumReleaseAgeExclude:
+  - '@oxc-project/*'
+  - '@rolldown/*'
+  - rolldown@1.0.1
+  - vite@8.0.13
+  - vitest@4.1.6
+
+overrides:
+  lightningcss: '-' # we do not bundle any css
+  postcss: '-' # we do not bundle any css
+
+shellEmulator: true
+trustPolicy: no-downgrade

rolldown.config.js

@@ -0,0 +1,13 @@
+import { defineConfig } from 'rolldown'
+
+export default defineConfig({
+  input: 'src/index.ts',
+  output: {
+    dir: 'dist',
+    format: 'esm',
+    cleanDir: true,
+    minify: true,
+    comments: false,
+  },
+  platform: 'node',
+})

rollup.config.js

@@ -1,38 +0,0 @@
-import { defineConfig } from "rollup";
-import commonjs from "@rollup/plugin-commonjs";
-import nodeResolve from "@rollup/plugin-node-resolve";
-import terser from "@rollup/plugin-terser";
-import json from "@rollup/plugin-json";
-import { transform } from "esbuild";
-import builtinModulesList from "builtin-modules";
-
-const builtinModules = new Set(builtinModulesList);
-
-export default defineConfig({
-  input: "src/index.ts",
-  output: {
-    dir: "dist",
-    format: "esm",
-  },
-  external: (id) => builtinModules.has(id),
-  plugins: [
-    nodeResolve({
-      preferBuiltins: false,
-    }),
-    json(),
-    commonjs(),
-    {
-      name: "esbuild",
-      async transform(code, id) {
-        if (!/\.(mts|cts|ts|tsx)$/.test(id)) {
-          return null;
-        }
-        const result = await transform(code, {
-          loader: "ts",
-        });
-        return result.code;
-      },
-    },
-    terser(),
-  ],
-});

scripts/bump.ts

@@ -1,6 +1,6 @@
-import { exec } from "@actions/exec";
 import fs from "node:fs";
 import path from "node:path";
+import { exec } from "@actions/exec";
 import pkgJson from "../package.json" with { type: "json" };
 
 process.chdir(path.join(import.meta.dirname, ".."));
@@ -13,6 +13,6 @@ const readmePath = path.join(import.meta.dirname, "..", "README.md");
 const content = fs.readFileSync(readmePath, "utf8");
 const updatedContent = content.replace(
   /changesets\/action@[^\s]+/g,
-  `changesets/action@${releaseLine}`
+  `changesets/action@${releaseLine}`,
 );
 fs.writeFileSync(readmePath, updatedContent);

scripts/release-pr.ts

@@ -1,20 +0,0 @@
-import { exec } from "@actions/exec";
-import path from "node:path";
-
-import pkgJson from "../package.json" with { type: "json" };
-
-const tag = `v${pkgJson.version}`;
-const releaseLine = "pr-release";
-
-process.chdir(path.join(import.meta.dirname, ".."));
-
-await exec("git", ["checkout", "--detach"]);
-await exec("git", ["add", "--force", "dist"]);
-await exec("git", ["commit", "-m", tag]);
-
-await exec("git", [
-  "push",
-  "--force",
-  "origin",
-  `HEAD:refs/heads/${releaseLine}`,
-]);

scripts/release.ts

@@ -1,6 +1,5 @@
-import { exec, getExecOutput } from "@actions/exec";
 import path from "node:path";
-
+import { exec, getExecOutput } from "@actions/exec";
 import pkgJson from "../package.json" with { type: "json" };
 
 const tag = `v${pkgJson.version}`;
@@ -14,11 +13,11 @@ process.chdir(path.join(import.meta.dirname, ".."));
     ["ls-remote", "--exit-code", "origin", "--tags", `refs/tags/${tag}`],
     {
       ignoreReturnCode: true,
-    }
+    },
   );
   if (exitCode === 0) {
     console.log(
-      `Action is not being published because version ${tag} is already published`
+      `Action is not being published because version ${tag} is already published`,
     );
     return;
   }

src/__snapshots__/run.test.ts.snap

@@ -1,5 +1,28 @@
 // Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
 
+exports[`version > creates a draft PR when prDraft is "create" 1`] = `
+[
+  {
+    "base": "some-branch",
+    "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
+
+
+# Releases
+## changesets-dev-simple-project-pkg-a@1.1.0
+
+### Minor Changes
+
+-   Awesome feature
+",
+    "draft": true,
+    "head": "changeset-release/some-branch",
+    "owner": "changesets",
+    "repo": "action",
+    "title": "Version Packages",
+  },
+]
+`;
+
 exports[`version > creates simple PR 1`] = `
 [
   {
@@ -8,7 +31,7 @@ exports[`version > creates simple PR 1`] = `
 
