v1.9.0

.changeset/config.json

@@ -2,14 +2,12 @@
   "$schema": "https://unpkg.com/@changesets/config@1.6.2/schema.json",
   "changelog": [
     "@changesets/changelog-github",
-    {
+    { "repo": "changesets/action" }
-      "repo": "changesets/action"
-    }
   ],
   "commit": false,
   "linked": [],
   "access": "restricted",
-  "baseBranch": "maintenance/v1",
+  "baseBranch": "main",
   "updateInternalDependencies": "patch",
   "ignore": []
 }

.github/dependabot.yml

@@ -1,32 +1,13 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
 version: 2
 updates:
-  - package-ecosystem: "npm"
+  - package-ecosystem: "npm" # See documentation for possible values
-    directory: "/"
+    directory: "/" # Location of package manifests
     schedule:
-      interval: "monthly"
+      interval: "weekly"
     cooldown:
       default-days: 7
-    open-pull-requests-limit: 10
-    versioning-strategy: increase
-    groups:
-      production-dependencies:
-        dependency-type: "production"
-        update-types:
-          - minor
-          - patch
-      development-dependencies:
-        dependency-type: "development"
-        update-types:
-          - minor
-          - patch
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "monthly"
-    cooldown:
-      default-days: 7
-    open-pull-requests-limit: 5
-    groups:
-      github-actions:
-        patterns:
-          - "*"

.github/workflows/ci.yml

@@ -7,9 +7,6 @@ on:
   merge_group:
     branches:
       - main
-      - next
-      # merge group rulesets don't allow wildcards so in settings each maintenance branch needs to be added separately
-      - "maintenance/v*" # branch rulesets don't support v[0-9]+
 
 permissions:
   contents: read
@@ -27,12 +24,12 @@ jobs:
       security-events: write # allow writing security events
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
         with:
           persona: pedantic
           annotations: true
@@ -40,11 +37,12 @@ jobs:
 
   test:
     name: Test
-    runs-on: ubuntu-latest
     timeout-minutes: 20
+    runs-on: ubuntu-latest
+
     steps:
       - name: Check out repo
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -55,11 +53,12 @@ jobs:
 
   typecheck:
     name: Typecheck
-    runs-on: ubuntu-latest
     timeout-minutes: 20
+    runs-on: ubuntu-latest
+
     steps:
       - name: Check out repo
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -70,11 +69,12 @@ jobs:
 
   lint:
     name: Lint
-    runs-on: ubuntu-latest
     timeout-minutes: 20
+    runs-on: ubuntu-latest
+
     steps:
       - name: Check out repo
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 

.github/workflows/publish.yml

@@ -4,8 +4,6 @@ on:
   push:
     branches:
       - main
-      - next
-      - "maintenance/v*" # branch rulesets don't support v[0-9]+
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -23,10 +21,12 @@ jobs:
     outputs:
       hasChangesets: ${{ steps.changesets.outputs.hasChangesets }}
     permissions:
-      contents: read # to check out repo (actions/checkout)
+      contents: write # to create release (changesets/action)
+      issues: write # to post issue comments (changesets/action)
+      pull-requests: write # to create pull request (changesets/action)
     steps:
       - name: Check out repo
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -37,13 +37,11 @@ jobs:
       - name: Build
         run: pnpm build
 
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
         id: app-token
         with:
           client-id: ${{ vars.APP_CLIENT_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
-          permission-contents: write # to create version commits (changesets/action)
-          permission-pull-requests: write # to create pull request (changesets/action)
 
       - name: Create or update release pull request
         id: changesets
@@ -62,17 +60,17 @@ jobs:
     permissions:
       contents: write # to create release and have it authored by github-actions (changesets/action)
     steps:
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
         id: app-token
         with:
           client-id: ${{ vars.APP_CLIENT_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
-          permission-contents: write # to bypass branch and tag protection rules (release.ts)
 
       - name: Check out repo
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          persist-credentials: false
+          persist-credentials: true
+          # we need this token to bypass the branch and tag protection rules
           token: ${{ steps.app-token.outputs.token }}
 
