Bump zizmorcore/zizmor-action from 0.6.2 to 0.6.4 in the github-actions group (#743)

* Bump zizmorcore/zizmor-action

Bumps the github-actions group with 1 update: [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).


Updates `zizmorcore/zizmor-action` from 0.6.2 to 0.6.4
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/3dc1ecc9bcb9e94e9b2c709687979e1298497054...cc914d7f3750a2d13d75c7f184a1060aa0e9d482)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>

* Fix zizmor lints

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: bluwy <bjornlu.dev@gmail.com>

.babelrc

@@ -1,6 +0,0 @@
-{
-  "presets": [
-    ["@babel/preset-env", { "targets": { "node": 10 } }],
-    "@babel/preset-typescript"
-  ]
-}

.changeset/config.json

@@ -1,13 +1,14 @@
 {
-  "$schema": "https://unpkg.com/@changesets/config@1.6.2/schema.json",
-  "changelog": [
-    "@changesets/changelog-github",
-    { "repo": "changesets/action" }
-  ],
+  "$schema": "https://unpkg.com/@changesets/config@4.0.0-next.6/schema.json",
+  "changelog": "@changesets/changelog-github",
   "commit": false,
   "linked": [],
   "access": "restricted",
   "baseBranch": "main",
   "updateInternalDependencies": "patch",
-  "ignore": []
+  "ignore": [],
+  "privatePackages": {
+    "version": true,
+    "tag": true
+  }
 }

.github/CODEOWNERS

@@ -0,0 +1,5 @@
+/.github/** @Andarist @bluwy @emmatown
+/action.yml @Andarist @bluwy @emmatown
+/scripts/bump.ts @Andarist @bluwy @emmatown
+/scripts/release.ts @Andarist @bluwy @emmatown
+/scripts/release-pr.ts @Andarist @bluwy @emmatown

.github/actions/ci-setup/action.yml

@@ -0,0 +1,29 @@
+name: Setup CI
+description: Setup CI
+
+inputs:
+  skip-cache:
+    description: "Whether to skip the cache"
+    required: false
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - name: Check out repo
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      with:
+        persist-credentials: false
+
+    - name: Set up pnpm
+      uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6.0.5
+
+    - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      with:
+        node-version-file: ".node-version"
+        package-manager-cache: ${{ inputs.skip-cache != 'true' }}
+        cache: ${{ inputs.skip-cache != 'true' && 'pnpm' || '' }}
+
+    - name: Install dependencies
+      shell: bash
+      run: pnpm install --frozen-lockfile

.github/actions/setup-bot-auth/action.yml

@@ -0,0 +1,44 @@
+name: Setup bot auth
+description: Create a GitHub App token and configure matching git identity
+
+inputs:
+  client-id:
+    description: GitHub App client ID
+    required: true
+  private-key:
+    description: GitHub App private key
+    required: true
+  permission-contents:
+    description: Contents permission for the GitHub App token
+    required: false
+    default: write
+  permission-pull-requests:
+    description: Pull requests permission for the GitHub App token
+    required: false
+
+outputs:
+  token:
+    description: GitHub App installation access token
+    value: ${{ steps.app-token.outputs.token }}
+
+runs:
+  using: composite
+  steps:
+    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      id: app-token
+      with:
+        client-id: ${{ inputs.client-id }}
+        private-key: ${{ inputs.private-key }}
+        permission-contents: ${{ inputs.permission-contents }}
+        permission-pull-requests: ${{ inputs.permission-pull-requests }}
+
+    - name: Setup Git user
+      shell: bash
+      run: |
+        app_user="$APP_SLUG[bot]"
+        app_id="$(gh api "/users/$app_user" --jq .id)"
+        git config user.name "$app_user"
+        git config user.email "$app_id+$app_user@users.noreply.github.com"
+      env:
+        APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
+        GH_TOKEN: ${{ steps.app-token.outputs.token }}

.github/dependabot.yml

@@ -0,0 +1,32 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 10
+    versioning-strategy: increase
+    groups:
+      production-dependencies:
+        dependency-type: "production"
+        update-types:
+          - minor
+          - patch
+      development-dependencies:
+        dependency-type: "development"
+        update-types:
+          - minor
+          - patch
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -1,24 +1,79 @@
-name: Node CI
+name: CI
 
-on: [pull_request]
+on:
+  pull_request:
+  # merge queue is required so all commits on target branches trigger this workflow
+  # despite lack of the push event trigger here
+  merge_group:
+    branches:
+      - main
+      - next
+      # merge group rulesets don't allow wildcards so in settings each maintenance branch needs to be added separately
+      - "maintenance/v*" # branch rulesets don't support v[0-9]+
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.sha }}
+  cancel-in-progress: true
 
 jobs:
-  build:
-    timeout-minutes: 20
-
+  lint-workflows:
+    name: Lint workflows
     runs-on: ubuntu-latest
-
+    permissions:
+      actions: read # only required in private repos
+      security-events: write # allow writing security events
     steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v2
-
-      - name: Use Node.js 14
-        uses: actions/setup-node@v1
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          node-version: 14.x
+          persist-credentials: false
 
-      - name: Install Dependencies
-        run: yarn --frozen-lockfile
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          persona: pedantic
+          annotations: true
+          advanced-security: false
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: $/.github/actions/ci-setup
 
       - name: Test
-        run: yarn test
+        run: pnpm test
+
+  typecheck:
+    name: Typecheck
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: $/.github/actions/ci-setup
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: $/.github/actions/ci-setup
+
+      - name: Format
+        run: pnpm format
+
+  ci-ok:
+    name: CI OK
+    runs-on: ubuntu-latest
+    if: always()
+    needs: [lint-workflows, test, typecheck, lint]
+    steps:
+      - name: Exit with error if some jobs are not successful
+        run: exit 1
+        if: ${{ always() && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) }}

.github/workflows/publish.yml

@@ -0,0 +1,98 @@
+name: Publish
+
+on:
+  push:
+    branches:
+      - main
+      - next
+      - "maintenance/v*" # branch rulesets don't support v[0-9]+
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+  queue: max
+
+permissions: {} # each job should define its own permission explicitly
+
+jobs:
+  select-mode:
+    name: Select mode
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    outputs:
+      mode: ${{ steps.select-mode.outputs.mode }}
+    permissions:
+      contents: read # to check out repo (actions/checkout)
+    steps:
+      - uses: $/.github/actions/ci-setup
+        with:
+          skip-cache: true # avoid cache poisoning attacks
+
+      - name: Build
+        run: pnpm build
+
+      - name: Select mode
+        id: select-mode
+        uses: $/select-mode
+
+  version:
+    name: Version
+    if: needs.select-mode.outputs.mode == 'version'
+    needs: select-mode
+    runs-on: ubuntu-latest
+    environment: version
+    timeout-minutes: 20
+    permissions:
+      contents: read # to check out repo (actions/checkout)
+    steps:
+      - uses: $/.github/actions/ci-setup
+        with:
+          skip-cache: true # avoid cache poisoning attacks
+
+      - name: Build
+        run: pnpm build
+
+      - uses: $/.github/actions/setup-bot-auth
+        id: bot-auth
+        with:
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write # to create version commits (changesets/action)
+          permission-pull-requests: write # to create pull request (changesets/action)
+
+      - name: Create or update release pull request
+        id: changesets
+        uses: $/version
+        with:
+          github-token: ${{ steps.bot-auth.outputs.token }}
+          script: pnpm bump
+
+  publish:
+    name: Publish
+    if: needs.select-mode.outputs.mode == 'publish'
+    needs: select-mode
+    runs-on: ubuntu-latest
+    environment: marketplace
+    timeout-minutes: 20
+    permissions:
+      contents: write # to create release and have it authored by github-actions (changesets/action)
+    steps:
+      - uses: $/.github/actions/ci-setup
+        with:
+          skip-cache: true # avoid cache poisoning attacks
+
+      - name: Build
+        run: pnpm build
+
+      - uses: $/.github/actions/setup-bot-auth
+        id: bot-auth
+        with:
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write # to bypass branch and tag protection rules (release.ts)
+
+      - name: Publish to marketplace
+        uses: $/publish
+        with:
+          github-token: ${{ steps.bot-auth.outputs.token }}
+          script: pnpm release

.github/workflows/release-pr.yml

@@ -0,0 +1,241 @@
+name: Release PR
+
+on:
+  issue_comment:
+    types: [created]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.run_id }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  release_check:
+    name: Validate release request
+    if: github.repository == 'changesets/action' && github.event.issue.pull_request && startsWith(github.event.comment.body, '/release-pr')
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read # to inspect the pull request commit state (changesets/action)
+      issues: write # to add and remove reactions on the triggering comment (changesets/action)
+      pull-requests: read # to inspect the pull request head state (changesets/action)
+
+    steps:
+      - id: report_in_progress
+        run: |
+          in_progress_reaction_id=$(gh api "/repos/$GH_REPO/issues/comments/$COMMENT_ID/reactions" -f content='eyes' --jq '.id')
+          echo "in_progress_reaction_id=$in_progress_reaction_id" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          COMMENT_ID: ${{ github.event.comment.id }}
+
+      - id: parse_command
+        run: |
+          if [[ "$COMMENT_BODY" =~ ^/release-pr[[:space:]]+([0-9a-fA-F]{7,40})[[:space:]]*$ ]]
+          then
+            echo "requested_sha=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT"
+          else
+            echo "Expected '/release-pr <sha>' where <sha> is a 7-40 character commit SHA."
+            exit 1
+          fi
+        env:
+          COMMENT_BODY: ${{ github.event.comment.body }}
+
+      - id: check_authorization
+        run: |
+          if [[ "$AUTHOR_ASSOCIATION" == 'MEMBER' || "$AUTHOR_ASSOCIATION" == 'OWNER' || "$AUTHOR_ASSOCIATION" == 'COLLABORATOR' ]]
+          then
+            echo "User is authorized to release"
+          else
+            echo "User is not authorized to release"
+            exit 1
+          fi
+        env:
+          AUTHOR_ASSOCIATION: ${{ github.event.comment.author_association }}
+
+      - id: resolve_requested_sha
+        run: |
+          requested_sha=$(echo "$REQUESTED_SHA" | tr '[:upper:]' '[:lower:]')
+
+          mapfile -t matches < <(
+            gh api "/repos/$GH_REPO/pulls/$ISSUE_NUMBER/commits" --paginate --jq '.[].sha' |
+              awk -v sha="$requested_sha" 'index(tolower($0), sha) == 1 { print $0 }'
+          )
+
+          if [[ ${#matches[@]} -eq 0 ]]
+          then
+            echo "Requested SHA $REQUESTED_SHA is not part of this pull request."
+            exit 1
+          fi
+
+          if [[ ${#matches[@]} -gt 1 ]]
+          then
+            echo "Requested SHA $REQUESTED_SHA is ambiguous for this pull request."
+            exit 1
+          fi
+
+          resolved_sha="${matches[0]}"
+          pr_head_sha=$(gh pr view "$ISSUE_NUMBER" --json headRefOid --jq '.headRefOid')
+
+          if [[ "$resolved_sha" != "$pr_head_sha" ]]
+          then
+            echo "Requested SHA $resolved_sha is not the current PR head $pr_head_sha."
+            exit 1
+          fi
+
+          echo "resolved_sha=$resolved_sha" >> "$GITHUB_OUTPUT"
+          echo "pr_head_sha=$pr_head_sha" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          REQUESTED_SHA: ${{ steps.parse_command.outputs.requested_sha }}
+
+      - id: get_pr_head_repository
+        run: |
+          head_repository=$(gh pr view "$ISSUE_NUMBER" --json headRepositoryOwner,headRepository --jq '.headRepositoryOwner.login + "/" + .headRepository.name')
+          echo "head_repository=$head_repository" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+
+    outputs:
+      in_progress_reaction_id: ${{ steps.report_in_progress.outputs.in_progress_reaction_id }}
+      requested_sha: ${{ steps.parse_command.outputs.requested_sha }}
+      resolved_sha: ${{ steps.resolve_requested_sha.outputs.resolved_sha }}
+      pr_head_sha: ${{ steps.resolve_requested_sha.outputs.pr_head_sha }}
+      head_repository: ${{ steps.get_pr_head_repository.outputs.head_repository }}
+
+  release:
+    name: Release snapshot
+    if: github.repository == 'changesets/action'
+    timeout-minutes: 20
+    runs-on: ubuntu-latest
+    needs: release_check
+
+    permissions:
+      contents: write # to create the release commit and publish snapshot artifacts (changesets/action)
+      issues: write # to add and remove reactions on the triggering comment (changesets/action)
+      pull-requests: write # to comment on the pull request with the release result (changesets/action)
+
+    steps:
+      - uses: $/.github/actions/ci-setup
+        with:
+          skip-cache: true # avoid cache poisoning attacks
+
+      - name: Fetch validated commit from pull request head repository
+        run: |
+          git remote add pr-head "https://github.com/$HEAD_REPOSITORY.git"
+          git fetch --no-tags pr-head "$RESOLVED_SHA"
+        env:
+          HEAD_REPOSITORY: ${{ needs.release_check.outputs.head_repository }}
+          RESOLVED_SHA: ${{ needs.release_check.outputs.resolved_sha }}
+
+      - name: Checkout validated commit
+        run: git checkout --detach "$RESOLVED_SHA"
+        env:
+          RESOLVED_SHA: ${{ needs.release_check.outputs.resolved_sha }}
+
+      - name: Check if Version Packages PR
+        id: check_version_packages
+        run: |
+          version_packages=$(gh pr view "$ISSUE_NUMBER" --json headRefName --jq '.headRefName|startswith("changeset-release/")')
+          echo "version_packages=$version_packages" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+
+      - name: Reset Version Packages PR
+        if: steps.check_version_packages.outputs.version_packages == 'true'
+        run: git reset --hard HEAD~1
+
+      - name: Create snapshot version
+        run: pnpm changeset version --snapshot "pr$ISSUE_NUMBER"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+
+      - name: Build
+        run: pnpm build
+
+      - uses: $/.github/actions/setup-bot-auth
+        id: bot-auth
+        with:
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write # to push the release snapshot branch (release-pr.ts)
+
+      - name: Release snapshot version
+        run: pnpm release:pr
+        env:
+          GITHUB_TOKEN: ${{ steps.bot-auth.outputs.token }}
+
+      - name: Add success reaction
+        run: gh api "/repos/$GH_REPO/issues/comments/$COMMENT_ID/reactions" -f content='rocket'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          COMMENT_ID: ${{ github.event.comment.id }}
+
+      - name: Remove in-progress reaction
+        run: gh api -X DELETE "/repos/$GH_REPO/issues/comments/$COMMENT_ID/reactions/$IN_PROGRESS_REACTION_ID"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          COMMENT_ID: ${{ github.event.comment.id }}
+          IN_PROGRESS_REACTION_ID: ${{ needs.release_check.outputs.in_progress_reaction_id }}
+
+      - name: Comment success
+        run: |
+          published_commit="$(git rev-parse HEAD)"
+          body="The release for \`$RESOLVED_SHA\` triggered by [this comment]($COMMENT_URL) has [succeeded]($RUN_URL). Published commit: [$GH_REPO@$published_commit](https://github.com/$GH_REPO/commit/$published_commit)."
+          gh pr comment "$ISSUE_NUMBER" --body "$body"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          COMMENT_URL: ${{ github.event.comment.url }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          RESOLVED_SHA: ${{ needs.release_check.outputs.resolved_sha }}
+
+  report-failure-if-needed:
+    name: Report failure
+    needs: [release_check, release]
+    timeout-minutes: 2
+    runs-on: ubuntu-latest
+    if: failure() && github.repository == 'changesets/action' && (needs.release_check.result == 'failure' || needs.release.result == 'failure')
+
+    permissions:
+      issues: write # to add and remove reactions on the triggering comment (changesets/action)
+      pull-requests: write # to comment on the pull request with the failure result (changesets/action)
+
+    steps:
+      - name: Add failure reaction
+        run: gh api "/repos/$GH_REPO/issues/comments/$COMMENT_ID/reactions" -f content='-1'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          COMMENT_ID: ${{ github.event.comment.id }}
+
+      - name: Remove in-progress reaction
+        run: gh api -X DELETE "/repos/$GH_REPO/issues/comments/$COMMENT_ID/reactions/$IN_PROGRESS_REACTION_ID"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          COMMENT_ID: ${{ github.event.comment.id }}
+          IN_PROGRESS_REACTION_ID: ${{ needs.release_check.outputs.in_progress_reaction_id }}
+
+      - name: Comment failure
+        run: |
+          body="The release for \`$REQUESTED_SHA\` triggered by [this comment]($COMMENT_URL) has [failed]($RUN_URL)."
+          gh pr comment "$ISSUE_NUMBER" --body "$body"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          COMMENT_URL: ${{ github.event.comment.url }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          REQUESTED_SHA: ${{ needs.release_check.outputs.requested_sha }}

.github/workflows/version-or-publish.yml

@@ -1,35 +0,0 @@
-name: Version or Publish
-
-on:
-  push:
-    branches:
-      - main
-
-concurrency: ${{ github.workflow }}-${{ github.ref }}
-
-jobs:
-  changesets:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v2
-
-      - name: Use Node.js 14
-        uses: actions/setup-node@v1
-        with:
-          node-version: 14.x
-
-      - name: Install Dependencies
-        run: yarn --frozen-lockfile
-
-      - name: Build
-        run: yarn build
-
-      - name: Create Release Pull Request or Publish
-        id: changesets
-        uses: ./
-        with:
-          version: yarn bump
-          publish: yarn release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -2,5 +2,6 @@ node_modules
 .parcel-cache
 .cache
 *.log
+.env
 
 dist/

.node-version

@@ -0,0 +1 @@
+v24.11.0

.oxfmtrc.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "printWidth": 80,
+  "sortImports": {
+    "newlinesBetween": false
+  }
+}

.vscode/launch.json

@@ -0,0 +1,16 @@
+{
+  "version": "0.2.0",
+  "configurations": [
+    {
+      "type": "node",
+      "request": "launch",
+      "name": "Debug Current Test File",
+      "autoAttachChildProcesses": true,
+      "skipFiles": [],
+      "program": "${workspaceRoot}/node_modules/vitest/vitest.mjs",
+      "args": ["run", "${relativeFile}"],
+      "smartStep": true,
+      "console": "integratedTerminal"
+    }
+  ]
+}

.vscode/settings.json

@@ -0,0 +1,4 @@
+{
+  "js/ts.tsdk.path": "node_modules/typescript/lib",
+  "editor.defaultFormatter": "oxc.oxc-vscode"
+}