 
 # Releases
-## simple-project-pkg-a@1.1.0
+## changesets-dev-simple-project-pkg-a@1.1.0
 
 ### Minor Changes
 
@@ -17,14 +40,15 @@ exports[`version > creates simple PR 1`] = `
 ### Patch Changes
 
 -   Updated dependencies
-    -   simple-project-pkg-b@1.1.0
+    -   changesets-dev-simple-project-pkg-b@1.1.0
 
-## simple-project-pkg-b@1.1.0
+## changesets-dev-simple-project-pkg-b@1.1.0
 
 ### Minor Changes
 
 -   Awesome feature
 ",
+    "draft": false,
     "head": "changeset-release/some-branch",
     "owner": "changesets",
     "repo": "action",
@@ -43,6 +67,7 @@ exports[`version > does not include any release information if a message with si
 # Releases
 
 > All release information have been omitted from this message, as the content exceeds the size limit.",
+    "draft": false,
     "head": "changeset-release/some-branch",
     "owner": "changesets",
     "repo": "action",
@@ -62,9 +87,10 @@ exports[`version > does not include changelog entries if full message exceeds si
 
 > The changelog information of each package has been omitted from this message, as the content exceeds the size limit.
 
-## simple-project-pkg-a@1.1.0
+## changesets-dev-simple-project-pkg-a@1.1.0
 
 ",
+    "draft": false,
     "head": "changeset-release/some-branch",
     "owner": "changesets",
     "repo": "action",
@@ -81,12 +107,13 @@ exports[`version > doesn't include ignored package that got a dependency update
 
 
 # Releases
-## ignored-package-pkg-b@1.1.0
+## changesets-dev-ignored-package-pkg-b@1.1.0
 
 ### Minor Changes
 
 -   Awesome feature
 ",
+    "draft": false,
     "head": "changeset-release/some-branch",
     "owner": "changesets",
     "repo": "action",
@@ -103,12 +130,13 @@ exports[`version > only includes bumped packages in the PR body 1`] = `
 
 
 # Releases
-## simple-project-pkg-a@1.1.0
+## changesets-dev-simple-project-pkg-a@1.1.0
 
 ### Minor Changes
 
 -   Awesome feature
 ",
+    "draft": false,
     "head": "changeset-release/some-branch",
     "owner": "changesets",
     "repo": "action",
@@ -116,3 +144,94 @@ exports[`version > only includes bumped packages in the PR body 1`] = `
   },
 ]
 `;
+
+exports[`version > updates an existing PR via GraphQL and converts it to draft when prDraft is "always" 1`] = `
+[
+  "
+      mutation UpdatePullRequest(
+        $pullRequestId: ID!
+        $title: String!
+        $body: String!
+      ) {
+        
+        convertPullRequestToDraft(
+          input: {
+            pullRequestId: $pullRequestId
+          }
+        ) {
+          pullRequest {
+            id
+          }
+        }
+
+        updatePullRequest(
+          input: {
+            pullRequestId: $pullRequestId
+            title: $title
+            body: $body
+            state: OPEN
+          }
+        ) {
+          pullRequest {
+            id
+          }
+        }
+      }
+    ",
+  {
+    "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
+
+
+# Releases
+## changesets-dev-simple-project-pkg-a@1.1.0
+
+### Minor Changes
+
+-   Awesome feature
+",
+    "pullRequestId": "PR_kwDOA",
+    "title": "Version Packages",
+  },
+]
+`;
+
+exports[`version > updates an existing PR via GraphQL without converting it to draft when prDraft is "create" 1`] = `
+[
+  "
+      mutation UpdatePullRequest(
+        $pullRequestId: ID!
+        $title: String!
+        $body: String!
+      ) {
+        
+
+        updatePullRequest(
+          input: {
+            pullRequestId: $pullRequestId
+            title: $title
+            body: $body
+            state: OPEN
+          }
+        ) {
+          pullRequest {
+            id
+          }
+        }
+      }
+    ",
+  {
+    "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
+
+
+# Releases
+## changesets-dev-simple-project-pkg-a@1.1.0
+
+### Minor Changes
+
+-   Awesome feature
+",
+    "pullRequestId": "PR_kwDOA",
+    "title": "Version Packages",
+  },
+]
+`;