       - uses: ./.github/actions/ci-setup

.github/workflows/release-pr.yml

@@ -123,7 +123,7 @@ jobs:
 
     steps:
       - name: Check out repo
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 

dist/pr-comment.js

@@ -0,0 +1 @@
+import{a as e,c as t,n,o as r,s as i,t as a}from"./github-DTObde6f.js";try{await o()}catch(e){i(e.message)}async function o(){let i=a.payload.pull_request;if(!i)throw Error("This action should only be run on `pull_request_target` or `pull_request` events");let o=e(`github-token`,{required:!0}),c=e(`body`,{required:!0}),l=e(`update-id`),u=l?s(l):null,d=u?`${u}\n\n${c}`:c,f={repo:i.base.repo.name,owner:i.base.repo.owner.login,issue_number:i.number,body:d},p=n(o),m;u&&(r(`Checking for existing comment...`),m=await p.rest.issues.listComments({repo:i.base.repo.name,owner:i.base.repo.owner.login,issue_number:i.number}).then(e=>e.data.find(e=>e.body?.includes(u))?.id)),m?(r(`Updating existing comment (id: ${m})...`),await p.rest.issues.updateComment({...f,comment_id:m}),t(`comment-id`,m)):(r(`Creating new comment...`),t(`comment-id`,(await p.rest.issues.createComment(f)).data.id)),r(`Done!`)}function s(e){let t=`changesets-action-pr-comment`;return t===e?`<!-- ${t} -->`:`<!-- ${t}:${e} -->`}export{};

package.json

@@ -30,8 +30,8 @@
     "@octokit/plugin-throttling": "^11.0.3",
     "human-id": "^4.1.3",
     "markdown-table": "^3.0.4",
-    "semver": "^7.8.1",
+    "semver": "^7.8.0",
-    "tinyexec": "^1.2.4"
+    "tinyexec": "^1.1.2"
   },
   "devDependencies": {
     "@changesets/changelog-github": "^0.7.0",

pnpm-lock.yaml

@@ -53,11 +53,11 @@ importers:
         specifier: ^3.0.4
         version: 3.0.4
       semver:
-        specifier: ^7.8.1
+        specifier: ^7.8.0
-        version: 7.8.1
+        version: 7.8.0
       tinyexec:
-        specifier: ^1.2.4
+        specifier: ^1.1.2
-        version: 1.2.4
+        version: 1.1.2
     devDependencies:
       '@changesets/changelog-github':
         specifier: ^0.7.0
@@ -1046,8 +1046,8 @@ packages:
   safer-buffer@2.1.2:
     resolution: {integrity: sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==}
 
-  semver@7.8.1:
+  semver@7.8.0:
-    resolution: {integrity: sha512-rkVq3IXh+4FDGch+KwzX3aV9W3kO54GyEgpvBzSyctDA6Xtd7RJQV1xmXbeQp5v7+VzLOfVqiutSE6GICgPFvg==}
+    resolution: {integrity: sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==}
     engines: {node: '>=10'}
     hasBin: true
 
@@ -1115,18 +1115,14 @@ packages:
   tinybench@2.9.0:
     resolution: {integrity: sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==}
 
-  tinyexec@1.2.4:
+  tinyexec@1.1.2:
-    resolution: {integrity: sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==}
+    resolution: {integrity: sha512-dAqSqE/RabpBKI8+h26GfLq6Vb3JVXs30XYQjdMjaj/c2tS8IYYMbIzP599KtRj7c57/wYApb3QjgRgXmrCukA==}
     engines: {node: '>=18'}
 
   tinyglobby@0.2.16:
     resolution: {integrity: sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==}
     engines: {node: '>=12.0.0'}
 
-  tinyglobby@0.2.17:
-    resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
-    engines: {node: '>=12.0.0'}
-
   tinypool@2.1.0:
     resolution: {integrity: sha512-Pugqs6M0m7Lv1I7FtxN4aoyToKg1C4tu+/381vH35y8oENM/Ai7f7C4StcoK4/+BSw9ebcS8jRiVrORFKCALLw==}
     engines: {node: ^20.0.0 || >=22.0.0}
@@ -1332,7 +1328,7 @@ snapshots:
       outdent: 0.5.0
       prettier: 2.8.8
       resolve-from: 5.0.0
-      semver: 7.8.1
+      semver: 7.8.0
 
   '@changesets/assemble-release-plan@6.0.10':
     dependencies:
@@ -1341,7 +1337,7 @@ snapshots:
       '@changesets/should-skip-package': 0.1.2
       '@changesets/types': 6.1.0
       '@manypkg/get-packages': 1.1.3
-      semver: 7.8.1
+      semver: 7.8.0
 