CHANGELOG.md

@@ -1,5 +1,353 @@
 # @changesets/action
 
+## 2.1.2
+
+### Patch Changes
+
+- [#735](https://github.com/changesets/action/pull/735) [`8833883`](https://github.com/changesets/action/commit/88338839e35c3e0fa61f3c9c3f27e7572cd5f2cf) Thanks [@bluwy](https://github.com/bluwy)! - Handle error when pushing git tags with the git CLI
+
+- [#724](https://github.com/changesets/action/pull/724) [`36f529f`](https://github.com/changesets/action/commit/36f529f13ab58bbcf6331035cb950385586e8a89) Thanks [@bluwy](https://github.com/bluwy)! - Improve log messages
+
+- [#724](https://github.com/changesets/action/pull/724) [`36f529f`](https://github.com/changesets/action/commit/36f529f13ab58bbcf6331035cb950385586e8a89) Thanks [@bluwy](https://github.com/bluwy)! - Fix root action double error logs
+
+- [#729](https://github.com/changesets/action/pull/729) [`ca85897`](https://github.com/changesets/action/commit/ca8589735af2ff6977a0f6474537d550040530d8) Thanks [@bluwy](https://github.com/bluwy)! - Always switch and reset branch when generating version commits, similar to if `push-with-git-cli` is enabled
+
+## 2.1.1
+
+### Patch Changes
+
+- [#721](https://github.com/changesets/action/pull/721) [`da1ea29`](https://github.com/changesets/action/commit/da1ea291ef93203a08fad360eac36f4858dd0514) Thanks [@KEBABSELLER6](https://github.com/KEBABSELLER6)! - Fixed typo in renamed inputs from v1 to v2
+
+## 2.1.0
+
+### Minor Changes
+
+- [#718](https://github.com/changesets/action/pull/718) [`3b7c71c`](https://github.com/changesets/action/commit/3b7c71c440e75fca5d335f779290425fc1117fe8) Thanks [@bluwy](https://github.com/bluwy)! - Add a `cwd` input to the root action, `/select-mode`, `/version`, `/pack`, and `/publish` sub-actions to set the current working directory to execute Changesets in. This input existed in v1 but was incorrectly removed.
+
+### Patch Changes
+
+- [#716](https://github.com/changesets/action/pull/716) [`6f58ba3`](https://github.com/changesets/action/commit/6f58ba35801ec075a1c87569277591f8ef1a3029) Thanks [@bluwy](https://github.com/bluwy)! - Update `pr-status` message to link to the new faq page
+
+## 2.0.0
+
+### Major Changes
+
+- [#692](https://github.com/changesets/action/pull/692) [`cb3f011`](https://github.com/changesets/action/commit/cb3f0110d7423cd340b1c5d63584c0ea6ee63959) Thanks [@Andarist](https://github.com/Andarist)! - Release commits and tags are now pushed using the GitHub API by default.
+
+  Replace the `commit-mode` input with the boolean `push-with-git-cli` input. Set `push-with-git-cli: true` to continue using the Git CLI.
+
+  Regardless of the push mode, custom GitHub tokens must be passed explicitly through the `github-token` input. The `GITHUB_TOKEN` environment variable and credentials configured by `actions/checkout` or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, `github-token` takes precedence over those repository credentials.
+
+- [#680](https://github.com/changesets/action/pull/680) [`ca57073`](https://github.com/changesets/action/commit/ca57073900dc678254406a052a03c0c8824e319d) Thanks [@bluwy](https://github.com/bluwy)! - Add a new `push-git-tags` option that complements `create-github-releases` to control specifically if git tags should be created but not GitHub releases.
+
+  If `create-github-releases` was previously set to `false`, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set `push-git-tags` to `false` explicitly.
+
+- [#657](https://github.com/changesets/action/pull/657) [`4f718b5`](https://github.com/changesets/action/commit/4f718b5921490b1efeb015a81abb6a4633892851) Thanks [@Andarist](https://github.com/Andarist)! - Removed compatibility support for old Changesets v1.
+
+- [#681](https://github.com/changesets/action/pull/681) [`7359107`](https://github.com/changesets/action/commit/73591071e61c7f61cf322dd7a6341dc29a8e1d4e) Thanks [@bluwy](https://github.com/bluwy)! - Rename the root action inputs and outputs to better match the sub-actions' conventions.
+
+  Inputs:
+
+  - `version` -> `version-script`
+  - `publish` -> `publish-script`
+  - `commit` -> `commit-message`
+  - `title` -> `pr-title`
+  - `branch` -> `pr-base-branch`
+
+  Outputs:
+
+  - `pull-request-number` -> `pr-number`
+
+- [#674](https://github.com/changesets/action/pull/674) [`164652b`](https://github.com/changesets/action/commit/164652bdd60525670d95291addb8c6f92833ac60) Thanks [@bluwy](https://github.com/bluwy)! - Remove support for passing custom GitHub token through the GITHUB_TOKEN environment variable. It should be passed to the `github-token` input instead.
+
+- [#659](https://github.com/changesets/action/pull/659) [`5649ff4`](https://github.com/changesets/action/commit/5649ff41b8eb1b7a281011e45df781c6d4628fd0) Thanks [@bluwy](https://github.com/bluwy)! - Remove `cwd` option for `changesets/action`. Use the step `working-directory` option instead to change the directory.
+
+- [#673](https://github.com/changesets/action/pull/673) [`823cf74`](https://github.com/changesets/action/commit/823cf741ca57c5e22652123d3a847dfafcd77ca0) Thanks [@bluwy](https://github.com/bluwy)! - Update to Changesets v3 packages
+
+- [#695](https://github.com/changesets/action/pull/695) [`469993c`](https://github.com/changesets/action/commit/469993ce5783c6a38e72541d4ba0d25588702b9a) Thanks [@bluwy](https://github.com/bluwy)! - Removed `.npmrc` handling when the `NPM_TOKEN` environment variable is set.
+
+  Authentication should be handled via Trusted Publishing instead. If a token is still needed, use `actions/setup-node` to set it up instead via the `registry-url` option. Check out the updated action README for more information of setting up npm authentication in GitHub Actions.
+
+- [#668](https://github.com/changesets/action/pull/668) [`0eae789`](https://github.com/changesets/action/commit/0eae789230defbc4ad287e9b476aba7e842e34e0) Thanks [@bluwy](https://github.com/bluwy)! - Rename the input and output names to kebab-case instead of camelCase to match the official GitHub actions pattern
+
+### Minor Changes
+
+- [#656](https://github.com/changesets/action/pull/656) [`a12d90d`](https://github.com/changesets/action/commit/a12d90de8394e63c952622b2fd3f98c8729c48b0) Thanks [@bluwy](https://github.com/bluwy)! - Add new `/select-mode`, `/version`, and `/publish` sub-actions to better control version and publish steps
+
+- [#678](https://github.com/changesets/action/pull/678) [`f71ae04`](https://github.com/changesets/action/commit/f71ae043ed5deb17952900091e009a60edef9507) Thanks [@Andarist](https://github.com/Andarist)! - Published packages detection done through stdout parsing was replaced with one based on the shared output file using `CHANGESETS_OUTPUT` environment variable. When using custom scripts this environment variable should always be passed down to the Changesets CLI invocations.
+
+### Patch Changes
+
+- [#699](https://github.com/changesets/action/pull/699) [`5b307d3`](https://github.com/changesets/action/commit/5b307d3df25daf51c41dff70d2f66df1579ae9fa) Thanks [@Andarist](https://github.com/Andarist)! - Validate that projects use Changesets CLI v3 and direct Changesets CLI v2 users to `changesets/action@v1`.
+
+- [#697](https://github.com/changesets/action/pull/697) [`84d78c6`](https://github.com/changesets/action/commit/84d78c68f98f20e24dfff22b22193e7b4f326ad9) Thanks [@Andarist](https://github.com/Andarist)! - Allow custom publish scripts to complete without a Changesets output file, warning that GitHub releases and git tags cannot be created when that file is missing.
+
+- [#670](https://github.com/changesets/action/pull/670) [`5a8b9b7`](https://github.com/changesets/action/commit/5a8b9b721bf683e3bf9bd72ea92a685dc024147b) Thanks [@Andarist](https://github.com/Andarist)! - Authenticate git CLI pushes with the configured GitHub token using Git extra headers instead of writing to a global `.netrc` file.
+
+- [#670](https://github.com/changesets/action/pull/670) [`5a8b9b7`](https://github.com/changesets/action/commit/5a8b9b721bf683e3bf9bd72ea92a685dc024147b) Thanks [@Andarist](https://github.com/Andarist)! - Derive the Git server URL from the GitHub Actions context when configuring git CLI authentication to support GitHub Enterprise Server setups.
+
+- [#688](https://github.com/changesets/action/pull/688) [`219ea82`](https://github.com/changesets/action/commit/219ea82e52caaff2a10a5e34d3455093cf958238) Thanks [@Andarist](https://github.com/Andarist)! - Remove the `setup-git-user` input. Complete custom Git identities are now preserved automatically, while `github-actions[bot]` is configured as a fallback before creating local release commits or tags.
+
+## 2.0.0-next.5
+
+### Patch Changes
+
+- [#711](https://github.com/changesets/action/pull/711) [`5fa6767`](https://github.com/changesets/action/commit/5fa67671df41b7a8a9d8123e8e446b1a8ad423db) Thanks [@Andarist](https://github.com/Andarist)! - Fix support for prerelease exits using the new `.changeset/pre` layout.
+
+## 2.0.0-next.4
+
+### Major Changes
+
+- [#692](https://github.com/changesets/action/pull/692) [`cb3f011`](https://github.com/changesets/action/commit/cb3f0110d7423cd340b1c5d63584c0ea6ee63959) Thanks [@Andarist](https://github.com/Andarist)! - Release commits and tags are now pushed using the GitHub API by default.
+
+  Replace the `commit-mode` input with the boolean `push-with-git-cli` input. Set `push-with-git-cli: true` to continue using the Git CLI.
+
+  Regardless of the push mode, custom GitHub tokens must be passed explicitly through the `github-token` input. The `GITHUB_TOKEN` environment variable and credentials configured by `actions/checkout` or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, `github-token` takes precedence over those repository credentials.
+
+- [#695](https://github.com/changesets/action/pull/695) [`469993c`](https://github.com/changesets/action/commit/469993ce5783c6a38e72541d4ba0d25588702b9a) Thanks [@bluwy](https://github.com/bluwy)! - Removed `.npmrc` handling when the `NPM_TOKEN` environment variable is set.
+
+  Authentication should be handled via Trusted Publishing instead. If a token is still needed, use `actions/setup-node` to set it up instead via the `registry-url` option. Check out the updated action README for more information of setting up npm authentication in GitHub Actions.
+
+### Patch Changes
+
+- [#699](https://github.com/changesets/action/pull/699) [`5b307d3`](https://github.com/changesets/action/commit/5b307d3df25daf51c41dff70d2f66df1579ae9fa) Thanks [@Andarist](https://github.com/Andarist)! - Validate that projects use Changesets CLI v3 and direct Changesets CLI v2 users to `changesets/action@v1`.
+
+- [#697](https://github.com/changesets/action/pull/697) [`84d78c6`](https://github.com/changesets/action/commit/84d78c68f98f20e24dfff22b22193e7b4f326ad9) Thanks [@Andarist](https://github.com/Andarist)! - Allow custom publish scripts to complete without a Changesets output file, warning that GitHub releases and git tags cannot be created when that file is missing.
+
+- [#705](https://github.com/changesets/action/pull/705) [`77be81b`](https://github.com/changesets/action/commit/77be81bcb9d2d1007c53c4f98bffe51da428d6a5) Thanks [@Andarist](https://github.com/Andarist)! - Fixed a regression making it impossible to sync new versions of versioning pull requests with base branch updates when using GitHub API pushes.
+
+- [#688](https://github.com/changesets/action/pull/688) [`219ea82`](https://github.com/changesets/action/commit/219ea82e52caaff2a10a5e34d3455093cf958238) Thanks [@Andarist](https://github.com/Andarist)! - Remove the `setup-git-user` input. Complete custom Git identities are now preserved automatically, while `github-actions[bot]` is configured as a fallback before creating local release commits or tags.
+
+## 2.0.0-next.3
+
+### Major Changes
+
+- [#680](https://github.com/changesets/action/pull/680) [`ca57073`](https://github.com/changesets/action/commit/ca57073900dc678254406a052a03c0c8824e319d) Thanks [@bluwy](https://github.com/bluwy)! - Add a new `push-git-tags` option that complements `create-github-releases` to control specifically if git tags should be created but not GitHub releases.
+
+  If `create-github-releases` was previously set to `false`, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set `push-git-tags` to `false` explicitly.
+
+- [#681](https://github.com/changesets/action/pull/681) [`7359107`](https://github.com/changesets/action/commit/73591071e61c7f61cf322dd7a6341dc29a8e1d4e) Thanks [@bluwy](https://github.com/bluwy)! - Rename the root action inputs and outputs to better match the sub-actions' conventions.
+
+  Inputs:
+  - `version` -> `version-script`
+  - `publish` -> `publish-script`
+  - `commit` -> `commit-message`
+  - `title` -> `pr-title`
+  - `branch` -> `pr-base-branch`
+
+  Outputs:
+  - `pull-request-number` -> `pr-number`
+
+- [#674](https://github.com/changesets/action/pull/674) [`164652b`](https://github.com/changesets/action/commit/164652bdd60525670d95291addb8c6f92833ac60) Thanks [@bluwy](https://github.com/bluwy)! - Remove support for passing custom GitHub token through the GITHUB_TOKEN environment variable. It should be passed to the `github-token` input instead.
+
+- [#673](https://github.com/changesets/action/pull/673) [`823cf74`](https://github.com/changesets/action/commit/823cf741ca57c5e22652123d3a847dfafcd77ca0) Thanks [@bluwy](https://github.com/bluwy)! - Update to Changesets v3 packages
+
+- [#668](https://github.com/changesets/action/pull/668) [`0eae789`](https://github.com/changesets/action/commit/0eae789230defbc4ad287e9b476aba7e842e34e0) Thanks [@bluwy](https://github.com/bluwy)! - Rename the input and output names to kebab-case instead of camelCase to match the official GitHub actions pattern
+
+### Minor Changes
+
+- [#678](https://github.com/changesets/action/pull/678) [`f71ae04`](https://github.com/changesets/action/commit/f71ae043ed5deb17952900091e009a60edef9507) Thanks [@Andarist](https://github.com/Andarist)! - Published packages detection done through stdout parsing was replaced with one based on the shared output file using `CHANGESETS_OUTPUT` environment variable. When using custom scripts this environment variable should always be passed down to the Changesets CLI invocations.
+
+## 2.0.0-next.2
+
+### Patch Changes
+
+- [#670](https://github.com/changesets/action/pull/670) [`5a8b9b7`](https://github.com/changesets/action/commit/5a8b9b721bf683e3bf9bd72ea92a685dc024147b) Thanks [@Andarist](https://github.com/Andarist)! - Authenticate git CLI pushes with the configured GitHub token using Git extra headers instead of writing to a global `.netrc` file.
+
+- [#670](https://github.com/changesets/action/pull/670) [`5a8b9b7`](https://github.com/changesets/action/commit/5a8b9b721bf683e3bf9bd72ea92a685dc024147b) Thanks [@Andarist](https://github.com/Andarist)! - Derive the Git server URL from the GitHub Actions context when configuring git CLI authentication to support GitHub Enterprise Server setups.
+
+## 2.0.0-next.1
+
+### Patch Changes
+
+- [#663](https://github.com/changesets/action/pull/663) [`ccb3811`](https://github.com/changesets/action/commit/ccb38113eaaa4a13eb6aabe09520e49cc8519b84) Thanks [@Andarist](https://github.com/Andarist)! - Fix the computed publish plan path passed internally to `changeset pack` by the `/pack` subaction.
+
+- [#662](https://github.com/changesets/action/pull/662) [`5c88881`](https://github.com/changesets/action/commit/5c88881fff1f0d8b055d4a2d3a74a8ce843db6f3) Thanks [@Andarist](https://github.com/Andarist)! - Fixed usage of `--from-publish-plan` flag used by the `/pack` subaction
+
+- [#666](https://github.com/changesets/action/pull/666) [`dc29b73`](https://github.com/changesets/action/commit/dc29b738b532d9e95f46b9bf493e2e3fdf48a7ed) Thanks [@Andarist](https://github.com/Andarist)! - Fix the `/version` subaction to not crash on missing `pr-base-branch` input. This input is meant to be optional.
+
+## 2.0.0-next.0
+
+### Major Changes
+
+- [#657](https://github.com/changesets/action/pull/657) [`4f718b5`](https://github.com/changesets/action/commit/4f718b5921490b1efeb015a81abb6a4633892851) Thanks [@Andarist](https://github.com/Andarist)! - Removed compatibility support for old Changesets v1.
+
+- [#659](https://github.com/changesets/action/pull/659) [`5649ff4`](https://github.com/changesets/action/commit/5649ff41b8eb1b7a281011e45df781c6d4628fd0) Thanks [@bluwy](https://github.com/bluwy)! - Remove `cwd` option for `changesets/action`. Use the step `working-directory` option instead to change the directory.
+
+### Minor Changes
+
+- [#656](https://github.com/changesets/action/pull/656) [`a12d90d`](https://github.com/changesets/action/commit/a12d90de8394e63c952622b2fd3f98c8729c48b0) Thanks [@bluwy](https://github.com/bluwy)! - Add new `/select-mode`, `/version`, and `/publish` sub-actions to better control version and publish steps
+
+## 1.9.0
+
+### Minor Changes
+
+- [#636](https://github.com/changesets/action/pull/636) [`b072bcc`](https://github.com/changesets/action/commit/b072bccc4c664a373c42168eed9139dce1e003b1) Thanks [@bluwy](https://github.com/bluwy)! - Add a new `@changesets/action/pr-comment` sub-action to comment on PRs
+
+- [#625](https://github.com/changesets/action/pull/625) [`8795eee`](https://github.com/changesets/action/commit/8795eee5eee884e887d352ac673a515ffe35aaa6) Thanks [@bluwy](https://github.com/bluwy)! - Add a new `@changesets/action/pr-status` sub-action to generate the changeset status comment for PRs as an alternative to the [Changesets Bot](https://github.com/apps/changeset-bot).
+
+### Patch Changes
+
+- [#535](https://github.com/changesets/action/pull/535) [`34f64f6`](https://github.com/changesets/action/commit/34f64f6e2e1e47ddc183f174aa27c197aa47f520) Thanks [@Andarist](https://github.com/Andarist)! - Fixed an issue with GitHub releases not being created for successfully published packages when _some_ packages failed to be published to the registry.
+
+- [#632](https://github.com/changesets/action/pull/632) [`1d54b9e`](https://github.com/changesets/action/commit/1d54b9e660e435237accbcae0b4581af3be641b4) Thanks [@bluwy](https://github.com/bluwy)! - Simplify internal implementation to get changelog entries for a package version
+
+- [#629](https://github.com/changesets/action/pull/629) [`e0c90aa`](https://github.com/changesets/action/commit/e0c90aa7fbd0cc26931a679c5abe9bbc0deb0b50) Thanks [@bluwy](https://github.com/bluwy)! - Fix custom version and publish command argument parsing
+
+- [#645](https://github.com/changesets/action/pull/645) [`f9585d9`](https://github.com/changesets/action/commit/f9585d966a9c7d2f668b97199990de6f885823cf) Thanks [@Andarist](https://github.com/Andarist)! - Improved force-push handling when using `commitMode: "github-api"` so updating an existing branch no longer temporarily resets the target branch to the base commit, avoiding cases where GitHub closes open pull requests during the update. This should remove a possibility of a GitHub state race that caused the force-pushed PRs not being reopened.
+
+## 1.8.0
+
+### Minor Changes
+
+- [#258](https://github.com/changesets/action/pull/258) [`f5dbf72`](https://github.com/changesets/action/commit/f5dbf72f96949cb0daf45152f0f63062df70e97d) Thanks [@tom-sherman](https://github.com/tom-sherman)! - Support draft version PR modes with a new `prDraft` input. Use `create` to create new version PRs as drafts, or `always` to also convert existing version PRs back to draft when updating them.
+
+### Patch Changes
+
+- [#502](https://github.com/changesets/action/pull/502) [`6002dbd`](https://github.com/changesets/action/commit/6002dbd987f49a3c0a134910d9c7bca975b79977) Thanks [@oshytiko](https://github.com/oshytiko)! - Fixed initial `.changeset` state being picked up, when `cwd` parameter is provided
+
+- [#536](https://github.com/changesets/action/pull/536) [`81b3f61`](https://github.com/changesets/action/commit/81b3f61ebffcb868f73e4c0b2682517149c834a2) Thanks [@radnan](https://github.com/radnan)! - Fixed `.changeset` state being picked for the version command when `cwd` parameter is provided
+
+## 1.7.0
+
+### Minor Changes
+
+- [#564](https://github.com/changesets/action/pull/564) [`935fe87`](https://github.com/changesets/action/commit/935fe876b0054dfc962ac86bcddf028460040d46) Thanks [@Andarist](https://github.com/Andarist)! - Automatically use the GitHub-provided token to allow most users to avoid explicit `GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}` configuration.
+
+### Patch Changes
+
+- [#545](https://github.com/changesets/action/pull/545) [`54220dd`](https://github.com/changesets/action/commit/54220dd92c06e7da112b139f95d8beb933e4cdde) Thanks [@ryanbas21](https://github.com/ryanbas21)! - The `.npmrc` generation now intelligently handles both traditional NPM token authentication and trusted publishing scenarios by only appending the auth token when `NPM_TOKEN` is defined. This prevents 'undefined' from being written to the registry configuration when using OIDC tokens from GitHub Actions trusted publishing.
+
+- [#563](https://github.com/changesets/action/pull/563) [`6af4a7e`](https://github.com/changesets/action/commit/6af4a7ec080d23ac6b304f69b67fd0aa92e089e7) Thanks [@Andarist](https://github.com/Andarist)! - Don't error on already committed symlinks and executables that stay untouched
+
+## 1.6.0
+
+### Minor Changes
+
+- [#558](https://github.com/changesets/action/pull/558) [`342005d`](https://github.com/changesets/action/commit/342005d41242bccd9dd9ae8d3679efce96af48ae) Thanks [@harsha-venugopal-ledn](https://github.com/harsha-venugopal-ledn)! - Upgrade from Node.js 20 to Node.js 24 LTS
+
+## 1.5.3
+
+### Patch Changes
+
+- [#477](https://github.com/changesets/action/pull/477) [`9d933dc`](https://github.com/changesets/action/commit/9d933dcd11c284ac49a835db884c3c1008b2b96f) Thanks [@Andarist](https://github.com/Andarist)! - Updated `@actions/*` and `@octokit/*` dependencies.
+
+- [#479](https://github.com/changesets/action/pull/479) [`cf373e4`](https://github.com/changesets/action/commit/cf373e45c90a0cc564cd2770de3e9a3a4cdd4603) Thanks [@Andarist](https://github.com/Andarist)! - Switched to `esbuild` for bundling the dist file. This led to 45% file size reduction.
+
+- [#488](https://github.com/changesets/action/pull/488) [`022692b`](https://github.com/changesets/action/commit/022692ba027b33bf46d4d41907a317fbf04461a7) Thanks [@s0](https://github.com/s0)! - Fix PRs sometimes not getting reopened with `commitMode: github-api`
+
+  There was a race-condition that means sometimes existing PRs would not be found,
+  and new PRs would be opened. This has now been fixed by fetching existing PRs
+  before making any changes.
+
+- [#486](https://github.com/changesets/action/pull/486) [`7ed1955`](https://github.com/changesets/action/commit/7ed195554624ebd75c08aa477b53110f61cc78f7) Thanks [@s0](https://github.com/s0)! - Fixed situations in which `cwd` was specified as a relative path and used with (default) `commitMode: git-cli`
+
+- [#461](https://github.com/changesets/action/pull/461) [`e9c36b6`](https://github.com/changesets/action/commit/e9c36b696406360bf04204ad32e3dcf3ad752b77) Thanks [@nayounsang](https://github.com/nayounsang)! - Avoid hitting a deprecation warning when encountering errors from `@octokit/request-error`
+
+## 1.5.2
+
+### Patch Changes
+
+- [#473](https://github.com/changesets/action/pull/473) [`3c24abe`](https://github.com/changesets/action/commit/3c24abeab26da6335c181222faa2ea485a092cf8) Thanks [@s0](https://github.com/s0)! - Make git add work consistently with subdirectories
+
+  Ensure that when running the action from a subdirectory of a repository,
+  only the files from that directory are added, regardless of `commitMode`.
+
+## 1.5.1
+
+### Patch Changes
+
+- [#471](https://github.com/changesets/action/pull/471) [`15ab130`](https://github.com/changesets/action/commit/15ab1306067a396fa9ba7ad363e8a041d457782a) Thanks [@h3rmanj](https://github.com/h3rmanj)! - Bump `@changesets/ghcommit` to v1.4.0, which fixes an issue running this action in monorepos with `commitMode: github-api`
+
+- [#467](https://github.com/changesets/action/pull/467) [`6e57550`](https://github.com/changesets/action/commit/6e575506e63f9e69e475d3eccfdd61b448efc8ae) Thanks [@Vx-V](https://github.com/Vx-V)! - Avoid searching for an existing pull request early.
+
+## 1.5.0
+
+### Minor Changes
+
+- [#391](https://github.com/changesets/action/pull/391) [`207dc3d`](https://github.com/changesets/action/commit/207dc3da2d1907cae0454ce123935401332be72b) Thanks [@s0](https://github.com/s0)! - Introduce a new input `commitMode` that allows using the GitHub API for pushing tags and commits instead of the Git CLI.
+
+  When used with `"github-api"` value all tags and commits will be attributed to the user whose GITHUB_TOKEN is used, and also signed using GitHub's internal GPG key.
+
+## 1.4.10
+
+### Patch Changes
+
+- [#448](https://github.com/changesets/action/pull/448) [`8b16070`](https://github.com/changesets/action/commit/8b16070fe386eed3456c83eeed9460160432cf26) Thanks [@bluwy](https://github.com/bluwy)! - Use full git email (`41898282+github-actions[bot]@users.noreply.github.com`) for github-actions bot when making commits
+
+## 1.4.9
+
+### Patch Changes
+
+- [#415](https://github.com/changesets/action/pull/415) [`57ab80c`](https://github.com/changesets/action/commit/57ab80c61104c270bebc125910ae32da3a5aca46) Thanks [@benmccann](https://github.com/benmccann)! - Improve error message when attempting to publish without publish script defined
+
+## 1.4.8
+
+### Patch Changes
+
+- [#393](https://github.com/changesets/action/pull/393) [`48ab0d2`](https://github.com/changesets/action/commit/48ab0d2f2e77ae169182d022591ef5c18c931ff2) Thanks [@s0](https://github.com/s0)! - Ensure the PR remains open when updated
+
+- [#393](https://github.com/changesets/action/pull/393) [`48ab0d2`](https://github.com/changesets/action/commit/48ab0d2f2e77ae169182d022591ef5c18c931ff2) Thanks [@s0](https://github.com/s0)! - Switch to cheaper API for querying existing PRs
+
+## 1.4.7
+
+### Patch Changes
+
+- [#255](https://github.com/changesets/action/pull/255) [`f2660aa`](https://github.com/changesets/action/commit/f2660aa7e78365f53dbeb4cfa774c1499ec6483a) Thanks [@ernestognw](https://github.com/ernestognw)! - Allow customize PR `branch` field
+
+## 1.4.6
+
+### Patch Changes
+
+- [#350](https://github.com/changesets/action/pull/350) [`9385be9`](https://github.com/changesets/action/commit/9385be9e757839189ea5ee63ec4e3caa8a6ca71b) Thanks [@m-shaka](https://github.com/m-shaka)! - Bump the used node.js from 16 to 20
+
+## 1.4.5
+
+### Patch Changes
+
+- [#282](https://github.com/changesets/action/pull/282) [`eb19e25`](https://github.com/changesets/action/commit/eb19e25e7797cf33dc2de4caa071e85a8057a0f0) Thanks [@mark-omarov](https://github.com/mark-omarov)! - Updated a few dependencies to patch the security vulnerabilities that were reported for their older versions.
+
+## 1.4.4
+
+### Patch Changes
+
+- [#291](https://github.com/changesets/action/pull/291) [`db8a109`](https://github.com/changesets/action/commit/db8a1099bc0ba1dd6f46a5b9df4212e4f69e78c9) Thanks [@varl](https://github.com/varl)! - Wire up [`@octokit/plugin-throttling`](https://github.com/octokit/plugin-throttling.js) with all GitHub Octokit instances
+
+## 1.4.3
+
+### Patch Changes
+
+- [#289](https://github.com/changesets/action/pull/289) [`8b28186`](https://github.com/changesets/action/commit/8b2818674de86a7fc69aebb9ed6b486ee32eb96e) Thanks [@varl](https://github.com/varl)! - Use logging provided by `@actions/core`
+
+## 1.4.2
+
+### Patch Changes
+
+- [#286](https://github.com/changesets/action/pull/286) [`225a1e8`](https://github.com/changesets/action/commit/225a1e8cbcabb7b585174ba0ad806549db40d4cd) Thanks [@varl](https://github.com/varl)! - This patch implements the [`@octokit/plugin-throttling`](https://github.com/octokit/plugin-throttling.js) plugin and [wires
+  it up with the internal GitHub Octokit instance](https://github.com/actions/toolkit/tree/457303960f03375db6f033e214b9f90d79c3fe5c/packages/github#extending-the-octokit-instance).
+
+  This plugin is recommended by [the Octokit docs](://octokit.github.io/rest.js/v19#throttling) as it implements all the GitHub [best practices for integrators](https://docs.github.com/en/rest/guides/best-practices-for-integrators?apiVersion=2022-11-28).
+
+  This should help with `changesets/action` gitting spurious secondary rate limits and failing CI jobs, for which the only known workaround is to simply re-run the job.
+
+## 1.4.1
+
+### Patch Changes
+
+- [#123](https://github.com/changesets/action/pull/123) [`b78f480`](https://github.com/changesets/action/commit/b78f48099899f0a853c5d9cd3feb21a5440babbd) Thanks [@Andarist](https://github.com/Andarist)! - Updated `@actions/*` dependencies to avoid using deprecated features of the runner.
+
+## 1.4.0
+
+### Minor Changes
+
+- [#216](https://github.com/changesets/action/pull/216) [`398d7ed`](https://github.com/changesets/action/commit/398d7ed) Thanks [@quinnjn](https://github.com/quinnjn)! - Execute action with node16 instead of node12.
+
+### Patch Changes
+
+- [#228](https://github.com/changesets/action/pull/228) [`bff53cc`](https://github.com/changesets/action/commit/bff53cc50c1ebb33f8f558f9de2e0eb9a99230c6) Thanks [@iansan5653](https://github.com/iansan5653)! - Add `is:pull-request` to search query when looking for existing PR. This fixes an issue with user-owned PATs.
+
+* [#206](https://github.com/changesets/action/pull/206) [`8c3f5f5`](https://github.com/changesets/action/commit/8c3f5f5637a95a2327e78d5dabcf357978aedcbb) Thanks [@glasser](https://github.com/glasser)! - Skip creating a PR when all existing changesets are empty.
+
 ## 1.3.0
 