src/git.ts

@@ -14,7 +14,7 @@ const push = async (branch: string, options: GitOptions) => {
 
 const switchToMaybeExistingBranch = async (
   branch: string,
-  options: GitOptions
+  options: GitOptions,
 ) => {
   let { stderr } = await getExecOutput("git", ["checkout", branch], {
     ignoreReturnCode: true,
@@ -41,7 +41,7 @@ const checkIfClean = async (options: GitOptions): Promise<boolean> => {
   const { stdout } = await getExecOutput(
     "git",
     ["status", "--porcelain"],
-    options
+    options,
   );
   return !stdout.length;
 };
@@ -71,7 +71,7 @@ export class Git {
       ],
       {
         cwd: this.cwd,
-      }
+      },
     );
   }
 

src/index.ts

@@ -1,6 +1,6 @@
-import * as core from "@actions/core";
 import fs from "node:fs/promises";
 import path from "node:path";
+import * as core from "@actions/core";
 import { Git } from "./git.ts";
 import { setupOctokit } from "./octokit.ts";
 import readChangesetState from "./readChangesetState.ts";
@@ -24,10 +24,15 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
 
   const octokit = setupOctokit(githubToken);
   const commitMode = getOptionalInput("commitMode") ?? "git-cli";
+  const prDraft = getOptionalInput("prDraft");
   if (commitMode !== "git-cli" && commitMode !== "github-api") {
     core.setFailed(`Invalid commit mode: ${commitMode}`);
     return;
   }
+  if (prDraft !== undefined && prDraft !== "always" && prDraft !== "create") {
+    core.setFailed(`Invalid prDraft: ${prDraft}`);
+    return;
+  }
   const git = new Git({
     octokit: commitMode === "github-api" ? octokit : undefined,
     cwd,
@@ -43,7 +48,7 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
   core.info("setting GitHub credentials");
   await fs.writeFile(
     `${process.env.HOME}/.netrc`,
-    `machine github.com\nlogin github-actions[bot]\npassword ${githubToken}`
+    `machine github.com\nlogin github-actions[bot]\npassword ${githubToken}`,
   );
 
   let { changesets } = await readChangesetState(cwd);
@@ -51,7 +56,7 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
   let publishScript = core.getInput("publish");
   let hasChangesets = changesets.length !== 0;
   const hasNonEmptyChangesets = changesets.some(
-    (changeset) => changeset.releases.length > 0
+    (changeset) => changeset.releases.length > 0,
   );
   let hasPublishScript = !!publishScript;
 
@@ -62,12 +67,12 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
   switch (true) {
     case !hasChangesets && !hasPublishScript:
       core.info(
-        "No changesets present or were removed by merging release PR. Not publishing because no publish script found."
+        "No changesets present or were removed by merging release PR. Not publishing because no publish script found.",
       );
       return;
     case !hasChangesets && hasPublishScript: {
       core.info(
-        "No changesets found. Attempting to publish any unpublished packages to npm"
+        "No changesets found. Attempting to publish any unpublished packages to npm",
       );
 
       if (process.env.NPM_TOKEN) {
@@ -82,24 +87,24 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
           });
           if (authLine) {
             core.info(
-              "Found existing auth token for the npm registry in the user .npmrc file"
+              "Found existing auth token for the npm registry in the user .npmrc file",
             );
           } else {
             core.info(
-              "Didn't find existing auth token for the npm registry in the user .npmrc file, creating one"
+              "Didn't find existing auth token for the npm registry in the user .npmrc file, creating one",
             );
             await fs.appendFile(
               userNpmrcPath,
-              `\n//registry.npmjs.org/:_authToken=${process.env.NPM_TOKEN}\n`
+              `\n//registry.npmjs.org/:_authToken=${process.env.NPM_TOKEN}\n`,
             );
           }
         } else {
           core.info(
-            "No user .npmrc file found, creating one with NPM_TOKEN used as auth token"
+            "No user .npmrc file found, creating one with NPM_TOKEN used as auth token",
           );
           await fs.writeFile(
             userNpmrcPath,
-            `//registry.npmjs.org/:_authToken=${process.env.NPM_TOKEN}\n`
+            `//registry.npmjs.org/:_authToken=${process.env.NPM_TOKEN}\n`,
           );
         }
       } else if (
@@ -107,11 +112,11 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
         process.env.ACTIONS_ID_TOKEN_REQUEST_URL
       ) {
         core.info(
-          "No NPM_TOKEN found, but OIDC is available - using npm trusted publishing"
+          "No NPM_TOKEN found, but OIDC is available - using npm trusted publishing",
         );
       } else {
         core.info(
-          "No NPM_TOKEN or OIDC available - assuming npm is already authenticated"
+          "No NPM_TOKEN or OIDC available - assuming npm is already authenticated",
         );
       }
 