   '@changesets/changelog-git@0.2.1':
     dependencies:
@@ -1380,7 +1376,7 @@ snapshots:
       package-manager-detector: 0.2.11
       picocolors: 1.1.1
       resolve-from: 5.0.0
-      semver: 7.8.1
+      semver: 7.8.0
       spawndamnit: 3.0.1
       term-size: 2.2.1
     transitivePeerDependencies:
@@ -1406,7 +1402,7 @@ snapshots:
       '@changesets/types': 6.1.0
       '@manypkg/get-packages': 1.1.3
       picocolors: 1.1.1
-      semver: 7.8.1
+      semver: 7.8.0
 
   '@changesets/get-github-info@0.8.0':
     dependencies:
@@ -2238,7 +2234,7 @@ snapshots:
 
   safer-buffer@2.1.2: {}
 
-  semver@7.8.1: {}
+  semver@7.8.0: {}
 
   set-function-length@1.2.2:
     dependencies:
@@ -2300,18 +2296,13 @@ snapshots:
 
   tinybench@2.9.0: {}
 
-  tinyexec@1.2.4: {}
+  tinyexec@1.1.2: {}
 
   tinyglobby@0.2.16:
     dependencies:
       fdir: 6.5.0(picomatch@4.0.4)
       picomatch: 4.0.4
 
-  tinyglobby@0.2.17:
-    dependencies:
-      fdir: 6.5.0(picomatch@4.0.4)
-      picomatch: 4.0.4
-
   tinypool@2.1.0: {}
 
   tinyrainbow@3.1.0: {}
@@ -2353,7 +2344,7 @@ snapshots:
     dependencies:
       picomatch: 4.0.4
       rolldown: 1.0.1
-      tinyglobby: 0.2.17
+      tinyglobby: 0.2.16
     optionalDependencies:
       '@types/node': 24.12.4
       fsevents: 2.3.3
@@ -2375,7 +2366,7 @@ snapshots:
       picomatch: 4.0.4
       std-env: 4.1.0
       tinybench: 2.9.0
-      tinyexec: 1.2.4
+      tinyexec: 1.1.2
       tinyglobby: 0.2.16
       tinyrainbow: 3.1.0
       vite: 8.0.13(@types/node@24.12.4)

pr-status/README.md

@@ -2,18 +2,7 @@
 
 This action generates the changesets status in PRs, e.g. whether it has changeset files and which packages will be released if the PR is merged.
 
-It requires the repo to be checked out, and automatically fetches the PR head ref into a temporary detached worktree in order to infer the changed files and packages.
+It requires the repo to be checked out, and automatically fetches the PR head ref into a temporary detached worktree in order to infer the changed files and packages. It also requires the [`pull_request_target`](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target) event to be triggered in order to have permissions to comment on the PR and to work in PRs from forks.
-
-See the [action metadata](action.yml) for details on the inputs and outputs.
-
-> [!CAUTION]
-> **This action uses `pull_request_target` by default to support PRs from forks.**
->
-> **Do not run untrusted code** when using the `pull_request_target` event.
->
-> The example below only **_checks out_** and **_reads_** code, and does not **_execute_** any code from the fork.
->
-> Read more about the `pull_request_target` event in the [GitHub documentation](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target).
 
 You can also use the [`pull_request`](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request) event if you prefer to lock permissions down and not run for PRs from forks. Make sure to add an if check to prevent the action from failing in fork PRs:
 
@@ -24,7 +13,10 @@ jobs:
     # ...
 ```
 
-You can also use the [Changesets Bot](https://github.com/apps/changeset-bot) if you don't want an extra action in your repo, or are worried about the `pull_request_target` event.
+See the [action metadata](action.yml) for details on the inputs and outputs.
+
+> [!WARNING]
+> **Do not run untrusted code** when using the `pull_request_target` event. The example below only checks out code and does not run any code from the PR. Read more about the `pull_request_target` event in the [GitHub documentation](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target).
 
 ## Example setup
 
@@ -35,8 +27,6 @@ name: Comment Changesets status in PRs
 on:
   pull_request_target:
 
-permissions: {} # require explicitly stating all permissions in each job
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true

scripts/release.ts

@@ -4,7 +4,6 @@ import pkgJson from "../package.json" with { type: "json" };
 
 const tag = `v${pkgJson.version}`;
 const releaseLine = `v${pkgJson.version.split(".")[0]}`;
-const isPrerelease = pkgJson.version.includes("-");
 
 process.chdir(path.join(import.meta.dirname, ".."));
 
@@ -32,11 +31,6 @@ process.chdir(path.join(import.meta.dirname, ".."));
 
   await exec("changeset", ["tag"]);
 
-  if (isPrerelease) {
-    await exec("git", ["push", "origin", `refs/tags/${tag}`]);
-    return;
-  }
-
   await exec("git", [
     "push",
     "--force",