 ### Minor Changes

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) Changesets team and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,217 +1,77 @@
-# Changesets Release Action
+# Changesets GitHub Action
 
-This action for [Changesets](https://github.com/atlassian/changesets) creates a pull request with all of the package versions updated and changelogs updated and when there are new changesets on master, the PR will be updated. When you're ready, you can merge the pull request and you can either publish the packages to npm manually or setup the action to do it for you.
+> [!IMPORTANT]
+> This is the development branch for `changesets/action` v2 compatible with Changesets v3. For the v1 code compatible with Changesets v2, check out the [`maintenance/v1`](https://github.com/changesets/action/tree/maintenance/v1) branch.
 
-## Usage
+This repo contains a collection of GitHub Actions for [Changesets](https://changesets.dev). Check out the [Automating Changesets](https://changesets.dev/guide/automating) guide to learn how to use these actions to automate your workflow.
 
-### Inputs
+- [changesets/action](./README.md): (This README. See below for details.)
+- [changesets/action/select-mode](./select-mode/README.md): Select the mode to run a Changesets workflow.
+- [changesets/action/version](./version/README.md): Version packages and create or update a pull request with the changes.
+- [changesets/action/pack](./pack/README.md): Pack publishable packages into tarballs.
+- [changesets/action/publish](./publish/README.md): Publish packages to npm.
+- [changesets/action/pr-status](./pr-status/README.md): Generate changeset status in PRs.
+- [changesets/action/pr-comment](./pr-comment/README.md): Create or update comments on PRs.
 
-- publish - The command to use to build and publish packages
-- version - The command to update version, edit CHANGELOG, read and delete changesets. Default to `changeset version` if not provided
-- commit - The commit message to use. Default to `Version Packages`
-- title - The pull request title. Default to `Version Packages`
-- setupGitUser - Sets up the git user for commits as `"github-actions[bot]"`. Default to `true`
-- cwd - Changes node's `process.cwd()` if the project is not located on the root. Default to `process.cwd()`
+## changesets/action
 
-### Outputs
+This action handles versioning and publishing of packages. It's the equivalent of setting up the `changesets/action/select-mode`, `changesets/action/version`, and `changesets/action/publish` actions in a workflow, but with the required permissions combined.
 
-- published - A boolean value to indicate whether a publishing is happened or not
-- publishedPackages - A JSON array to present the published packages. The format is `[{"name": "@xx/xx", "version": "1.2.0"}, {"name": "@xx/xy", "version": "0.8.9"}]`
+If using [trusted publishing](https://docs.npmjs.com/trusted-publishers), it's recommended to set up the individual sub-actions instead to tighten publish permissions.
 
-### Example workflow:
+### Requirements
 
-#### Without Publishing
+- Needs repo checked out and `@changesets/cli` installed
+- [Job permissions][job-permissions]:
+  - `contents: write`: to commit version changes
+  - `pull-requests: write`: to create pull request
+  - `id-token: write`: if using [trusted publishing](https://docs.npmjs.com/trusted-publishers)
+- [Workflow triggers][workflow-triggers]: _any_
 
-Create a file at `.github/workflows/release.yml` with the following content.
+> [!NOTE]
+> In your repository settings, in `Actions > General`, also ensure the `Allow GitHub Actions to create and approve pull requests` option is enabled
 
-```yml
-name: Release
+### Usage
 
-on:
-  push:
-    branches:
-      - master
+> [!TIP]
+> Check out [the docs](https://changesets.dev/guide/automating#how-do-i-run-the-version-and-publish-commands) to learn how to set up the version and publish workflow.
 
-concurrency: ${{ github.workflow }}-${{ github.ref }}
+> [!IMPORTANT]
+> To use a custom GitHub token, pass it explicitly through the `github-token` input:
+>
+> ```yaml
+> with:
+>   github-token: ${{ secrets.CUSTOM_GITHUB_TOKEN }}
+> ```
+>
+> Setting the `GITHUB_TOKEN` environment variable does not configure the action. This applies whether release changes are pushed using the GitHub API or the Git CLI.
 
-jobs:
-  release:
-    name: Release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v2
+### API
 
-      - name: Setup Node.js 12.x
-        uses: actions/setup-node@v2
-        with:
-          node-version: 12.x
+<!-- api-start -->
 
-      - name: Install Dependencies
-        run: yarn
+| Inputs                   | Description                                                                                                                                                                                                                                               |
+| ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `github-token`           | The GitHub token to use for authentication. Defaults to the GitHub-provided token. To use a custom token, pass it explicitly to this input.                                                                                                               |
+| `publish-script`         | The command to use to build and publish packages                                                                                                                                                                                                          |
+| `version-script`         | The command to update version, edit CHANGELOG, read and delete changesets. Default to `changeset version` if not provided                                                                                                                                 |
+| `commit-message`         | The commit message. Default to `Version Packages`                                                                                                                                                                                                         |
+| `pr-title`               | The pull request title. Default to `Version Packages`                                                                                                                                                                                                     |
+| `pr-draft`               | Controls draft PR behavior. Use 'create' to create new version PRs as draft, or 'always' to also convert existing version PRs back to draft when updating them.                                                                                           |
+| `pr-base-branch`         | Sets the base branch of the PR. Defaults to `github.ref_name`.                                                                                                                                                                                            |
+| `create-github-releases` | Whether to create Github releases after publish                                                                                                                                                                                                           |
+| `push-git-tags`          | Whether to create git tags after publish. If `create-github-releases` is set to `true`, this option will also always be `true`.                                                                                                                           |
+| `push-with-git-cli`      | Whether to use the Git CLI instead of the GitHub API to push release commits and tags. Defaults to `false`. When using the GitHub API, commits and tags are signed using GitHub's GPG key and attributed to the user or app that owns the `github-token`. |
+| `cwd`                    | The working directory to execute Changesets in. Defaults to the root of the repository.                                                                                                                                                                   |
 
-      - name: Create Release Pull Request
-        uses: changesets/action@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-```
+| Outputs              | Description                                                                                                                                      |
+| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `published`          | A "true" or "false" string value to indicate whether a publishing is happened or not                                                             |
+| `published-packages` | A JSON array to present the published packages. The format is `[{"name": "@xx/xx", "version": "1.2.0"}, {"name": "@xx/xy", "version": "0.8.9"}]` |
+| `has-changesets`     | A "true" or "false" string value about whether there were changesets. Useful if you want to create your own publishing functionality.            |
+| `pr-number`          | The pull request number that was created or updated                                                                                              |
 