@@ -128,7 +133,7 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
         core.setOutput("published", "true");
         core.setOutput(
           "publishedPackages",
-          JSON.stringify(result.publishedPackages)
+          JSON.stringify(result.publishedPackages),
         );
       }
       return;
@@ -147,6 +152,7 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
         prTitle: getOptionalInput("title"),
         commitMessage: getOptionalInput("commit"),
         hasPublishScript,
+        prDraft,
         branch: getOptionalInput("branch"),
       });
 

src/octokit.ts

@@ -9,7 +9,7 @@ export const setupOctokit = (githubToken: string) => {
       throttle: {
         onRateLimit: (retryAfter, options: any, octokit, retryCount) => {
           core.warning(
-            `Request quota exhausted for request ${options.method} ${options.url}`
+            `Request quota exhausted for request ${options.method} ${options.url}`,
           );
 
           if (retryCount <= 2) {
@@ -21,10 +21,10 @@ export const setupOctokit = (githubToken: string) => {
           retryAfter,
           options: any,
           octokit,
-          retryCount
+          retryCount,
         ) => {
           core.warning(
-            `SecondaryRateLimit detected for request ${options.method} ${options.url}`
+            `SecondaryRateLimit detected for request ${options.method} ${options.url}`,
           );
 
           if (retryCount <= 2) {
@@ -34,7 +34,7 @@ export const setupOctokit = (githubToken: string) => {
         },
       },
     },
-    throttling
+    throttling,
   );
 };
 

src/readChangesetState.ts

@@ -1,6 +1,6 @@
-import type { PreState, NewChangeset } from "@changesets/types";
 import { readPreState } from "@changesets/pre";
 import readChangesets from "@changesets/read";
+import type { PreState, NewChangeset } from "@changesets/types";
 
 export type ChangesetState = {
   preState: PreState | undefined;
@@ -8,7 +8,7 @@ export type ChangesetState = {
 };
 
 export default async function readChangesetState(
-  cwd: string = process.cwd()
+  cwd: string = process.cwd(),
 ): Promise<ChangesetState> {
   let preState = await readPreState(cwd);
   let changesets = await readChangesets(cwd);

src/run.test.ts

@@ -1,8 +1,7 @@
+import path from "node:path";
 import type { Changeset } from "@changesets/types";
 import writeChangeset from "@changesets/write";
-import fixturez from "fixturez";
+import { createFixture } from "fs-fixture";
-import fs from "node:fs/promises";
-import path from "node:path";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import { Git } from "./git.ts";
 import { setupOctokit } from "./octokit.ts";
@@ -19,6 +18,7 @@ vi.mock("@actions/github", () => ({
   },
   getOctokit: () => ({
     rest: mockedGithubMethods,
+    graphql: mockedGraphql,
   }),
 }));
 vi.mock("./git.ts");
@@ -33,15 +33,60 @@ let mockedGithubMethods = {
     createRelease: vi.fn(),
   },
 };
+let mockedGraphql = vi.fn();
 
-let f = fixturez(import.meta.dirname);
+const nodeModulesDir = path.join(import.meta.dirname, "..", "node_modules");
+
+function createSimpleProjectFixture() {
+  return createFixture({
+    node_modules: (api) => api.symlink(nodeModulesDir),
+    ".changeset/config.json": JSON.stringify({}),
+    "packages/pkg-a/package.json": JSON.stringify({
+      name: "changesets-dev-simple-project-pkg-a",
+      version: "1.0.0",
+      dependencies: {
+        "changesets-dev-simple-project-pkg-b": "1.0.0",
+      },
+    }),
+    "packages/pkg-b/package.json": JSON.stringify({
+      name: "changesets-dev-simple-project-pkg-b",
+      version: "1.0.0",
+    }),
+    "package.json": JSON.stringify({
+      name: "simple-project",
+      version: "1.0.0",
+      private: true,
+      workspaces: ["packages/*"],
+    }),
+  });
+}
+
+function createIgnoredPackageFixture() {
+  return createFixture({
+    node_modules: (api) => api.symlink(nodeModulesDir),
+    ".changeset/config.json": JSON.stringify({
+      ignore: ["changesets-dev-ignored-package-pkg-a"],
+    }),
+    "packages/pkg-a/package.json": JSON.stringify({
+      name: "changesets-dev-ignored-package-pkg-a",
+      version: "1.0.0",
+      dependencies: {
+        "changesets-dev-ignored-package-pkg-b": "1.0.0",
+      },
+    }),
+    "packages/pkg-b/package.json": JSON.stringify({
+      name: "changesets-dev-ignored-package-pkg-b",
+      version: "1.0.0",
+    }),
+    "package.json": JSON.stringify({
+      name: "ignored-package",
+      version: "1.0.0",
+      private: true,
+      workspaces: ["packages/*"],
+    }),
+  });
+}
 
-const linkNodeModules = async (cwd: string) => {
-  await fs.symlink(
-    path.join(import.meta.dirname, "..", "node_modules"),
-    path.join(cwd, "node_modules")
-  );
-};
 const writeChangesets = (changesets: Changeset[], cwd: string) => {
   return Promise.all(changesets.map((commit) => writeChangeset(commit, cwd)));
 };
@@ -52,8 +97,8 @@ beforeEach(() => {
 
 describe("version", () => {
   it("creates simple PR", async () => {
-    let cwd = f.copy("simple-project");
+    await using fixture = await createSimpleProjectFixture();
-    await linkNodeModules(cwd);
+    const cwd = fixture.path;
 
     mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({ data: [] }));
 
@@ -66,18 +111,18 @@ describe("version", () => {
         {
           releases: [
             {
-              name: "simple-project-pkg-a",
+              name: "changesets-dev-simple-project-pkg-a",
               type: "minor",
             },
             {
-              name: "simple-project-pkg-b",
+              name: "changesets-dev-simple-project-pkg-b",
               type: "minor",
             },
           ],
           summary: "Awesome feature",
         },
       ],
-      cwd
+      cwd,
     );
 
     await runVersion({
@@ -90,9 +135,9 @@ describe("version", () => {
     expect(mockedGithubMethods.pulls.create.mock.calls[0]).toMatchSnapshot();
   });
 
-  it("only includes bumped packages in the PR body", async () => {
+  it('creates a draft PR when prDraft is "create"', async () => {
-    let cwd = f.copy("simple-project");
+    await using fixture = await createSimpleProjectFixture();
-    await linkNodeModules(cwd);
+    const cwd = fixture.path;
 
     mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({ data: [] }));
 
@@ -105,14 +150,50 @@ describe("version", () => {
         {
           releases: [
             {
-              name: "simple-project-pkg-a",
+              name: "changesets-dev-simple-project-pkg-a",
               type: "minor",
             },
           ],
           summary: "Awesome feature",
         },
       ],
-      cwd
+      cwd,
+    );
+
+    await runVersion({
+      octokit: setupOctokit("@@GITHUB_TOKEN"),
+      githubToken: "@@GITHUB_TOKEN",
+      git: new Git({ cwd }),
+      cwd,
+      prDraft: "create",
+    });
+
+    expect(mockedGithubMethods.pulls.create.mock.calls[0]).toMatchSnapshot();
+  });
+
+  it("only includes bumped packages in the PR body", async () => {
+    await using fixture = await createSimpleProjectFixture();
+    const cwd = fixture.path;
+
+    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({ data: [] }));
+
+    mockedGithubMethods.pulls.create.mockImplementationOnce(() => ({
+      data: { number: 123 },
+    }));
+
+    await writeChangesets(
+      [
+        {
+          releases: [
+            {
+              name: "changesets-dev-simple-project-pkg-a",
+              type: "minor",
+            },
+          ],
+          summary: "Awesome feature",
+        },
+      ],
+      cwd,
     );
 
     await runVersion({
@@ -126,8 +207,8 @@ describe("version", () => {
   });
 
   it("doesn't include ignored package that got a dependency update in the PR body", async () => {
-    let cwd = f.copy("ignored-package");
+    await using fixture = await createIgnoredPackageFixture();
-    await linkNodeModules(cwd);
+    const cwd = fixture.path;
 
     mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({ data: [] }));
 