-#### With Publishing
+<!-- api-end -->
 
-Before you can setup this action with publishing, you'll need to have an [npm token](https://docs.npmjs.com/creating-and-viewing-authentication-tokens) that can publish the packages in the repo you're setting up the action for and doesn't have 2FA on publish enabled ([2FA on auth can be enabled](https://docs.npmjs.com/about-two-factor-authentication)). You'll also need to [add it as a secret on your GitHub repo](https://help.github.com/en/articles/virtual-environments-for-github-actions#creating-and-using-secrets-encrypted-variables) with the name `NPM_TOKEN`. Once you've done that, you can create a file at `.github/workflows/release.yml` with the following content.
-
-```yml
-name: Release
-
-on:
-  push:
-    branches:
-      - master
-
-concurrency: ${{ github.workflow }}-${{ github.ref }}
-
-jobs:
-  release:
-    name: Release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v2
-
-      - name: Setup Node.js 12.x
-        uses: actions/setup-node@v2
-        with:
-          node-version: 12.x
-
-      - name: Install Dependencies
-        run: yarn
-
-      - name: Create Release Pull Request or Publish to npm
-        id: changesets
-        uses: changesets/action@v1
-        with:
-          # This expects you to have a script called release which does a build for your packages and calls changeset publish
-          publish: yarn release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Send a Slack notification if a publish happens
-        if: steps.changesets.outputs.published == 'true'
-        # You can do something when a publish happens.
-        run: my-slack-bot send-notification --message "A new version of ${GITHUB_REPOSITORY} was published!"
-```
-
-By default the GitHub Action creates a `.npmrc` file with the following content:
-
-```
-//registry.npmjs.org/:_authToken=${process.env.NPM_TOKEN}
-```
-
-However, if a `.npmrc` file is found, the GitHub Action does not recreate the file. This is useful if you need to configure the `.npmrc` file on your own.
-For example, you can add a step before running the Changesets GitHub Action:
-
-```yml
-- name: Creating .npmrc
-  run: |
-    cat << EOF > "$HOME/.npmrc"
-      email=my@email.com
-      //registry.npmjs.org/:_authToken=$NPM_TOKEN
-    EOF
-  env:
-    NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-```
-
-#### Custom Publishing
-
-If you want to hook into when publishing should occur but have your own publishing functionality you can utilize the `hasChangesets` output.
-
-Note that you might need to account for things already being published in your script because a commit without any new changesets can always land on your base branch after a successful publish. In such a case you need to figure out on your own how to skip over the actual publishing logic or handle errors gracefully as most package registries won't allow you to publish over already published version.
-
-```yml
-name: Release
-
-on:
-  push:
-    branches:
-      - master
-
-jobs:
-  release:
-    name: Release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v2
-
-      - name: Setup Node.js 12.x
-        uses: actions/setup-node@v2
-        with:
-          node-version: 12.x
-
-      - name: Install Dependencies
-        run: yarn
-
-      - name: Create Release Pull Request or Publish to npm
-        id: changesets
-        uses: changesets/action@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Publish
-        if: steps.changesets.outputs.hasChangesets == 'false'
-        # You can do something when a publish should happen.
-        run: yarn publish
-```
-
-#### With version script
-
-If you need to add additional logic to the version command, you can do so by using a version script.
-
-If the version script is present, this action will run that script instead of `changeset version`, so please make sure that your script calls `changeset version` at some point. All the changes made by the script will be included in the PR.
-
-```yml
-name: Release
-
-on:
-  push:
-    branches:
-      - master
-
-concurrency: ${{ github.workflow }}-${{ github.ref }}
-
-jobs:
-  release:
-    name: Release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v2
-
-      - name: Setup Node.js 12.x
-        uses: actions/setup-node@v2
-        with:
-          node-version: 12.x
-
-      - name: Install Dependencies
-        run: yarn
-
-      - name: Create Release Pull Request
-        uses: changesets/action@v1
-        with:
-          # this expects you to have a npm script called version that runs some logic and then calls `changeset version`.
-          version: yarn version
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-```
-
-#### With Yarn 2 / Plug'n'Play
-
-If you are using [Yarn Plug'n'Play](https://yarnpkg.com/features/pnp), you should use a custom `version` command so that the action can resolve the `changeset` CLI:
-
-```yaml
-- uses: changesets/action@v1
-  with:
-    version: yarn changeset version
-    ...
-```
+[job-permissions]: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idpermissions
+[workflow-triggers]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows

__fixtures__/ignored-package/.changeset/config.json

@@ -1,4 +0,0 @@
-{
-  "$schema": "https://unpkg.com/@changesets/config@1.3.0/schema.json",
-  "ignore": ["ignored-package-pkg-a"]
-}

__fixtures__/ignored-package/package.json

@@ -1,8 +0,0 @@
-{
-  "private": true,
-  "name": "ignored-package",
-  "version": "1.0.0",
-  "workspaces": [
-    "packages/*"
-  ]
-}

__fixtures__/ignored-package/packages/pkg-a/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "ignored-package-pkg-a",
-  "version": "1.0.0",
-  "dependencies": {
-    "ignored-package-pkg-b": "1.0.0"
-  }
-}

__fixtures__/ignored-package/packages/pkg-b/package.json

@@ -1,4 +0,0 @@
-{
-  "name": "ignored-package-pkg-b",
-  "version": "1.0.0"
-}

__fixtures__/simple-project/.changeset/config.json

@@ -1,3 +0,0 @@
-{
-  "$schema": "https://unpkg.com/@changesets/config@1.3.0/schema.json"
-}

__fixtures__/simple-project/package.json

@@ -1,8 +0,0 @@
-{
-  "private": true,
-  "name": "simple-project",
-  "version": "1.0.0",
-  "workspaces": [
-    "packages/*"
-  ]
-}

__fixtures__/simple-project/packages/pkg-a/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "simple-project-pkg-a",
-  "version": "1.0.0",
-  "dependencies": {
-    "simple-project-pkg-b": "1.0.0"
-  }
-}

__fixtures__/simple-project/packages/pkg-b/package.json

@@ -1,4 +0,0 @@
-{
-  "name": "simple-project-pkg-b",
-  "version": "1.0.0"
-}

action.yml

@@ -1,42 +1,64 @@
 name: Changesets
 description: A GitHub action to automate releases with Changesets
 runs:
-  using: "node12"
+  using: "node24"
   main: "dist/index.js"
 inputs:
-  publish:
+  github-token:
+    description: >
+      The GitHub token to use for authentication. Defaults to the GitHub-provided token.
+      To use a custom token, pass it explicitly to this input.
+    required: false
+    default: ${{ github.token }}
+  publish-script:
     description: "The command to use to build and publish packages"
     required: false
-  version:
+  version-script:
     description: "The command to update version, edit CHANGELOG, read and delete changesets. Default to `changeset version` if not provided"
     required: false
+  commit-message:
+    description: "The commit message. Default to `Version Packages`"
+    required: false
+    default: "Version Packages"
+  pr-title:
+    description: "The pull request title. Default to `Version Packages`"
+    required: false
+    default: "Version Packages"
+  pr-draft:
+    description: "Controls draft PR behavior. Use 'create' to create new version PRs as draft, or 'always' to also convert existing version PRs back to draft when updating them."
+    required: false
+  pr-base-branch:
+    description: "Sets the base branch of the PR. Defaults to `github.ref_name`."
+    required: false
+  create-github-releases:
+    description: "Whether to create Github releases after publish"
+    required: false
+    default: true
+  push-git-tags:
+    description: >
+      Whether to create git tags after publish. If `create-github-releases` is set to `true`,
+      this option will also always be `true`.
+    required: false
+    default: true
+  push-with-git-cli:
+    description: >
+      Whether to use the Git CLI instead of the GitHub API to push release commits and tags.
+      Defaults to `false`. When using the GitHub API, commits and tags are signed using
+      GitHub's GPG key and attributed to the user or app that owns the `github-token`.
+    required: false
+    default: false
   cwd:
-    description: Sets the cwd for the node process. Default to `process.cwd()`
+    description: "The working directory to execute Changesets in. Defaults to the root of the repository."
     required: false
-  commit:
-    description: |
-      The commit message. Default to `Version Packages`
-    required: false
-  title:
-    description: The pull request title. Default to `Version Packages`
-    required: false
-  setupGitUser:
-    description: Sets up the git user for commits as `"github-actions[bot]"`. Default to `true`
-    required: false
-    default: true
-  createGithubReleases:
-    description: "A boolean value to indicate whether to create Github releases after `publish` or not"
-    required: false
-    default: true
 outputs:
   published:
-    description: A boolean value to indicate whether a publishing is happened or not
-  publishedPackages:
+    description: A "true" or "false" string value to indicate whether a publishing is happened or not
+  published-packages:
     description: >
       A JSON array to present the published packages. The format is `[{"name": "@xx/xx", "version": "1.2.0"}, {"name": "@xx/xy", "version": "0.8.9"}]`
-  hasChangesets:
-    description: A boolean about whether there were changesets. Useful if you want to create your own publishing functionality.
-  pullRequestNumber:
+  has-changesets:
+    description: A "true" or "false" string value about whether there were changesets. Useful if you want to create your own publishing functionality.
+  pr-number:
     description: The pull request number that was created or updated
 branding:
   icon: "package"

pack/README.md

@@ -0,0 +1,32 @@
+# changesets/action/pack
+
+This action packs publishable packages into tarballs, complements [changesets/action/publish](../publish/README.md) to publish them in a later step.
+
+## Requirements
+
+- Needs repo checked out and `@changesets/cli` installed
+- [Job permissions][job-permissions]: _none_
+- [Workflow triggers][workflow-triggers]: _any_
+
+## Usage
+
+> [!TIP]
+> Check out [the docs](https://changesets.dev/guide/automating#how-do-i-run-the-version-and-publish-commands) to learn how to set up the version and publish workflow.
+
+## API
+
+<!-- api-start -->
+
+| Inputs                     | Description                                                                             |
+| -------------------------- | --------------------------------------------------------------------------------------- |
+| `publish-plan-artifact-id` | Artifact id for a publish plan generated by the select-mode subaction                   |
+| `cwd`                      | The working directory to execute Changesets in. Defaults to the root of the repository. |
+
+| Outputs                | Description                                 |
+| ---------------------- | ------------------------------------------- |
+| `pack-dir-artifact-id` | Artifact id for the packed output directory |
+
+<!-- api-end -->
+
+[job-permissions]: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idpermissions
+[workflow-triggers]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows

pack/action.yml

@@ -0,0 +1,18 @@
+name: Changesets - Pack
+description: Pack publishable packages into tarballs
+runs:
+  using: node24
+  main: ../dist/pack.js
+inputs:
+  publish-plan-artifact-id:
+    description: "Artifact id for a publish plan generated by the select-mode subaction"
+    required: false
+  cwd:
+    description: "The working directory to execute Changesets in. Defaults to the root of the repository."
+    required: false
+outputs:
+  pack-dir-artifact-id:
+    description: "Artifact id for the packed output directory"
+branding:
+  icon: package
+  color: blue

package.json

@@ -1,52 +1,58 @@
 {
   "name": "@changesets/action",
-  "version": "1.3.0",
-  "main": "dist/index.js",
+  "version": "2.1.2",
+  "private": true,
   "license": "MIT",
-  "devDependencies": {
-    "@changesets/changelog-github": "^0.4.2",
-    "@changesets/cli": "^2.20.0",
-    "@changesets/write": "^0.1.6",
-    "fixturez": "^1.1.0",
-    "parcel": "^1.12.3",
-    "prettier": "^2.0.5",
-    "typescript": "^3.5.3"
-  },
+  "type": "module",
+  "main": "dist/index.js",
   "scripts": {
-    "build": "parcel build ./src/index.ts --no-source-maps --target=node --bundle-node-modules",
-    "test": "jest",
-    "test:watch": "yarn test --watch",
+    "build": "rolldown -c",
+    "test": "vitest",
+    "test:watch": "pnpm test --watch",
+    "typecheck": "tsc",
+    "format": "oxfmt --check",
+    "format:fix": "oxfmt",
     "changeset": "changeset",
-    "bump": "node ./scripts/bump.js",
-    "release": "node ./scripts/release.js"
+    "bump": "node ./scripts/bump.ts",
+    "update-readme": "node ./scripts/update-readme.ts",
+    "release": "node ./scripts/release.ts",
+    "release:pr": "node ./scripts/release-pr.ts"
   },
   "dependencies": {
-    "@actions/core": "^1.3.0",
-    "@actions/exec": "^1.1.0",
-    "@actions/github": "^4.0.0",
-    "@babel/core": "^7.13.10",
-    "@babel/preset-env": "^7.13.10",
-    "@babel/preset-typescript": "^7.13.0",
-    "@changesets/pre": "^1.0.9",
-    "@changesets/read": "^0.5.3",
-    "@manypkg/get-packages": "^1.1.3",
-    "@types/fs-extra": "^8.0.0",
-    "@types/jest": "^24.0.18",
-    "@types/node": "^12.7.1",
-    "@types/semver": "^6.0.2",
-    "babel-jest": "^24.9.0",
-    "fs-extra": "^8.1.0",
-    "husky": "^3.0.3",
-    "jest": "^24.9.0",
-    "mdast-util-to-string": "^1.0.6",
-    "remark-parse": "^7.0.1",
-    "remark-stringify": "^7.0.3",
-    "resolve-from": "^5.0.0",
-    "semver": "^6.3.0",
-    "unified": "^8.3.2"
+    "@actions/artifact": "^6.2.1",
+    "@actions/core": "^3.0.1",
+    "@actions/exec": "^3.0.0",
+    "@actions/github": "^9.1.1",
+    "@changesets/get-release-plan": "^5.0.2",
+    "@changesets/ghcommit": "^3.0.0",
+    "@changesets/git": "^4.0.1",
+    "@changesets/pre": "^3.0.0",
+    "@changesets/read": "^1.0.1",
+    "@manypkg/get-packages": "^3.1.0",
+    "@octokit/core": "^7.0.8",
+    "@octokit/plugin-throttling": "^11.0.5",
+    "human-id": "^4.2.1",
+    "markdown-table": "^3.0.4",
+    "semver": "^7.8.5",
+    "tinyexec": "^1.3.1"
   },
-  "husky": {
-    "hooks": {}
+  "devDependencies": {
+    "@changesets/changelog-github": "^1.0.1",
+    "@changesets/cli": "^3.0.3",
+    "@changesets/types": "^7.0.0",
+    "@changesets/write": "^1.0.1",
+    "@tsconfig/node24": "^24.0.5",
+    "@types/node": "^26.6.2",
+    "@types/semver": "^7.8.0",
+    "fs-fixture": "^2.16.0",
+    "oxfmt": "^0.70.0",
+    "rolldown": "^1.2.10",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.1",
+    "yaml": "^2.9.1"
   },
-  "prettier": {}
+  "engines": {
+    "node": ">=24"
+  },
+  "packageManager": "pnpm@11.20.0+sha512.9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee"
 }

pnpm-workspace.yaml

@@ -0,0 +1,30 @@
+blockExoticSubdeps: true
+dedupePeers: true
+dedupePeerDependents: true
+minimumReleaseAge: 10080
+minimumReleaseAgeExclude:
+  - "@changesets/apply-release-plan@8.0.0"
+  - "@changesets/assemble-release-plan@7.0.0"
+  - "@changesets/changelog-git@1.0.0"
+  - "@changesets/changelog-github@1.0.0"
+  - "@changesets/cli@3.0.0"
+  - "@changesets/config@4.0.0"
+  - "@changesets/errors@1.0.0"
+  - "@changesets/get-dependents-graph@3.0.0"
+  - "@changesets/get-github-info@1.0.0"
+  - "@changesets/get-release-plan@5.0.0"
+  - "@changesets/git@4.0.0"
+  - "@changesets/parse@1.0.0"
+  - "@changesets/pre@3.0.0"
+  - "@changesets/read@1.0.0"
+  - "@changesets/should-skip-package@1.0.0"
+  - "@changesets/types@7.0.0"
+  - "@changesets/write@1.0.0"
+  - "vite@8.2.0"
+
+overrides:
+  lightningcss: "-" # we do not bundle any css
+  postcss: "-" # we do not bundle any css
+
+shellEmulator: true
+trustPolicy: no-downgrade

pr-comment/README.md

@@ -0,0 +1,89 @@
+# changesets/action/pr-comment
+
+This action creates or updates comments on PRs, aimed to complement [changesets/action/pr-status](../pr-status/README.md).
+
+Its features are kept intentionally simple. For advanced usecases, check out other actions such as [mshick/add-pr-comment](https://github.com/marketplace/actions/add-pr-comment) and [peter-evans/create-or-update-comment](https://github.com/marketplace/actions/create-or-update-comment).
+
+## Requirements
+
+- [Job permissions][job-permissions]:
+  - `pull-requests: write`: to create and update comments on PRs
+- [Workflow triggers][workflow-triggers]:
+  - [`pull_request`][trigger-pull-request]
+  - [`pull_request_target`][trigger-pull-request-target]
+
+> [!CAUTION]
+> **Do not run untrusted code** when using the `pull_request_target` event.
+>
+> `pull_request_target` can be useful to support PRs from forks, however it enables write permissions by default which can be a security risk if untrusted code is executed and the permissions aren't scoped down.
+
+## Usage
+
+> [!TIP]
+> Check out [the docs](https://changesets.dev/guide/automating#non-blocking) to learn how to set up commenting changesets status on PRs.
+
+```yaml
+on:
+  pull_request:
+
+jobs:
+  pr-comment:
+    runs-on: ubuntu-slim
+    permissions:
+      pull-requests: write # to create and update comments on PRs (changesets/action/pr-comment)
+    steps:
+      - name: Comment on PR
+        uses: changesets/action/pr-comment@v2
+        with:
+          body: Hello world!
+```
+
+If the action is called again for the same PR, for example, if called in another workflow run, it will update the comment it created by default.
+
+If you use the action to create different types of comments, pass an `update-id` value to differentiate them.
+
+```yaml
+jobs:
+  pr-comment:
+    # ...
+    steps:
+      - name: Comment on PR
+        uses: changesets/action/pr-comment@v2
+        with:
+          body: Hello world!
+          update-id: my-tag
+```
+
+If you want to always create new comments, pass an empty value to `update-id`.
+
+```yaml
+jobs:
+  pr-comment:
+    # ...
+    steps:
+      - uses: changesets/action/pr-comment@v2
+        with:
+          body: Hello world!
+          update-id: ""
+```
+
+## API
+
+<!-- api-start -->
+
+| Inputs         | Description                                                                                                                                                                         |
+| -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `github-token` | The GitHub token to use for authentication. Defaults to the GitHub-provided token. To use a custom token, pass it explicitly to this input.                                         |
+| `body`         | **Required.** The comment body to post on the PR.                                                                                                                                   |
+| `update-id`    | By default, the action will create and update a comment with this id. Pass a different id to create and update a new comment, or pass an empty string to disable updating comments. |
+
+| Outputs      | Description                                                |
+| ------------ | ---------------------------------------------------------- |
+| `comment-id` | The comment id of the comment that was created or updated. |
+
+<!-- api-end -->
+
+[job-permissions]: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idpermissions
+[workflow-triggers]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
+[trigger-pull-request]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request
+[trigger-pull-request-target]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target