@@ -140,14 +221,14 @@ describe("version", () => {
         {
           releases: [
             {
-              name: "ignored-package-pkg-b",
+              name: "changesets-dev-ignored-package-pkg-b",
               type: "minor",
             },
           ],
           summary: "Awesome feature",
         },
       ],
-      cwd
+      cwd,
     );
 
     await runVersion({
@@ -161,8 +242,8 @@ describe("version", () => {
   });
 
   it("does not include changelog entries if full message exceeds size limit", async () => {
-    let cwd = f.copy("simple-project");
+    await using fixture = await createSimpleProjectFixture();
-    await linkNodeModules(cwd);
+    const cwd = fixture.path;
 
     mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({ data: [] }));
 
@@ -175,7 +256,7 @@ describe("version", () => {
         {
           releases: [
             {
-              name: "simple-project-pkg-a",
+              name: "changesets-dev-simple-project-pkg-a",
               type: "minor",
             },
           ],
@@ -202,7 +283,7 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
 `,
         },
       ],
-      cwd
+      cwd,
     );
 
     await runVersion({
@@ -215,13 +296,13 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
 
     expect(mockedGithubMethods.pulls.create.mock.calls[0]).toMatchSnapshot();
     expect(mockedGithubMethods.pulls.create.mock.calls[0][0].body).toMatch(
-      /The changelog information of each package has been omitted from this message/
+      /The changelog information of each package has been omitted from this message/,
     );
   });
 
   it("does not include any release information if a message with simplified release info exceeds size limit", async () => {
-    let cwd = f.copy("simple-project");
+    await using fixture = await createSimpleProjectFixture();
-    await linkNodeModules(cwd);
+    const cwd = fixture.path;
 
     mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({ data: [] }));
 
@@ -234,7 +315,7 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
         {
           releases: [
             {
-              name: "simple-project-pkg-a",
+              name: "changesets-dev-simple-project-pkg-a",
               type: "minor",
             },
           ],
@@ -261,7 +342,7 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
 `,
         },
       ],
-      cwd
+      cwd,
     );
 
     await runVersion({
@@ -274,7 +355,75 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
 
     expect(mockedGithubMethods.pulls.create.mock.calls[0]).toMatchSnapshot();
     expect(mockedGithubMethods.pulls.create.mock.calls[0][0].body).toMatch(
-      /All release information have been omitted from this message, as the content exceeds the size limit/
+      /All release information have been omitted from this message, as the content exceeds the size limit/,
     );
   });
+
+  it('updates an existing PR via GraphQL without converting it to draft when prDraft is "create"', async () => {
+    await using fixture = await createSimpleProjectFixture();
+    const cwd = fixture.path;
+
+    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({
+      data: [{ number: 123, node_id: "PR_kwDOA" }],
+    }));
+
+    await writeChangesets(
+      [
+        {
+          releases: [
+            {
+              name: "changesets-dev-simple-project-pkg-a",
+              type: "minor",
+            },
+          ],
+          summary: "Awesome feature",
+        },
+      ],
+      cwd,
+    );
+
+    await runVersion({
+      octokit: setupOctokit("@@GITHUB_TOKEN"),
+      githubToken: "@@GITHUB_TOKEN",
+      git: new Git({ cwd }),
+      cwd,
+      prDraft: "create",
+    });
+
+    expect(mockedGraphql.mock.calls[0]).toMatchSnapshot();
+  });
+
+  it('updates an existing PR via GraphQL and converts it to draft when prDraft is "always"', async () => {
+    await using fixture = await createSimpleProjectFixture();
+    const cwd = fixture.path;
+
+    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({
+      data: [{ number: 123, node_id: "PR_kwDOA" }],
+    }));
+
+    await writeChangesets(
+      [
+        {
+          releases: [
+            {
+              name: "changesets-dev-simple-project-pkg-a",
+              type: "minor",
+            },
+          ],
+          summary: "Awesome feature",
+        },
+      ],
+      cwd,
+    );
+
+    await runVersion({
+      octokit: setupOctokit("@@GITHUB_TOKEN"),
+      githubToken: "@@GITHUB_TOKEN",
+      git: new Git({ cwd }),
+      cwd,
+      prDraft: "always",
+    });
+
+    expect(mockedGraphql.mock.calls[0]).toMatchSnapshot();
+  });
 });

src/run.ts

@@ -1,11 +1,11 @@
+import fs from "node:fs/promises";
+import { createRequire } from "node:module";
+import path from "node:path";
 import * as core from "@actions/core";
 import { exec, getExecOutput } from "@actions/exec";
 import * as github from "@actions/github";
 import type { PreState } from "@changesets/types";
 import { type Package, getPackages } from "@manypkg/get-packages";
-import fs from "node:fs/promises";
-import { createRequire } from "node:module";
-import path from "node:path";
 import semverLt from "semver/functions/lt.js";
 import { Git } from "./git.ts";
 import type { Octokit } from "./octokit.ts";
@@ -28,7 +28,7 @@ const MAX_CHARACTERS_PER_MESSAGE = 60000;
 
 const createRelease = async (
   octokit: Octokit,
-  { pkg, tagName }: { pkg: Package; tagName: string }
+  { pkg, tagName }: { pkg: Package; tagName: string },
 ) => {
   let changelog;
   try {
@@ -45,7 +45,7 @@ const createRelease = async (
     // we can find a changelog but not the entry for this version
     // if this is true, something has probably gone wrong
     throw new Error(
-      `Could not find changelog entry for ${pkg.packageJson.name}@${pkg.packageJson.version}`
+      `Could not find changelog entry for ${pkg.packageJson.name}@${pkg.packageJson.version}`,
     );
   }
 
@@ -91,7 +91,7 @@ export async function runPublish({
   let changesetPublishOutput = await getExecOutput(
     publishCommand,
     publishArgs,
-    { cwd, env: { ...process.env, GITHUB_TOKEN: githubToken } }
+    { cwd, env: { ...process.env, GITHUB_TOKEN: githubToken } },
   );
 
   let { packages, tool } = await getPackages(cwd);
@@ -111,7 +111,7 @@ export async function runPublish({
       if (pkg === undefined) {
         throw new Error(
           `Package "${pkgName}" not found.` +
-            "This is probably a bug in the action, please open an issue"
+            "This is probably a bug in the action, please open an issue",
         );
       }
       releasedPackages.push(pkg);
@@ -123,14 +123,14 @@ export async function runPublish({
           const tagName = `${pkg.packageJson.name}@${pkg.packageJson.version}`;
           await git.pushTag(tagName);
           await createRelease(octokit, { pkg, tagName });
-        })
+        }),
       );
     }
   } else {
     if (packages.length === 0) {
       throw new Error(
         `No package found.` +
-          "This is probably a bug in the action, please open an issue"
+          "This is probably a bug in the action, please open an issue",
       );
     }
     let pkg = packages[0];
@@ -166,14 +166,16 @@ export async function runPublish({
 
 const requireChangesetsCliPkgJson = (cwd: string) => {
   try {
-    return require(require.resolve("@changesets/cli/package.json", {
+    return require(
-      paths: [cwd],
+      require.resolve("@changesets/cli/package.json", {
-    }));
+        paths: [cwd],
+      }),
+    );
   } catch (err) {
     if (isErrorWithCode(err, "MODULE_NOT_FOUND")) {
       throw new Error(
         `Have you forgotten to install \`@changesets/cli\` in "${cwd}"?`,
-        { cause: err }
+        { cause: err },
       );
     }
     throw err;
@@ -259,6 +261,7 @@ type VersionOptions = {
   commitMessage?: string;
   hasPublishScript?: boolean;
   prBodyMaxCharacters?: number;
+  prDraft?: "always" | "create";
   branch?: string;
 };
 
@@ -277,6 +280,7 @@ export async function runVersion({
   hasPublishScript = false,
   prBodyMaxCharacters = MAX_CHARACTERS_PER_MESSAGE,
   branch = github.context.ref.replace("refs/heads/", ""),
+  prDraft,
 }: VersionOptions): Promise<RunVersionResult> {
   let versionBranch = `changeset-release/${branch}`;
 
@@ -307,7 +311,7 @@ export async function runVersion({
       {
         cwd,
         env,
-      }
+      },
     );
   }
 