pr-comment/action.yml

@@ -0,0 +1,27 @@
+name: Changesets - PR Comment
+description: Create or update comments on PRs
+runs:
+  using: node24
+  main: ../dist/pr-comment.js
+inputs:
+  github-token:
+    description: >
+      The GitHub token to use for authentication. Defaults to the GitHub-provided token.
+      To use a custom token, pass it explicitly to this input.
+    required: false
+    default: ${{ github.token }}
+  body:
+    description: "The comment body to post on the PR."
+    required: true
+  update-id:
+    description: >
+      By default, the action will create and update a comment with this id. Pass a different id to
+      create and update a new comment, or pass an empty string to disable updating comments.
+    required: false
+    default: "changesets-action-pr-comment"
+outputs:
+  comment-id:
+    description: "The comment id of the comment that was created or updated."
+branding:
+  icon: message-circle
+  color: blue

pr-status/README.md

@@ -0,0 +1,40 @@
+# changesets/action/pr-status
+
+This action generates the changesets status in PRs, for example, whether it has changeset files and which packages will be released if the PR is merged.
+
+It requires the repo to be checked out, and will automatically fetch the PR head ref into a temporary detached worktree in order to infer the changed files and packages.
+
+## Requirements
+
+- Needs repo checked out
+- [Job permissions][job-permissions]: _none_
+- [Workflow triggers][workflow-triggers]:
+  - [`pull_request`][trigger-pull-request]
+  - [`pull_request_target`][trigger-pull-request-target]
+
+> [!CAUTION]
+> **Do not run untrusted code** when using the `pull_request_target` event.
+>
+> `pull_request_target` can be useful to support PRs from forks, however it enables write permissions by default which can be a security risk if untrusted code is executed and the permissions aren't scoped down.
+
+[job-permissions]: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idpermissions
+[workflow-triggers]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
+[trigger-pull-request]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request
+[trigger-pull-request-target]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target
+
+## Usage
+
+> [!TIP]
+> Check out [the docs](https://changesets.dev/guide/automating#non-blocking) to learn how to set up commenting changesets status on PRs.
+
+## API
+
+<!-- api-start -->
+
+Inputs: _none_
+
+| Outputs        | Description                                                         |
+| -------------- | ------------------------------------------------------------------- |
+| `comment-body` | The generated comment body to present the changesets status in PRs. |
+
+<!-- api-end -->

pr-status/action.yml

@@ -0,0 +1,12 @@
+name: Changesets - PR Status
+description: Generate the changesets status in PRs
+runs:
+  using: node24
+  main: ../dist/pr-status.js
+inputs: {}
+outputs:
+  comment-body:
+    description: The generated comment body to present the changesets status in PRs.
+branding:
+  icon: package
+  color: blue

publish/README.md

@@ -0,0 +1,38 @@
+# changesets/action/publish
+
+This action publishes packages to npm.
+
+## Requirements
+
+- Needs repo checked out and `@changesets/cli` installed
+- [Job permissions][job-permissions]:
+  - `id-token: write`: if using [trusted publishing](https://docs.npmjs.com/trusted-publishers)
+- [Workflow triggers][workflow-triggers]: _any_
+
+## Usage
+
+> [!TIP]
+> Check out [the docs](https://changesets.dev/guide/automating#how-do-i-run-the-version-and-publish-commands) to learn how to set up the version and publish workflow.
+
+## API
+
+<!-- api-start -->
+
+| Inputs                   | Description                                                                                                                                 |
+| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------- |
+| `github-token`           | The GitHub token to use for authentication. Defaults to the GitHub-provided token. To use a custom token, pass it explicitly to this input. |
+| `script`                 | The command to use to publish packages                                                                                                      |
+| `pack-dir-artifact-id`   | Artifact id for packed publish output generated by the pack subaction                                                                       |
+| `create-github-releases` | Whether to create Github releases after publish                                                                                             |
+| `push-git-tags`          | Whether to create git tags after publish. If `create-github-releases` is set to `true`, this option will also always be `true`.             |
+| `cwd`                    | The working directory to execute Changesets in. Defaults to the root of the repository.                                                     |
+
+| Outputs              | Description                                                                                                                                      |
+| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `published`          | A "true" or "false" string value to indicate whether a publishing has happened or not                                                            |
+| `published-packages` | A JSON array to present the published packages. The format is `[{"name": "@xx/xx", "version": "1.2.0"}, {"name": "@xx/xy", "version": "0.8.9"}]` |
+
+<!-- api-end -->
+
+[job-permissions]: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idpermissions
+[workflow-triggers]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows

publish/action.yml

@@ -0,0 +1,40 @@
+name: Changesets - Publish
+description: Publish packages to npm
+runs:
+  using: node24
+  main: ../dist/publish.js
+inputs:
+  github-token:
+    description: >
+      The GitHub token to use for authentication. Defaults to the GitHub-provided token.
+      To use a custom token, pass it explicitly to this input.
+    required: false
+    default: ${{ github.token }}
+  script:
+    description: "The command to use to publish packages"
+    required: false
+  pack-dir-artifact-id:
+    description: "Artifact id for packed publish output generated by the pack subaction"
+    required: false
+  create-github-releases:
+    description: "Whether to create Github releases after publish"
+    required: false
+    default: true
+  push-git-tags:
+    description: >
+      Whether to create git tags after publish. If `create-github-releases` is set to `true`,
+      this option will also always be `true`.
+    required: false
+    default: true
+  cwd:
+    description: "The working directory to execute Changesets in. Defaults to the root of the repository."
+    required: false
+outputs:
+  published:
+    description: A "true" or "false" string value to indicate whether a publishing has happened or not
+  published-packages:
+    description: >
+      A JSON array to present the published packages. The format is `[{"name": "@xx/xx", "version": "1.2.0"}, {"name": "@xx/xy", "version": "0.8.9"}]`
+branding:
+  icon: package
+  color: blue

rolldown.config.js

@@ -0,0 +1,21 @@
+import { defineConfig } from "rolldown";
+
+export default defineConfig({
+  input: {
+    index: "src/index.ts",
+    pack: "src/pack/index.ts",
+    "pr-status": "src/pr-status/index.ts",
+    "pr-comment": "src/pr-comment/index.ts",
+    "select-mode": "src/select-mode/index.ts",
+    version: "src/version/index.ts",
+    publish: "src/publish/index.ts",
+  },
+  output: {
+    dir: "dist",
+    format: "esm",
+    cleanDir: true,
+    minify: true,
+    comments: false,
+  },
+  platform: "node",
+});

scripts/bump.js

@@ -1,19 +0,0 @@
-const fs = require("fs");
-const path = require("path");
-const { exec } = require("@actions/exec");
-
-process.chdir(path.join(__dirname, ".."));
-
-(async () => {
-  await exec("changeset", ["version"]);
-
-  const releaseLine = `v${require("../package.json").version.split(".")[0]}`;
-
-  const readmePath = path.join(__dirname, "..", "README.md");
-  const content = fs.readFileSync(readmePath, "utf8");
-  const updatedContent = content.replace(
-    /changesets\/action@[^\s]+/g,
-    `changesets/action@${releaseLine}`
-  );
-  fs.writeFileSync(readmePath, updatedContent);
-})();

scripts/bump.ts

@@ -0,0 +1,20 @@
+import fs from "node:fs";
+import path from "node:path";
+import { exec } from "@actions/exec";
+
+process.chdir(path.join(import.meta.dirname, ".."));
+
+await exec("changeset", ["version"]);
+
+// read after versioning to get the new version
+const pkgJson = (await import("../package.json", { with: { type: "json" } }))
+  .default;
+const releaseLine = `v${pkgJson.version.split(".")[0]}`;
+
+const readmePath = path.join(import.meta.dirname, "..", "README.md");
+const content = fs.readFileSync(readmePath, "utf8");
+const updatedContent = content.replace(
+  /changesets\/action@[^\s]+/g,
+  `changesets/action@${releaseLine}`,
+);
+fs.writeFileSync(readmePath, updatedContent);

scripts/release-pr.ts

@@ -0,0 +1,32 @@
+import { Buffer } from "node:buffer";
+import path from "node:path";
+import { exec } from "@actions/exec";
+import pkgJson from "../package.json" with { type: "json" };
+
+const tag = `v${pkgJson.version}`;
+const releaseLine = "pr-release";
+const githubToken = process.env.GITHUB_TOKEN;
+if (!githubToken) {
+  throw new Error("GITHUB_TOKEN is required");
+}
+const basic = Buffer.from(`x-access-token:${githubToken}`).toString("base64");
+const gitEnv = {
+  ...process.env,
+  GIT_CONFIG_COUNT: "1",
+  GIT_CONFIG_KEY_0: "http.https://github.com/.extraheader",
+  GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${basic}`,
+};
+
+process.chdir(path.join(import.meta.dirname, ".."));
+
+await exec("git", ["checkout", "--detach"]);
+await exec("git", ["add", "--force", "dist"]);
+await exec("git", ["commit", "-m", tag]);
+
+await exec(
+  "git",
+  ["push", "--force", "origin", `HEAD:refs/heads/${releaseLine}`],
+  {
+    env: gitEnv,
+  },
+);

scripts/release.js

@@ -1,41 +0,0 @@
-const path = require("path");
-const { exec, getExecOutput } = require("@actions/exec");
-
-const { version } = require("../package.json");
-const tag = `v${version}`;
-const releaseLine = `v${version.split(".")[0]}`;
-
-process.chdir(path.join(__dirname, ".."));
-
-(async () => {
-  const { exitCode, stderr } = await getExecOutput(
-    `git`,
-    ["ls-remote", "--exit-code", "origin", "--tags", `refs/tags/${tag}`],
-    {
-      ignoreReturnCode: true,
-    }
-  );
-  if (exitCode === 0) {
-    console.log(
-      `Action is not being published because version ${tag} is already published`
-    );
-    return;
-  }
-  if (exitCode !== 2) {
-    throw new Error(`git ls-remote exited with ${exitCode}:\n${stderr}`);
-  }
-
-  await exec("git", ["checkout", "--detach"]);
-  await exec("git", ["add", "--force", "dist"]);
-  await exec("git", ["commit", "-m", tag]);
-
-  await exec("changeset", ["tag"]);
-
-  await exec("git", [
-    "push",
-    "--force",
-    "--follow-tags",
-    "origin",
-    `HEAD:refs/heads/${releaseLine}`,
-  ]);
-})();

scripts/release.ts

@@ -0,0 +1,47 @@
+import { Buffer } from "node:buffer";
+import path from "node:path";
+import { exec } from "@actions/exec";
+import pkgJson from "../package.json" with { type: "json" };
+
+const tag = `v${pkgJson.version}`;
+const releaseLine = `v${pkgJson.version.split(".")[0]}`;
+const isPrerelease = pkgJson.version.includes("-");
+const githubToken = process.env.GITHUB_TOKEN;
+if (!githubToken) {
+  throw new Error("GITHUB_TOKEN is required");
+}
+const basic = Buffer.from(`x-access-token:${githubToken}`).toString("base64");
+const gitEnv = {
+  ...process.env,
+  GIT_CONFIG_COUNT: "1",
+  GIT_CONFIG_KEY_0: "http.https://github.com/.extraheader",
+  GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${basic}`,
+};
+
+process.chdir(path.join(import.meta.dirname, ".."));
+
+await exec("git", ["checkout", "--detach"]);
+await exec("git", ["add", "--force", "dist"]);
+await exec("git", ["commit", "-m", tag]);
+
+await exec("changeset", ["git-tag"]);
+
+if (isPrerelease) {
+  await exec("git", ["push", "origin", `refs/tags/${tag}`], {
+    env: gitEnv,
+  });
+} else {
+  await exec(
+    "git",
+    [
+      "push",
+      "--force",
+      "--follow-tags",
+      "origin",
+      `HEAD:refs/heads/${releaseLine}`,
+    ],
+    {
+      env: gitEnv,
+    },
+  );
+}

scripts/update-readme.ts

@@ -0,0 +1,46 @@
+import * as fs from "node:fs/promises";
+import path from "node:path";
+import { markdownTable } from "markdown-table";
+import * as yaml from "yaml";
+
+await main();
+
+async function main() {
+  for await (const readmePath of fs.glob("**/README.md", {
+    exclude: ["**/node_modules/**"],
+  })) {
+    const actionPath = path.join(path.dirname(readmePath), "action.yml");
+    const actionExists = await fs.stat(actionPath).catch(() => null);
+    if (!actionExists) continue;
+
+    const action = yaml.parse(await fs.readFile(actionPath, "utf8"));
+    const inputs = action.inputs ?? {};
+    const outputs = action.outputs ?? {};
+
+    const content = [
+      renderSection("Inputs", inputs),
+      renderSection("Outputs", outputs),
+    ].join("\n\n");
+
+    const readme = await fs.readFile(readmePath, "utf8");
+    const updated = readme.replace(
+      /<!-- api-start -->[\s\S]*?<!-- api-end -->/,
+      `<!-- api-start -->\n\n${content}\n\n<!-- api-end -->`,
+    );
+    await fs.writeFile(readmePath, updated);
+  }
+}
+
+function renderSection(title: string, entries: Record<string, any>) {
+  const rows: string[][] = [];
+  for (const [name, entry] of Object.entries(entries)) {
+    let description = (entry.description ?? "").trim().replace(/\|/g, "\\|");
+    if (entry.required) description = `**Required.** ${description}`;
+    rows.push([`\`${name}\``, description]);
+  }
+  if (rows.length === 0) {
+    return `${title}: _none_`;
+  }
+  rows.unshift([title, "Description"]);
+  return markdownTable(rows);
+}

select-mode/README.md

@@ -0,0 +1,35 @@
+# changesets/action/select-mode
+
+This action selects the mode to run a Changesets workflow:
+
+- `"version"`: Changesets are found. The workflow should version packages and create a pull request with the changes.
+- `"publish"`: No changesets are found and they are publishable packages. The workflow should publish them.
+- `"none"`: No changesets are found and there are no publishable packages. The workflow should do nothing.
+
+## Requirements
+
+- [Job permissions][job-permissions]: _none_
+- [Workflow triggers][workflow-triggers]: _any_
+
+## Usage
+
+> [!TIP]
+> Check out [the docs](https://changesets.dev/guide/automating#how-do-i-run-the-version-and-publish-commands) to learn how to set up the version and publish workflow.
+
+## API
+
+<!-- api-start -->
+
+| Inputs | Description                                                                             |
+| ------ | --------------------------------------------------------------------------------------- |
+| `cwd`  | The working directory to execute Changesets in. Defaults to the root of the repository. |
+
+| Outputs                    | Description                                                                  |
+| -------------------------- | ---------------------------------------------------------------------------- |
+| `mode`                     | The mode to use for the current repo state: 'version', 'publish', or 'none'. |
+| `publish-plan-artifact-id` | Artifact id for the generated publish plan when mode is `publish`            |
+
+<!-- api-end -->
+
+[job-permissions]: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idpermissions
+[workflow-triggers]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows

select-mode/action.yml

@@ -0,0 +1,17 @@
+name: Changesets - Select Mode
+description: Whether to version or publish in the current repo state
+runs:
+  using: node24
+  main: ../dist/select-mode.js
+inputs:
+  cwd:
+    description: "The working directory to execute Changesets in. Defaults to the root of the repository."
+    required: false
+outputs:
+  mode:
+    description: "The mode to use for the current repo state: 'version', 'publish', or 'none'."
+  publish-plan-artifact-id:
+    description: "Artifact id for the generated publish plan when mode is `publish`"
+branding:
+  icon: package
+  color: blue

src/__snapshots__/run.test.ts.snap

@@ -1,14 +1,36 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
 
-exports[`version creates simple PR 1`] = `
-Array [
-  Object {
+exports[`version > creates a draft PR when prDraft is "create" 1`] = `
+[
+  {
     "base": "some-branch",
     "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
 
 
 # Releases
-## simple-project-pkg-a@1.1.0
+## changesets-dev-simple-project-pkg-a@1.1.0
+
+### Minor Changes
+
+- Awesome feature",
+    "draft": true,
+    "head": "changeset-release/some-branch",
+    "owner": "changesets",
+    "repo": "action",
+    "title": "Version Packages",
+  },
+]
+`;
+
+exports[`version > creates simple PR 1`] = `
+[
+  {
+    "base": "some-branch",
+    "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
+
+
+# Releases
+## changesets-dev-simple-project-pkg-a@1.1.0
 
 ### Minor Changes
 
@@ -17,14 +39,13 @@ Array [
 ### Patch Changes
 
 - Updated dependencies
-    -   simple-project-pkg-b@1.1.0
-
-## simple-project-pkg-b@1.1.0
+  - changesets-dev-simple-project-pkg-b@1.1.0
+## changesets-dev-simple-project-pkg-b@1.1.0
 
 ### Minor Changes
 
--   Awesome feature
-",
+- Awesome feature",
+    "draft": false,
     "head": "changeset-release/some-branch",
     "owner": "changesets",
     "repo": "action",
@@ -33,9 +54,9 @@ Array [
 ]
 `;
 
-exports[`version does not include any release information if a message with simplified release info exceeds size limit 1`] = `
-Array [
-  Object {
+exports[`version > does not include any release information if a message with simplified release info exceeds size limit 1`] = `
+[
+  {
     "base": "some-branch",
     "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
 
@@ -43,6 +64,7 @@ Array [
 # Releases
 
 > All release information have been omitted from this message, as the content exceeds the size limit.",
+    "draft": false,
     "head": "changeset-release/some-branch",
     "owner": "changesets",
     "repo": "action",
@@ -51,9 +73,9 @@ Array [
 ]
 `;
 
-exports[`version does not include changelog entries if full message exceeds size limit 1`] = `
-Array [
-  Object {
+exports[`version > does not include changelog entries if full message exceeds size limit 1`] = `
+[
+  {
     "base": "some-branch",
     "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
 
@@ -62,9 +84,10 @@ Array [
 
 > The changelog information of each package has been omitted from this message, as the content exceeds the size limit.
 