@@ -316,7 +320,7 @@ export async function runVersion({
     changedPackages.map(async (pkg) => {
       let changelogContents = await fs.readFile(
         path.join(pkg.dir, "CHANGELOG.md"),
-        "utf8"
+        "utf8",
       );
 
       let entry = getChangelogEntry(changelogContents, pkg.packageJson.version);
@@ -326,7 +330,7 @@ export async function runVersion({
         content: entry.content,
         header: `## ${pkg.packageJson.name}@${pkg.packageJson.version}`,
       };
-    })
+    }),
   );
 
   const finalPrTitle = `${prTitle}${!!preState ? ` (${preState.tag})` : ""}`;
@@ -351,8 +355,8 @@ export async function runVersion({
     `Existing pull requests: ${JSON.stringify(
       existingPullRequests.data,
       null,
-      2
+      2,
-    )}`
+    )}`,
   );
 
   await git.pushChanges({ branch: versionBranch, message: finalCommitMessage });
@@ -376,6 +380,7 @@ export async function runVersion({
       head: versionBranch,
       title: finalPrTitle,
       body: prBody,
+      draft: prDraft !== undefined,
       ...github.context.repo,
     });
 
@@ -386,12 +391,46 @@ export async function runVersion({
     const [pullRequest] = existingPullRequests.data;
 
     core.info(`updating found pull request #${pullRequest.number}`);
-    await octokit.rest.pulls.update({
+    const convertPullRequestToDraftMutation =
-      pull_number: pullRequest.number,
+      prDraft === "always"
+        ? `
+        convertPullRequestToDraft(
+          input: {
+            pullRequestId: $pullRequestId
+          }
+        ) {
+          pullRequest {
+            id
+          }
+        }`
+        : "";
+    const updatePullRequestMutation = `
+      mutation UpdatePullRequest(
+        $pullRequestId: ID!
+        $title: String!
+        $body: String!
+      ) {
+        ${convertPullRequestToDraftMutation}
+
+        updatePullRequest(
+          input: {
+            pullRequestId: $pullRequestId
+            title: $title
+            body: $body
+            state: OPEN
+          }
+        ) {
+          pullRequest {
+            id
+          }
+        }
+      }
+    `;
+
+    await octokit.graphql(updatePullRequestMutation, {
+      pullRequestId: pullRequest.node_id,
       title: finalPrTitle,
       body: prBody,
-      ...github.context.repo,
-      state: "open",
     });
 
     return {

src/utils.ts

@@ -1,11 +1,11 @@
-import unified from "unified";
-import remarkParse from "remark-parse";
-import remarkStringify from "remark-stringify";
 import fs from "node:fs/promises";
+import { getPackages, type Package } from "@manypkg/get-packages";
 import type { Root } from "mdast";
 // @ts-ignore
 import mdastToString from "mdast-util-to-string";
-import { getPackages, type Package } from "@manypkg/get-packages";
+import remarkParse from "remark-parse";
+import remarkStringify from "remark-stringify";
+import unified from "unified";
 
 export const BumpLevels = {
   dep: 0,
@@ -21,7 +21,7 @@ export async function getVersionsByDirectory(cwd: string) {
 
 export async function getChangedPackages(
   cwd: string,
-  previousVersions: Map<string, string>
+  previousVersions: Map<string, string>,
 ) {
   let { packages } = await getPackages(cwd);
   let changedPackages = new Set<Package>();
@@ -87,7 +87,7 @@ export function getChangelogEntry(changelog: string, version: string) {
 
 export function sortTheThings(
   a: { private: boolean; highestLevel: number },
-  b: { private: boolean; highestLevel: number }
+  b: { private: boolean; highestLevel: number },
 ) {
   if (a.private === b.private) {
     return b.highestLevel - a.highestLevel;
@@ -110,6 +110,6 @@ export function isErrorWithCode(err: unknown, code: string) {
 export function fileExists(filePath: string) {
   return fs.access(filePath, fs.constants.F_OK).then(
     () => true,
-    () => false
+    () => false,
   );
 }

types/fixturez.d.ts

@@ -1,17 +0,0 @@
-type Opts = {
-  glob?: string | Array<string>;
-  root?: string;
-  cleanup?: boolean;
-};
-
-declare module "fixturez" {
-  export default function (
-    cwd: string,
-    opts?: Opts
-  ): {
-    find: (a: string) => string;
-    temp: () => string;
-    copy: (a: string) => string;
-    cleanup: () => any;
-  };
-}