-## simple-project-pkg-a@1.1.0
+## changesets-dev-simple-project-pkg-a@1.1.0
 
 ",
+    "draft": false,
     "head": "changeset-release/some-branch",
     "owner": "changesets",
     "repo": "action",
@@ -73,20 +96,20 @@ Array [
 ]
 `;
 
-exports[`version doesn't include ignored package that got a dependency update in the PR body 1`] = `
-Array [
-  Object {
+exports[`version > doesn't include ignored package that got a dependency update in the PR body 1`] = `
+[
+  {
     "base": "some-branch",
     "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
 
 
 # Releases
-## ignored-package-pkg-b@1.1.0
+## changesets-dev-ignored-package-pkg-b@1.1.0
 
 ### Minor Changes
 
--   Awesome feature
-",
+- Awesome feature",
+    "draft": false,
     "head": "changeset-release/some-branch",
     "owner": "changesets",
     "repo": "action",
@@ -95,20 +118,20 @@ Array [
 ]
 `;
 
-exports[`version only includes bumped packages in the PR body 1`] = `
-Array [
-  Object {
+exports[`version > only includes bumped packages in the PR body 1`] = `
+[
+  {
     "base": "some-branch",
     "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
 
 
 # Releases
-## simple-project-pkg-a@1.1.0
+## changesets-dev-simple-project-pkg-a@1.1.0
 
 ### Minor Changes
 
--   Awesome feature
-",
+- Awesome feature",
+    "draft": false,
     "head": "changeset-release/some-branch",
     "owner": "changesets",
     "repo": "action",
@@ -116,3 +139,92 @@ Array [
   },
 ]
 `;
+
+exports[`version > updates an existing PR via GraphQL and converts it to draft when prDraft is "always" 1`] = `
+[
+  "
+      mutation UpdatePullRequest(
+        $pullRequestId: ID!
+        $title: String!
+        $body: String!
+      ) {
+        
+        convertPullRequestToDraft(
+          input: {
+            pullRequestId: $pullRequestId
+          }
+        ) {
+          pullRequest {
+            id
+          }
+        }
+
+        updatePullRequest(
+          input: {
+            pullRequestId: $pullRequestId
+            title: $title
+            body: $body
+            state: OPEN
+          }
+        ) {
+          pullRequest {
+            id
+          }
+        }
+      }
+    ",
+  {
+    "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
+
+
+# Releases
+## changesets-dev-simple-project-pkg-a@1.1.0
+
+### Minor Changes
+
+- Awesome feature",
+    "pullRequestId": "PR_kwDOA",
+    "title": "Version Packages",
+  },
+]
+`;
+
+exports[`version > updates an existing PR via GraphQL without converting it to draft when prDraft is "create" 1`] = `
+[
+  "
+      mutation UpdatePullRequest(
+        $pullRequestId: ID!
+        $title: String!
+        $body: String!
+      ) {
+        
+
+        updatePullRequest(
+          input: {
+            pullRequestId: $pullRequestId
+            title: $title
+            body: $body
+            state: OPEN
+          }
+        ) {
+          pullRequest {
+            id
+          }
+        }
+      }
+    ",
+  {
+    "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
+
+
+# Releases
+## changesets-dev-simple-project-pkg-a@1.1.0
+
+### Minor Changes
+
+- Awesome feature",
+    "pullRequestId": "PR_kwDOA",
+    "title": "Version Packages",
+  },
+]
+`;

src/__snapshots__/utils.test.ts.snap

@@ -1,18 +1,18 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
 
 exports[`it sorts the things right 1`] = `
-Array [
-  Object {
+[
+  {
     "highestLevel": 3,
     "name": "c",
     "private": false,
   },
-  Object {
+  {
     "highestLevel": 1,
     "name": "b",
     "private": false,
   },
-  Object {
+  {
     "highestLevel": 3,
     "name": "a",
     "private": true,
@@ -31,8 +31,7 @@ exports[`it works 1`] = `
 
 - [81dc0be5](https://github.com/keystonejs/keystone-5/commit/81dc0be5):
 
-    -   Update dependencies
-"
+  - Update dependencies"
 `;
 
 exports[`it works 2`] = `
@@ -40,6 +39,5 @@ exports[`it works 2`] = `
 
 - [19fe6c1b](https://github.com/keystonejs/keystone-5/commit/19fe6c1b):
 
-    Move frontmatter in docs into comments
-"
+  Move frontmatter in docs into comments"
 `;

src/gitUtils.ts

@@ -1,64 +0,0 @@
-import { exec } from "@actions/exec";
-import { execWithOutput } from "./utils";
-
-export const setupUser = async () => {
-  await exec("git", [
-    "config",
-    "user.name",
-    `"github-actions[bot]"`,
-  ]);
-  await exec("git", [
-    "config",
-    "user.email",
-    `"github-actions[bot]@users.noreply.github.com"`,
-  ]);
-};
-
-export const pullBranch = async (branch: string) => {
-  await exec("git", ["pull", "origin", branch]);
-};
-
-export const push = async (
-  branch: string,
-  { force }: { force?: boolean } = {}
-) => {
-  await exec(
-    "git",
-    ["push", "origin", `HEAD:${branch}`, force && "--force"].filter<string>(
-      Boolean as any
-    )
-  );
-};
-
-export const pushTags = async () => {
-  await exec("git", ["push", "origin", "--tags"]);
-};
-
-export const switchToMaybeExistingBranch = async (branch: string) => {
-  let { stderr } = await execWithOutput("git", ["checkout", branch], {
-    ignoreReturnCode: true,
-  });
-  let isCreatingBranch = !stderr
-    .toString()
-    .includes(`Switched to a new branch '${branch}'`);
-  if (isCreatingBranch) {
-    await exec("git", ["checkout", "-b", branch]);
-  }
-};
-
-export const reset = async (
-  pathSpec: string,
-  mode: "hard" | "soft" | "mixed" = "hard"
-) => {
-  await exec("git", ["reset", `--${mode}`, pathSpec]);
-};
-
-export const commitAll = async (message: string) => {
-  await exec("git", ["add", "."]);
-  await exec("git", ["commit", "-m", message]);
-};
-
-export const checkIfClean = async (): Promise<boolean> => {
-  const { stdout } = await execWithOutput("git", ["status", "--porcelain"]);
-  return !stdout.length;
-};

src/github.test.ts

@@ -0,0 +1,227 @@
+import { Buffer } from "node:buffer";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { exec } from "tinyexec";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { GitHub } from "./github.ts";
+import { createGitHttpRemote, shallowClone, testdir } from "./test-utils.ts";
+
+const githubContext = vi.hoisted(() => ({
+  repo: {
+    owner: "changesets",
+    repo: "action",
+  },
+  sha: "base-sha",
+}));
+
+vi.mock("@actions/github", () => ({
+  context: githubContext,
+  getOctokit: () => ({}),
+}));
+
+async function git(cwd: string, args: string[]) {
+  const result = await exec("git", args, {
+    nodeOptions: { cwd },
+    throwOnError: true,
+  });
+  return result.stdout.trim();
+}
+
+function getAuthorization(token: string) {
+  return `basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}`;
+}
+
+function createRemote() {
+  return createGitHttpRemote({ "file.txt": "initial\n" });
+}
+
+async function isolateGitConfig() {
+  const fixture = await testdir({ "global.gitconfig": "" });
+  vi.stubEnv("GIT_CONFIG_GLOBAL", path.join(fixture.path, "global.gitconfig"));
+  return fixture;
+}
+
+type GitHttpRemote = Awaited<ReturnType<typeof createGitHttpRemote>>;
+
+async function pushChangedFile(
+  repository: string,
+  serverUrl: string,
+  token: string,
+) {
+  await fs.writeFile(path.join(repository, "file.txt"), "changed\n");
+  const github = new GitHub({
+    cwd: repository,
+    githubToken: token,
+    pushWithGitCli: true,
+    serverUrl,
+  });
+  await github.pushChanges({
+    branch: "changeset-release/main",
+    message: "Version Packages",
+  });
+  return github;
+}
+
+async function expectReleaseBranch(remote: GitHttpRemote, repository: string) {
+  expect(
+    await git(remote.path, ["rev-parse", "refs/heads/changeset-release/main"]),
+  ).toBe(await git(repository, ["rev-parse", "HEAD"]));
+}
+
+function expectRequestsToUseToken(remote: GitHttpRemote, token: string) {
+  expect(remote.requests.length).toBeGreaterThan(0);
+  for (const request of remote.requests) {
+    expect(request.headers.authorization).toEqual([getAuthorization(token)]);
+  }
+}
+
+beforeEach(() => {
+  vi.stubEnv("GIT_AUTHOR_DATE", "2000-01-01T00:00:00Z");
+  vi.stubEnv("GIT_COMMITTER_DATE", "2000-01-01T00:00:00Z");
+  vi.stubEnv("GIT_CONFIG_COUNT", "0");
+  vi.stubEnv("GIT_CONFIG_NOSYSTEM", "1");
+  vi.stubEnv("GIT_TERMINAL_PROMPT", "0");
+});
+
+afterEach(() => {
+  vi.unstubAllEnvs();
+});
+
+describe("GitHub", () => {
+  it("defaults to GitHub API mode", () => {
+    const github = new GitHub({
+      cwd: "/repo",
+      githubToken: "token",
+    });
+
+    expect(github.pushWithGitCli).toBe(false);
+  });
+
+  it("uses github-token instead of checkout's persisted header for branch and tag pushes", async () => {
+    await using _gitConfig = await isolateGitConfig();
+    const actionToken = "action-token";
+    const checkoutToken = "checkout-token";
+    await using remote = await createRemote();
+    await using repositoryFixture = await shallowClone(remote.path);
+    const repository = repositoryFixture.path;
+    const serverUrl = new URL(remote.url).origin;
+
+    await git(repository, ["remote", "set-url", "origin", remote.url]);
+    await git(repository, [
+      "config",
+      `http.${serverUrl}/.extraheader`,
+      `AUTHORIZATION: ${getAuthorization(checkoutToken)}`,
+    ]);
+
+    const github = await pushChangedFile(repository, serverUrl, actionToken);
+    await git(repository, ["tag", "v1.0.0"]);
+    await github.pushTag("v1.0.0");
+
+    await expectReleaseBranch(remote, repository);
+    expect(await git(remote.path, ["rev-parse", "refs/tags/v1.0.0"])).toBe(
+      await git(repository, ["rev-parse", "v1.0.0"]),
+    );
+    expectRequestsToUseToken(remote, actionToken);
+  }, 15_000);
+
+  it("uses github-token instead of credentials embedded in the push URL", async () => {
+    await using _gitConfig = await isolateGitConfig();
+    const actionToken = "action-token";
+    await using remote = await createRemote();
+    await using repositoryFixture = await shallowClone(remote.path);
+    const repository = repositoryFixture.path;
+
+    const remoteUrl = new URL(remote.url);
+    remoteUrl.username = "x-access-token";
+    remoteUrl.password = "checkout-token";
+    await git(repository, ["remote", "set-url", "origin", remoteUrl.href]);
+
+    const persistedCredentialUrl = new URL(remoteUrl);
+    persistedCredentialUrl.password = "";
+    await git(repository, [
+      "config",
+      `http.${persistedCredentialUrl.href}.extraheader`,
+      `AUTHORIZATION: ${getAuthorization("checkout-token")}`,
+    ]);
+
+    await pushChangedFile(repository, remoteUrl.origin, actionToken);
+
+    await expectReleaseBranch(remote, repository);
+    expectRequestsToUseToken(remote, actionToken);
+  }, 15_000);
+
+  it("uses the push URL when it differs from the fetch URL", async () => {
+    await using _gitConfig = await isolateGitConfig();
+    const actionToken = "action-token";
+    await using fetchRemote = await createRemote();
+    await using pushRemote = await createRemote();
+    await using repositoryFixture = await shallowClone(fetchRemote.path);
+    const repository = repositoryFixture.path;
+
+    await git(repository, ["remote", "set-url", "origin", fetchRemote.url]);
+    await git(repository, ["config", "remote.origin.pushurl", pushRemote.url]);
+
+    await pushChangedFile(
+      repository,
+      new URL(fetchRemote.url).origin,
+      actionToken,
+    );
+
+    expect(fetchRemote.requests).toEqual([]);
+    await expectReleaseBranch(pushRemote, repository);
+    expectRequestsToUseToken(pushRemote, actionToken);
+  }, 15_000);
+
+  it("uses github-token for every push URL", async () => {
+    await using _gitConfig = await isolateGitConfig();
+    const actionToken = "action-token";
+    await using firstRemote = await createRemote();
+    await using secondRemote = await createRemote();
+    await using repositoryFixture = await shallowClone(firstRemote.path);
+    const repository = repositoryFixture.path;
+
+    for (const remote of [firstRemote, secondRemote]) {
+      await git(repository, [
+        "config",
+        "--add",
+        "remote.origin.pushurl",
+        remote.url,
+      ]);
+    }
+
+    await pushChangedFile(
+      repository,
+      new URL(firstRemote.url).origin,
+      actionToken,
+    );
+
+    for (const remote of [firstRemote, secondRemote]) {
+      await expectReleaseBranch(remote, repository);
+      expectRequestsToUseToken(remote, actionToken);
+    }
+  }, 15_000);
+
+  it("preserves existing command-scoped Git config entries", async () => {
+    await using _gitConfig = await isolateGitConfig();
+    const actionToken = "action-token";
+    await using fetchRemote = await createRemote();
+    await using pushRemote = await createRemote();
+    await using repositoryFixture = await shallowClone(fetchRemote.path);
+    const repository = repositoryFixture.path;
+
+    await git(repository, ["remote", "set-url", "origin", fetchRemote.url]);
+    vi.stubEnv("GIT_CONFIG_COUNT", "1");
+    vi.stubEnv("GIT_CONFIG_KEY_0", "remote.origin.pushurl");
+    vi.stubEnv("GIT_CONFIG_VALUE_0", pushRemote.url);
+
+    await pushChangedFile(
+      repository,
+      new URL(fetchRemote.url).origin,
+      actionToken,
+    );
+
+    expect(fetchRemote.requests).toEqual([]);
+    await expectReleaseBranch(pushRemote, repository);
+    expectRequestsToUseToken(pushRemote, actionToken);
+  }, 15_000);
+});

src/github.ts

@@ -0,0 +1,271 @@
+import { Buffer } from "node:buffer";
+import * as core from "@actions/core";
+import { exec, getExecOutput } from "@actions/exec";
+import { context } from "@actions/github";
+import { commitChangesSinceBase } from "@changesets/ghcommit";
+import { setupOctokit, type Octokit } from "./octokit.ts";
+
+type GitOptions = {
+  cwd: string;
+  env?: Record<string, string>;
+};
+
+const push = async (branch: string, options: GitOptions) => {
+  await exec("git", ["push", "origin", `HEAD:${branch}`, "--force"], options);
+};
+
+const switchToMaybeExistingBranch = async (
+  branch: string,
+  options: GitOptions,
+) => {
+  let { stderr } = await getExecOutput("git", ["checkout", branch], {
+    ignoreReturnCode: true,
+    ...options,
+  });
+  let isCreatingBranch = !stderr
+    .toString()
+    .includes(`Switched to a new branch '${branch}'`);
+  if (isCreatingBranch) {
+    await exec("git", ["checkout", "-b", branch], options);
+  }
+};
+
+const reset = async (pathSpec: string, options: GitOptions) => {
+  await exec("git", ["reset", `--hard`, pathSpec], options);
+};
+
+const commitAll = async (message: string, options: GitOptions) => {
+  await exec("git", ["add", "."], options);
+  await exec("git", ["commit", "-m", message], options);
+};
+
+const checkIfClean = async (options: GitOptions): Promise<boolean> => {
+  const { stdout } = await getExecOutput(
+    "git",
+    ["status", "--porcelain"],
+    options,
+  );
+  return !stdout.length;
+};
+
+function getHttpUrl(remoteUrl: string): string | undefined {
+  try {
+    const url = new URL(remoteUrl);
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+      return;
+    }
+
+    // Git includes the username when deciding which URL-specific config is
+    // most specific, so retain it. Password, query, and fragment do not
+    // participate in matching; strip them before copying the URL into the env.
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    return url.href;
+  } catch {
+    return;
+  }
+}
+
+export class GitHub {
+  readonly #githubToken: string;
+  readonly octokit: Octokit;
+  readonly cwd: string;
+  readonly pushWithGitCli: boolean;
+  readonly serverUrl: string;
+
+  constructor(options: {
+    githubToken: string;
+    cwd: string;
+    pushWithGitCli?: boolean;
+    serverUrl?: string;
+  }) {
+    this.#githubToken = options.githubToken;
+    this.cwd = options.cwd;
+    this.pushWithGitCli = options.pushWithGitCli ?? false;
+    this.serverUrl = (
+      options.serverUrl ??
+      context.serverUrl ??
+      process.env.GITHUB_SERVER_URL ??
+      "https://github.com"
+    ).replace(/\/+$/, "");
+    this.octokit = setupOctokit(options.githubToken);
+  }
+
+  getToken() {
+    return this.#githubToken;
+  }
+
+  async #getCliAuthEnv(): Promise<Record<string, string>> {
+    // Make `github-token` authoritative for CLI pushes without changing the
+    // repository config. Git may otherwise use checkout's persisted header or
+    // credentials embedded in a remote URL, so we need to install command-scoped
+    // `http.extraHeader` overrides for every push destination.
+    //
+    // Historical context: v1 put `github-token` in ~/.netrc, where checkout's
+    // extraheader took precedence. This setup with reset + authHeader
+    // deliberately makes `github-token` win for pushes.
+    const basic = Buffer.from(`x-access-token:${this.#githubToken}`).toString(
+      "base64",
+    );
+
+    // The environment may already contain command-scoped Git config. Append
+    // our KEY_n/VALUE_n entries so those existing settings stay active.
+    const gitConfigCount = Number(process.env.GIT_CONFIG_COUNT ?? 0);
+    if (!Number.isInteger(gitConfigCount) || gitConfigCount < 0) {
+      throw new Error(
+        `Invalid GIT_CONFIG_COUNT value: ${process.env.GIT_CONFIG_COUNT}`,
+      );
+    }
+
+    // `git push origin` prefers remote.origin.pushurl over the fetch URL and
+    // supports more than one push URL, so inspect every effective destination.
+    const { stdout } = await getExecOutput(
+      "git",
+      ["remote", "get-url", "--push", "--all", "origin"],
+      {
+        cwd: this.cwd,
+        ignoreReturnCode: true,
+        // A user-configured remote can contain credentials.
+        silent: true,
+      },
+    );
+
+    // Git reads `http.extraHeader` from the most specific matching URL section.
+    // The host key replaces checkout's usual persisted header; an exact key for
+    // each destination outranks path- or username-specific inherited config.
+    // Git selects only one URL section, so these keys do not duplicate headers.
+    const extraHeaderKeys = new Set([`http.${this.serverUrl}/.extraheader`]);
+    for (const remoteUrl of stdout.split(/\r?\n/)) {
+      const httpUrl = getHttpUrl(remoteUrl);
+      if (httpUrl !== undefined) {
+        extraHeaderKeys.add(`http.${httpUrl}.extraheader`);
+      }
+    }
+    const authHeader = `AUTHORIZATION: basic ${basic}`;
+
+    // Each URL key needs two new command-scoped config entries: one to reset
+    // the inherited header list and one to install our Authorization header.
+    const env: Record<string, string> = {
+      GIT_CONFIG_COUNT: String(gitConfigCount + extraHeaderKeys.size * 2),
+    };
+
+    // `http.extraHeader` is multi-valued, so merely appending our header could
+    // make Git send both tokens. An empty value resets inherited values; the
+    // following value adds only ours.
+    let index = 0;
+    for (const extraHeaderKey of extraHeaderKeys) {
+      const resetIndex = gitConfigCount + index * 2;
+      const authIndex = resetIndex + 1;
+      env[`GIT_CONFIG_KEY_${resetIndex}`] = extraHeaderKey;
+      env[`GIT_CONFIG_VALUE_${resetIndex}`] = "";
+      env[`GIT_CONFIG_KEY_${authIndex}`] = extraHeaderKey;
+      env[`GIT_CONFIG_VALUE_${authIndex}`] = authHeader;
+      index++;
+    }
+
+    return env;
+  }
+
+  async ensureGitUser() {
+    // Check the exact identities that Git would use for commits without
+    // allowing Git to fall back to auto-detected values like user@hostname.
+    // This covers explicit GIT_AUTHOR_* / GIT_COMMITTER_* env vars, local
+    // config, and global config. A partial identity, with only a name or only
+    // an email, does not pass this check. If either identity is missing,
+    // configure our default bot user as a fallback.
+    const authorIdentity = await getExecOutput(
+      "git",
+      ["-c", "user.useConfigOnly=true", "var", "GIT_AUTHOR_IDENT"],
+      {
+        cwd: this.cwd,
+        ignoreReturnCode: true,
+        silent: true,
+      },
+    );
+    const committerIdentity = await getExecOutput(
+      "git",
+      ["-c", "user.useConfigOnly=true", "var", "GIT_COMMITTER_IDENT"],
+      {
+        cwd: this.cwd,
+        ignoreReturnCode: true,
+        silent: true,
+      },
+    );
+    if (authorIdentity.exitCode === 0 && committerIdentity.exitCode === 0) {
+      return;
+    }
+    core.info("Setting git user to github-actions[bot]");
+    await exec("git", ["config", "user.name", `"github-actions[bot]"`], {
+      cwd: this.cwd,
+    });
+    await exec(
+      "git",
+      [
+        "config",
+        "user.email",
+        `"41898282+github-actions[bot]@users.noreply.github.com"`,
+      ],
+      {
+        cwd: this.cwd,
+      },
+    );
+  }
+
+  async pushTag(tag: string) {
+    try {
+      if (!this.pushWithGitCli) {
+        await this.octokit.rest.git.createRef({
+          ...context.repo,
+          ref: `refs/tags/${tag}`,
+          sha: context.sha,
+        });
+      } else {
+        await exec("git", ["push", "origin", tag], {
+          cwd: this.cwd,
+          env: {
+            ...process.env,
+            ...(await this.#getCliAuthEnv()),
+          } as Record<string, string>,
+        });
+      }
+    } catch (err) {
+      core.warning(
+        `Failed to create git tag "${tag}". Assuming it was manually pushed by the publish script: ${(err as Error).message}`,
+      );
+    }
+  }
+
+  async prepareBranch(branch: string) {
+    await switchToMaybeExistingBranch(branch, { cwd: this.cwd });
+    await reset(context.sha, { cwd: this.cwd });
+  }
+
+  async pushChanges({ branch, message }: { branch: string; message: string }) {
+    if (!this.pushWithGitCli) {
+      await commitChangesSinceBase({
+        octokit: this.octokit,
+        ...context.repo,
+        branch,
+        message,
+        base: {
+          commit: context.sha,
+        },
+        force: true,
+        cwd: this.cwd,
+      });
+      return;
+    }
+    if (!(await checkIfClean({ cwd: this.cwd }))) {
+      await this.ensureGitUser();
+      await commitAll(message, { cwd: this.cwd });
+    }
+    await push(branch, {
+      cwd: this.cwd,
+      env: {
+        ...process.env,
+        ...(await this.#getCliAuthEnv()),
+      } as Record<string, string>,
+    });
+  }
+}

src/index.ts

@@ -1,115 +1,139 @@
 import * as core from "@actions/core";
-import fs from "fs-extra";
-import * as gitUtils from "./gitUtils";
-import { runPublish, runVersion } from "./run";
-import readChangesetState from "./readChangesetState";
+import { GitHub } from "./github.ts";
+import readChangesetState from "./readChangesetState.ts";
+import { runPublish, runVersion } from "./run.ts";
+import {
+  getOptionalInput,
+  getRequiredInput,
+  throwOnRemovedCommitModeInput,
+  throwOnRenamedInputs,
+  validateChangesetsCliVersion,
+} from "./utils.ts";
 
-const getOptionalInput = (name: string) => core.getInput(name) || undefined;
+try {
+  await main();
+} catch (err) {
+  core.setFailed((err as Error).message);
+}
 
-(async () => {
-  let githubToken = process.env.GITHUB_TOKEN;
+async function main() {
+  const cwd = getOptionalInput("cwd") || process.cwd();
+  await validateChangesetsCliVersion(cwd);
 
-  if (!githubToken) {
-    core.setFailed("Please add the GITHUB_TOKEN to the changesets action");
+  throwOnRenamedInputs({
+    publish: "publish-script",
+    version: "version-script",
+    commit: "commit-message",
+    title: "pr-title",
+    branch: "pr-base-branch",
+    prDraft: "pr-draft",
+    createGithubReleases: "create-github-releases",
+  });
+  throwOnRemovedCommitModeInput();
+
+  const githubToken = getRequiredInput("github-token");
+  if (process.env.GITHUB_TOKEN && process.env.GITHUB_TOKEN !== githubToken) {
+    throw new Error(
+      'The GITHUB_TOKEN environment variable is set and does not match the "github-token" input. ' +
+        'Please pass the custom GitHub token to the "github-token" input and ' +
+        "remove the GITHUB_TOKEN environment variable to avoid conflicts.",
+    );
+  }
+
+  const pushWithGitCli = core.getBooleanInput("push-with-git-cli");
+  const prDraft = getOptionalInput("pr-draft");
+  if (prDraft !== undefined && prDraft !== "always" && prDraft !== "create") {
+    core.setFailed(`Invalid pr-draft: ${prDraft}`);
     return;
   }
+  const github = new GitHub({
+    cwd,
+    githubToken,
+    pushWithGitCli,
+  });
 
-  const inputCwd = core.getInput("cwd");
-  if (inputCwd) {
-    console.log("changing directory to the one given as the input");
-    process.chdir(inputCwd);
-  }
+  let { changesets } = await readChangesetState(cwd);
 
-  let setupGitUser = core.getBooleanInput("setupGitUser");
-
-  if (setupGitUser) {
-    console.log("setting git user");
-    await gitUtils.setupUser();
-  }
-
-  console.log("setting GitHub credentials");
-  await fs.writeFile(
-    `${process.env.HOME}/.netrc`,
-    `machine github.com\nlogin github-actions[bot]\npassword ${githubToken}`
-  );
-
-  let { changesets } = await readChangesetState();
-
-  let publishScript = core.getInput("publish");
+  let publishScript = core.getInput("publish-script");
   let hasChangesets = changesets.length !== 0;
+  const hasNonEmptyChangesets = changesets.some(
+    (changeset) => changeset.releases.length > 0,
+  );
   let hasPublishScript = !!publishScript;
 
   core.setOutput("published", "false");
-  core.setOutput("publishedPackages", "[]");
-  core.setOutput("hasChangesets", String(hasChangesets));
+  core.setOutput("published-packages", "[]");
+  core.setOutput("has-changesets", String(hasChangesets));
 
   switch (true) {
     case !hasChangesets && !hasPublishScript:
-      console.log("No changesets found");
+      core.info(
+        "No changesets present or were removed by merging version PR. Not publishing because publish-script is not set.",
+      );
       return;
     case !hasChangesets && hasPublishScript: {
-      console.log(
-        "No changesets found, attempting to publish any unpublished packages to npm"
+      core.info(
+        "No changesets found. Attempting to publish any unpublished packages to npm",
       );
 
-      let userNpmrcPath = `${process.env.HOME}/.npmrc`;
-      if (fs.existsSync(userNpmrcPath)) {
-        console.log("Found existing user .npmrc file");
-        const userNpmrcContent = await fs.readFile(userNpmrcPath, "utf8");
-        const authLine = userNpmrcContent.split("\n").find((line) => {
-          // check based on https://github.com/npm/cli/blob/8f8f71e4dd5ee66b3b17888faad5a7bf6c657eed/test/lib/adduser.js#L103-L105
-          return /^\s*\/\/registry\.npmjs\.org\/:[_-]authToken=/i.test(line);
-        });
-        if (authLine) {
-          console.log(
-            "Found existing auth token for the npm registry in the user .npmrc file"
+      const createGithubReleases = core.getBooleanInput(
+        "create-github-releases",
       );
-        } else {
-          console.log(
-            "Didn't find existing auth token for the npm registry in the user .npmrc file, creating one"
-          );
-          fs.appendFileSync(
-            userNpmrcPath,
-            `\n//registry.npmjs.org/:_authToken=${process.env.NPM_TOKEN}\n`
+      const pushGitTags = core.getBooleanInput("push-git-tags");
+      if (createGithubReleases && !pushGitTags) {
+        throw new Error(
+          "The input 'create-github-releases' is set to true, but 'push-git-tags' is set to false. " +
+            "Creating GitHub releases requires pushing git tags. Please set 'push-git-tags' to true " +
+            "or set 'create-github-releases' to false.",
         );
       }
-      } else {
-        console.log("No user .npmrc file found, creating one");
-        fs.writeFileSync(
-          userNpmrcPath,
-          `//registry.npmjs.org/:_authToken=${process.env.NPM_TOKEN}\n`
-        );
-      }
-
       const result = await runPublish({
         script: publishScript,
-        githubToken,
-        createGithubReleases: core.getBooleanInput("createGithubReleases"),
+        github,
+        createGithubReleases,
+        pushGitTags,
+        cwd,
       });
 
       if (result.published) {
         core.setOutput("published", "true");
         core.setOutput(
-          "publishedPackages",
-          JSON.stringify(result.publishedPackages)
+          "published-packages",
+          JSON.stringify(result.publishedPackages),
+        );
+      }
+
+      if (result.exitCode !== 0) {
+        throw new Error(
+          `Publish command exited with code ${result.exitCode}${
+            result.published
+              ? `, but some packages were published: ${result.publishedPackages
+                  .map((p) => `${p.name}@${p.version}`)
+                  .join(", ")}`
+              : ""
+          }`,
         );
       }
       return;
     }
-    case hasChangesets:
+    case hasChangesets && !hasNonEmptyChangesets:
+      core.info("All changesets are empty. Not creating PR");
+      return;
+    case hasChangesets: {
       const { pullRequestNumber } = await runVersion({
-        script: getOptionalInput("version"),
-        githubToken,
-        prTitle: getOptionalInput("title"),
-        commitMessage: getOptionalInput("commit"),
+        script: getOptionalInput("version-script"),
+        github,
+        cwd,
+        prTitle: getOptionalInput("pr-title"),
+        commitMessage: getOptionalInput("commit-message"),
         hasPublishScript,
+        prDraft,
+        branch: getOptionalInput("pr-base-branch"),
       });
 
-      core.setOutput("pullRequestNumber", String(pullRequestNumber));
+      core.setOutput("pr-number", String(pullRequestNumber));
 
       return;
     }
-})().catch((err) => {
-  console.error(err);
-  core.setFailed(err.message);
-});
+  }
+}

src/octokit.ts

@@ -0,0 +1,41 @@
+import * as core from "@actions/core";
+import { getOctokit } from "@actions/github";
+import { throttling } from "@octokit/plugin-throttling";
+
+export const setupOctokit = (githubToken: string) => {
+  return getOctokit(
+    githubToken,
+    {
+      throttle: {
+        onRateLimit: (retryAfter, options: any, octokit, retryCount) => {
+          core.warning(
+            `Request quota exhausted for request ${options.method} ${options.url}`,
+          );
+
+          if (retryCount <= 2) {
+            core.info(`Retrying after ${retryAfter} seconds!`);
+            return true;
+          }
+        },
+        onSecondaryRateLimit: (
+          retryAfter,
+          options: any,
+          octokit,
+          retryCount,
+        ) => {
+          core.warning(
+            `SecondaryRateLimit detected for request ${options.method} ${options.url}`,
+          );
+
+          if (retryCount <= 2) {
+            core.info(`Retrying after ${retryAfter} seconds!`);
+            return true;
+          }
+        },
+      },
+    },
+    throttling,
+  );
+};
+
+export type Octokit = ReturnType<typeof setupOctokit>;

src/pack/index.ts

@@ -0,0 +1,88 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import artifact from "@actions/artifact";
+import * as core from "@actions/core";
+import {
+  downloadArtifact,
+  execChangesetsCli,
+  getOptionalInput,
+  validateChangesetsCliVersion,
+} from "../utils.ts";
+
+try {
+  await main();
+} catch (err) {
+  core.setFailed((err as Error).message);
+}
+
+async function main() {
+  const cwd = getOptionalInput("cwd") || process.cwd();
+  await validateChangesetsCliVersion(cwd);
+
+  const publishPlanArtifactId = getOptionalInput("publish-plan-artifact-id");
+
+  const tmpDir = process.env.RUNNER_TEMP ?? (await fs.realpath(os.tmpdir()));
+  const outDir = path.join(tmpDir, `changeset-pack-${Date.now()}`);
+
+  await pack(cwd, {
+    outDir,
+    publishPlanPath: publishPlanArtifactId
+      ? await downloadPublishPlanArtifact(tmpDir, Number(publishPlanArtifactId))
+      : undefined,
+  });
+
+  const packDirArtifact = await artifact.uploadArtifact(
+    `changeset-pack-${Date.now()}`,
+    await getFiles(outDir),
+    outDir,
+    {
+      retentionDays: 30,
+    },
+  );
+  if (packDirArtifact.id === undefined) {
+    throw new Error("Packed artifact upload did not return an artifact id");
+  }
+  core.setOutput("pack-dir-artifact-id", String(packDirArtifact.id));
+}
+
+async function pack(
+  cwd: string,
+  args: {
+    outDir: string;
+    publishPlanPath?: string;
+  },
+) {
+  const cliArgs = ["pack", "--out-dir", args.outDir];
+  if (args.publishPlanPath) {
+    cliArgs.push("--from-publish-plan", args.publishPlanPath);
+  }
+
+  await execChangesetsCli(cliArgs, {
+    cwd,
+    env: process.env,
+  });
+}
+
+async function downloadPublishPlanArtifact(tmpDir: string, artifactId: number) {
+  const downloadPath = await downloadArtifact(
+    tmpDir,
+    artifactId,
+    "changeset-publish-plan",
+  );
+  return path.join(downloadPath, "publish-plan.json");
+}
+
+async function getFiles(dir: string): Promise<string[]> {
+  const entries = await fs.readdir(dir, { withFileTypes: true });
+  const files = await Promise.all(
+    entries.map(async (entry) => {
+      const entryPath = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        return getFiles(entryPath);
+      }
+      return [entryPath];
+    }),
+  );
+  return files.flat();
+}

src/pr-comment/index.ts

@@ -0,0 +1,78 @@
+import * as core from "@actions/core";
+import * as github from "@actions/github";
+import { getOptionalInput, getRequiredInput } from "../utils.ts";
+
+type Octokit = ReturnType<typeof github.getOctokit>;
+type CreateCommentParams = NonNullable<
+  Parameters<Octokit["rest"]["issues"]["createComment"]>[0]
+>;
+type UpdateCommentParams = NonNullable<
+  Parameters<Octokit["rest"]["issues"]["updateComment"]>[0]
+>;
+
+try {
+  await main();
+} catch (err) {
+  core.setFailed((err as Error).message);
+}
+
+async function main() {
+  const context = github.context.payload.pull_request;
+  if (!context) {
+    throw new Error(
+      "This action should only be run on `pull_request_target` or `pull_request` events",
+    );
+  }
+
+  const githubToken = getRequiredInput("github-token");
+  const body = getRequiredInput("body");
+  const updateId = getOptionalInput("update-id");
+
+  const commentMarker = updateId ? getCommentMarker(updateId) : null;
+  const commentBody = commentMarker ? `${commentMarker}\n\n${body}` : body;
+  const commentParam: CreateCommentParams | UpdateCommentParams = {
+    repo: context.base.repo.name,
+    owner: context.base.repo.owner.login,
+    issue_number: context.number,
+    body: commentBody,
+  };
+
+  const octokit = github.getOctokit(githubToken);
+
+  let existingCommentId: number | undefined;
+  if (commentMarker) {
+    core.info("Checking for existing comment...");
+    existingCommentId = await octokit.rest.issues
+      .listComments({
+        repo: context.base.repo.name,
+        owner: context.base.repo.owner.login,
+        issue_number: context.number,
+      })
+      .then((res) => {
+        const comment = res.data.find((c) => c.body?.includes(commentMarker));
+        return comment?.id;
+      });
+  }
+
+  if (existingCommentId) {
+    core.info(`Updating existing comment (id: ${existingCommentId})...`);
+    await octokit.rest.issues.updateComment({
+      ...commentParam,
+      comment_id: existingCommentId,
+    });
+    core.setOutput("comment-id", existingCommentId);
+  } else {
+    core.info("Creating new comment...");
+    const result = await octokit.rest.issues.createComment(commentParam);
+    core.setOutput("comment-id", result.data.id);
+  }
+
+  core.info("Done!");
+}
+
+function getCommentMarker(updateId: string) {
+  const prefix = "changesets-action-pr-comment";
+  return prefix === updateId
+    ? `<!-- ${prefix} -->`
+    : `<!-- ${prefix}:${updateId} -->`;
+}

src/pr-status/index.ts

@@ -0,0 +1,23 @@
+import * as core from "@actions/core";
+import * as github from "@actions/github";
+import { getCommentMessage } from "./message.ts";
+
+try {
+  await main();
+} catch (err) {
+  core.setFailed((err as Error).message);
+}
+
+async function main() {
+  const context = github.context.payload.pull_request;
+  if (!context) {
+    throw new Error(
+      "This action should only be run on `pull_request_target` or `pull_request` events",
+    );
+  }
+
+  core.info("Creating comment message...");
+  const commentBody = await getCommentMessage(context);
+  core.setOutput("comment-body", commentBody);
+  core.info("Done!");
+}

src/pr-status/message.ts

@@ -0,0 +1,120 @@
+import * as github from "@actions/github";
+import { getReleasePlan } from "@changesets/get-release-plan";
+import type {
+  ComprehensiveRelease,
+  ReleasePlan,
+  VersionType,
+} from "@changesets/types";
+import { markdownTable } from "markdown-table";
+import {
+  getNewChangesetTemplateContent,
+  getNewChangesetUrl,
+} from "./template.ts";
+import { getPullRequestWorktree } from "./worktree.ts";
+
+type PullRequestContext = NonNullable<
+  typeof github.context.payload.pull_request
+>;
+
+export async function getCommentMessage(context: PullRequestContext) {
+  await using worktree = await getPullRequestWorktree(context);
+
+  const releasePlan = await getReleasePlan(worktree.cwd, worktree.baseRef);
+  const templateContent = await getNewChangesetTemplateContent(
+    worktree.cwd,
+    worktree.baseRef,
+    context.title,
+  );
+
+  const newChangesetUrl = getNewChangesetUrl(
+    context.head.repo.html_url,
+    context.head.ref,
+    templateContent,
+  );
+
+  if (releasePlan.changesets.length > 0) {
+    return getApproveMessage(context.head.sha, newChangesetUrl, releasePlan);
+  } else {
+    return getAbsentMessage(context.head.sha, newChangesetUrl, releasePlan);
+  }
+}
+
+function getApproveMessage(
+  commitSha: string,
+  newChangesetUrl: string,
+  releasePlan: ReleasePlan,
+) {
+  return `\
+### 🦋 Changeset detected
+
+Latest commit: ${commitSha}
+
+**The changes in this PR will be included in the next version bump.**
+
+${getReleasePlanMessage(releasePlan)}
+
+Not sure what this means? [Click here to learn what changesets are](https://changesets.dev/faq).
+
+[Click here if you're a maintainer who wants to add another changeset to this PR](${newChangesetUrl})`;
+}
+
+function getAbsentMessage(
+  commitSha: string,
+  newChangesetUrl: string,
+  releasePlan: ReleasePlan,
+) {
+  return `\
+### ⚠️ No Changeset found
+
+Latest commit: ${commitSha}
+
+Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. **If these changes should result in a version bump, you need to add a changeset.**
+
+${getReleasePlanMessage(releasePlan)}
+
+[Click here to learn what changesets are, and how to add one](https://changesets.dev/faq).
+
+[Click here if you're a maintainer who wants to add a changeset to this PR](${newChangesetUrl})`;
+}
+
+function getReleasePlanMessage(releasePlan: ReleasePlan) {
+  const publishableReleases = releasePlan.releases.filter(
+    (r) => r.type !== "none",
+  ) as (ComprehensiveRelease & { type: Exclude<VersionType, "none"> })[];
+
+  const table = markdownTable([
+    ["Name", "Type"],
+    ...publishableReleases.map((release) => {
+      return [
+        release.name,
+        {
+          major: "Major",
+          minor: "Minor",
+          patch: "Patch",
+        }[release.type],
+      ];
+    }),
+  ]);
+
+  let summary = "This PR includes ";
+  if (releasePlan.changesets.length === 0) {
+    summary += "no changesets";
+  } else {
+    summary += `changesets to release ${publishableReleases.length} package`;
+    if (publishableReleases.length !== 1) {
+      summary += "s";
+    }
+  }
+
+  return `\
+<details>
+<summary>${summary}</summary>
+
+${
+  publishableReleases.length > 0
+    ? table
+    : "When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types"
+}
+
+</details>`;
+}

src/pr-status/template.ts

@@ -0,0 +1,30 @@
+import { getChangedPackagesSinceRef } from "@changesets/git";
+import { humanId } from "human-id";
+
+export function getNewChangesetUrl(
+  headRepoUrl: string,
+  headRef: string,
+  templateContent: string,
+) {
+  const fileName = humanId({ separator: "-", capitalize: false });
+  return `${headRepoUrl}/new/${headRef}?filename=.changeset/${fileName}.md&value=${encodeURIComponent(templateContent)}`;
+}
+
+export async function getNewChangesetTemplateContent(
+  cwd: string,
+  baseRef: string,
+  prTitle: string,
+) {
+  const changedPackages = await getChangedPackagesSinceRef({
+    cwd,
+    ref: baseRef,
+  });
+
+  return `\
+---
+${changedPackages.map((p) => `"${p.packageJson.name}": patch`).join("\n")}
+---
+
+${prTitle}
+`;
+}

src/pr-status/worktree.test.ts

@@ -0,0 +1,136 @@
+import { pathToFileURL } from "node:url";
+import type * as github from "@actions/github";
+import { getReleasePlan } from "@changesets/get-release-plan";
+import { exec } from "tinyexec";
+import { describe, expect, it } from "vitest";
+import { gitdir, shallowClone, testdir } from "../test-utils.ts";
+import { getPullRequestWorktree } from "./worktree.ts";
+
+type PullRequestContext = NonNullable<
+  typeof github.context.payload.pull_request
+>;
+
+async function git(cwd: string, args: string[]) {
+  const output = await exec("git", args, {
+    nodeOptions: { cwd },
+    throwOnError: true,
+  });
+  return output.stdout.trim();
+}
+
+describe("getPullRequestWorktree", () => {
+  it("fetches a PR branch into a detached worktree and keeps the main checkout untouched", async () => {
+    // Local source repo
+    await using sourceRepoFixture = await gitdir({
+      ".changeset/config.json": JSON.stringify({}),
+      "package.json": JSON.stringify({
+        name: "repo",
+        private: true,
+        workspaces: ["packages/*"],
+      }),
+      "package-lock.json": "",
+      "packages/pkg-a/package.json": JSON.stringify({
+        name: "pkg-a",
+        version: "1.0.0",
+      }),
+    });
+    const sourceRepo = sourceRepoFixture.path;
+
+    // Simulate remote bare git server
+    await using originBareFixture = await testdir();
+    const originBare = originBareFixture.path;
+    await git(originBare, [
+      "clone",
+      "--bare",
+      pathToFileURL(sourceRepo).toString(),
+      ".",
+    ]);
+
+    // Simulate checkout PR in github action
+    await using checkoutRepoFixture = await shallowClone(originBare);
+    const checkoutRepo = checkoutRepoFixture.path;
+
+    // Simulate remote fork bare git server
+    await using forkBareFixture = await testdir();
+    const forkBare = forkBareFixture.path;
+    await git(forkBare, [
+      "clone",
+      "--bare",
+      pathToFileURL(originBare).toString(),
+      ".",
+    ]);
+
+    await using forkRepoFixture = await shallowClone(forkBare);
+    const forkRepo = forkRepoFixture.path;
+    await git(forkRepo, ["config", "user.name", "Test User"]);
+    await git(forkRepo, ["config", "user.email", "test@example.com"]);
+    await git(forkRepo, ["checkout", "-b", "feature"]);
+
+    await forkRepoFixture.mkdir("packages/pkg-a/src");
+    await forkRepoFixture.writeFile(
+      "packages/pkg-a/src/index.ts",
+      "export const value = 1;\n",
+    );
+    await forkRepoFixture.writeFile(
+      ".changeset/add-pkg-a.md",
+      `\
+---
+"pkg-a": patch
+---
+
+Add pkg-a
+`,
+    );
+
+    await git(forkRepo, ["add", "."]);
+    await git(forkRepo, ["commit", "-m", "feature"]);
+    await git(forkRepo, ["push", "origin", "feature"]);
+
+    // Run tests
+    const originalHead = await git(checkoutRepo, ["rev-parse", "HEAD"]);
+    const context = {
+      number: 123,
+      base: {
+        ref: "main",
+        repo: {
+          clone_url: pathToFileURL(originBare).toString(),
+        },
+      },
+      head: {
+        ref: "feature",
+        repo: {
+          clone_url: pathToFileURL(forkBare).toString(),
+        },
+      },
+    };
+
+    await using worktree = await getPullRequestWorktree(
+      context satisfies PullRequestContext as PullRequestContext,
+      checkoutRepo,
+    );
+
+    const releasePlan = await getReleasePlan(worktree.cwd, worktree.baseRef);
+
+    const currentHead = await git(worktree.cwd, ["rev-parse", "HEAD"]);
+    expect(currentHead).not.toBe(originalHead);
+
+    const currentBranch = await git(worktree.cwd, ["branch", "--show-current"]);
+    expect(currentBranch).toBe("");
+
+    const releases = releasePlan.releases.map((release) => ({
+      name: release.name,
+      type: release.type,
+      newVersion: release.newVersion,
+    }));
+    expect(releases).toEqual([
+      {
+        name: "pkg-a",
+        type: "patch",
+        newVersion: "1.0.1",
+      },
+    ]);
+
+    expect(await git(checkoutRepo, ["rev-parse", "HEAD"])).toBe(originalHead);
+    expect(await git(checkoutRepo, ["branch", "--show-current"])).toBe("main");
+  });
+});

src/pr-status/worktree.ts

@@ -0,0 +1,150 @@
+import { randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import type * as github from "@actions/github";
+import { isRepoShallow } from "@changesets/git";
+import { exec } from "tinyexec";
+import { moveDisposable, type WithAsyncDispose } from "../utils.ts";
+
+type PullRequestContext = NonNullable<
+  typeof github.context.payload.pull_request
+>;
+
+type WorktreeInfo = {
+  baseRef: string;
+  cwd: string;
+};
+
+type TinyexecOptions = Parameters<typeof exec>[2];
+
+function git(cwd: string, args: string[], opts: TinyexecOptions = {}) {
+  return exec("git", args, {
+    nodeOptions: { cwd, ...opts.nodeOptions },
+    throwOnError: true,
+    ...opts,
+  });
+}
+
+interface Ref {
+  fetchSource: string;
+  local: string;
+  remote: string;
+}
+
+function getRefs(context: PullRequestContext): Record<"base" | "head", Ref> {
+  const suffix = `${context.number}-${randomUUID()}`;
+  return {
+    base: {
+      fetchSource: "origin",
+      local: `refs/changesets-action-pr-status/base/${suffix}`,
+      remote: `refs/heads/${context.base.ref}`,
+    },
+    head: {
+      fetchSource: context.head.repo.clone_url,
+      local: `refs/changesets-action-pr-status/head/${suffix}`,
+      remote: `refs/heads/${context.head.ref}`,
+    },
+  };
+}
+
+async function deepenRef(cwd: string, ref: Ref, deepenBy: number) {
+  await git(cwd, [
+    "fetch",
+    "--no-tags",
+    `--deepen=${deepenBy}`,
+    ref.fetchSource,
+    `${ref.remote}:${ref.local}`,
+  ]);
+}
+
+async function ensureMergeBase(args: {
+  cwd: string;
+  refs: ReturnType<typeof getRefs>;
+  deepenBy?: number;
+}) {
+  const { cwd, refs, deepenBy = 50 } = args;
+
+  while (true) {
+    const mergeBase = await git(cwd, ["merge-base", refs.base.local, "HEAD"], {
+      throwOnError: false,
+    });
+
+    if (mergeBase.exitCode === 0) {
+      return mergeBase.stdout.trim();
+    }
+
+    if (!(await isRepoShallow({ cwd }))) {
+      throw new Error(
+        `Failed to find merge base between "${refs.base.local}" and HEAD, and the repository is no longer shallow.`,
+      );
+    }
+
+    await deepenRef(cwd, refs.base, deepenBy);
+    await deepenRef(cwd, refs.head, deepenBy);
+  }
+}
+
+async function mkdtemp(prefix: string) {
+  const dir = await fs.mkdtemp(path.join(os.tmpdir(), prefix));
+
+  return {
+    dir,
+    async [Symbol.asyncDispose]() {
+      await fs.rm(dir, { recursive: true, force: true });
+    },
+  };
+}
+
+async function tempRef(cwd: string, ref: Ref) {
+  await git(cwd, [
+    "fetch",
+    "--no-tags",
+    "--depth=1",
+    ref.fetchSource,
+    `${ref.remote}:${ref.local}`,
+  ]);
+  return {
+    async [Symbol.asyncDispose]() {
+      await git(cwd, ["update-ref", "-d", ref.local], { throwOnError: false });
+    },
+  };
+}
+
+async function tempWorktree(cwd: string, dir: string, ref: Ref) {
+  await git(cwd, ["worktree", "add", "--detach", dir, ref.local]);
+
+  return {
+    async [Symbol.asyncDispose]() {
+      await git(cwd, ["worktree", "remove", "--force", dir], {
+        throwOnError: false,
+      });
+    },
+  };
+}
+
+export async function getPullRequestWorktree(
+  context: PullRequestContext,
+  cwd: string = process.cwd(),
+): Promise<WithAsyncDispose<WorktreeInfo>> {
+  await using stack = new AsyncDisposableStack();
+  const worktreeDir = stack.use(
+    await mkdtemp("changesets-action-pr-status-"),
+  ).dir;
+
+  const refs = getRefs(context);
+
+  stack.use(await tempRef(cwd, refs.base));
+  stack.use(await tempRef(cwd, refs.head));
+  stack.use(await tempWorktree(cwd, worktreeDir, refs.head));
+
+  await ensureMergeBase({
+    cwd: worktreeDir,
+    refs,
+  });
+
+  return moveDisposable(stack, {
+    baseRef: refs.base.local,
+    cwd: worktreeDir,
+  });
+}

src/publish/index.ts

@@ -0,0 +1,78 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import * as core from "@actions/core";
+import { GitHub } from "../github.ts";
+import { runPublish } from "../run.ts";
+import {
+  downloadArtifact,
+  getOptionalInput,
+  getRequiredInput,
+  validateChangesetsCliVersion,
+} from "../utils.ts";
+
+try {
+  await main();
+} catch (err) {
+  core.setFailed((err as Error).message);
+}
+
+async function main() {
+  const cwd = getOptionalInput("cwd") || process.cwd();
+  await validateChangesetsCliVersion(cwd);
+
+  const githubToken = getRequiredInput("github-token");
+  const script = getOptionalInput("script");
+  const packDirArtifactId = getOptionalInput("pack-dir-artifact-id");
+  const createGithubReleases = core.getBooleanInput("create-github-releases");
+  const pushGitTags = core.getBooleanInput("push-git-tags");
+
+  if (createGithubReleases && !pushGitTags) {
+    throw new Error(
+      "The input 'create-github-releases' is set to true, but 'push-git-tags' is set to false. " +
+        "Creating GitHub releases requires pushing git tags. Please set 'push-git-tags' to true " +
+        "or set 'create-github-releases' to false.",
+    );
+  }
+
+  // The publish sub-action always uses the GitHub API for tag pushes.
+  const github = new GitHub({ cwd, githubToken });
+
+  const fromPackDir = packDirArtifactId
+    ? await downloadArtifact(
+        process.env.RUNNER_TEMP ?? (await fs.realpath(os.tmpdir())),
+        Number(packDirArtifactId),
+        "changeset-pack",
+      )
+    : undefined;
+
+  const result = await runPublish({
+    script,
+    github,
+    createGithubReleases,
+    pushGitTags,
+    cwd,
+    fromPackDir,
+  });
+
+  if (result.published) {
+    core.setOutput("published", "true");
+    core.setOutput(
+      "published-packages",
+      JSON.stringify(result.publishedPackages),
+    );
+  } else {
+    core.setOutput("published", "false");
+  }
+
+  if (result.exitCode !== 0) {
+    throw new Error(
+      `Publish command exited with code ${result.exitCode}${
+        result.published
+          ? `, but some packages were published: ${result.publishedPackages
+              .map((p) => `${p.name}@${p.version}`)
+              .join(", ")}`
+          : ""
+      }`,
+    );
+  }
+}

src/readChangesetState.test.ts

@@ -0,0 +1,40 @@
+import { createFixture } from "fs-fixture";
+import { describe, expect, it } from "vitest";
+import readChangesetState from "./readChangesetState.ts";
+
+const changeset = `---
+"pkg-a": patch
+---
+
+Fix a bug.
+`;
+
+describe("readChangesetState", () => {
+  it("filters versioned changesets in prerelease mode", async () => {
+    await using fixture = await createFixture({
+      ".changeset/pre.json": JSON.stringify({ mode: "pre", tag: "next" }),
+      ".changeset/pre/versioned.md": changeset,
+      ".changeset/pending.md": changeset,
+    });
+
+    const state = await readChangesetState(fixture.path);
+
+    expect(state.changesets.map((changeset) => changeset.id)).toEqual([
+      "pending",
+    ]);
+  });
+
+  it("includes versioned changesets when exiting prerelease mode", async () => {
+    await using fixture = await createFixture({
+      ".changeset/pre.json": JSON.stringify({ mode: "exit", tag: "next" }),
+      ".changeset/pre/versioned.md": changeset,
+    });
+
+    const state = await readChangesetState(fixture.path);
+
+    expect(state.preState).toBeUndefined();
+    expect(state.changesets.map((changeset) => changeset.id)).toEqual([
+      "pre/versioned",
+    ]);
+  });
+});

src/readChangesetState.ts

@@ -1,6 +1,6 @@
-import { PreState, NewChangeset } from "@changesets/types";
 import { readPreState } from "@changesets/pre";
-import readChangesets from "@changesets/read";
+import { readChangesets } from "@changesets/read";
+import type { PreState, NewChangeset } from "@changesets/types";
 
 export type ChangesetState = {
   preState: PreState | undefined;
@@ -8,20 +8,22 @@ export type ChangesetState = {
 };
 
 export default async function readChangesetState(
-  cwd: string = process.cwd()
+  cwd: string = process.cwd(),
 ): Promise<ChangesetState> {
   let preState = await readPreState(cwd);
-  let isInPreMode = preState !== undefined && preState.mode === "pre";
-
   let changesets = await readChangesets(cwd);
 
-  if (isInPreMode) {
-    let changesetsToFilter = new Set(preState.changesets);
-    changesets = changesets.filter((x) => !changesetsToFilter.has(x.id));
+  if (preState !== undefined && preState.mode === "pre") {
+    return {
+      preState,
+      changesets: changesets.filter(
+        (changeset) => !changeset.id.startsWith("pre/"),
+      ),
+    };
   }
 
   return {
-    preState: isInPreMode ? preState : undefined,
+    preState: undefined,
     changesets,
   };
 }

src/run.test.ts

@@ -1,12 +1,15 @@
-import fixturez from "fixturez";
+import path from "node:path";
+import * as core from "@actions/core";
 import * as github from "@actions/github";
-import fs from "fs-extra";
-import path from "path";
-import writeChangeset from "@changesets/write";
-import { Changeset } from "@changesets/types";
-import { runVersion } from "./run";
+import type { Changeset } from "@changesets/types";
+import { writeChangeset } from "@changesets/write";
+import { exec } from "tinyexec";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { GitHub } from "./github.ts";
+import { runPublish, runVersion } from "./run.ts";
+import { gitdir } from "./test-utils.ts";
 
-jest.mock("@actions/github", () => ({
+vi.mock("@actions/github", () => ({
   context: {
     repo: {
       owner: "changesets",
@@ -15,47 +18,173 @@ jest.mock("@actions/github", () => ({
     ref: "refs/heads/some-branch",
     sha: "xeac7",
   },
-  getOctokit: jest.fn(),
+  getOctokit: () => ({
+    rest: mockedGithubMethods,
+    graphql: mockedGraphql,
+  }),
 }));
-jest.mock("./gitUtils");
+vi.mock("@actions/core", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@actions/core")>()),
+  error: vi.fn(),
+  notice: vi.fn(),
+  warning: vi.fn(),
+}));
+vi.mock("@changesets/ghcommit");
 
 let mockedGithubMethods = {
-  search: {
-    issuesAndPullRequests: jest.fn(),
-  },
   pulls: {
-    create: jest.fn(),
+    create: vi.fn(),
+    list: vi.fn(),
   },
   repos: {
-    createRelease: jest.fn(),
+    createRelease: vi.fn(),
   },
 };
-(github.getOctokit as any).mockImplementation(() => mockedGithubMethods);
+let mockedGraphql = vi.fn();
 
-let f = fixturez(__dirname);
+const nodeModulesDir = path.join(import.meta.dirname, "..", "node_modules");
+
+function createSimpleProjectFixture() {
+  return gitdir({
+    node_modules: (api) => api.symlink(nodeModulesDir),
+    ".changeset/config.json": JSON.stringify({}),
+    "packages/pkg-a/package.json": JSON.stringify({
+      name: "changesets-dev-simple-project-pkg-a",
+      version: "1.0.0",
+      dependencies: {
+        "changesets-dev-simple-project-pkg-b": "1.0.0",
+      },
+    }),
+    "packages/pkg-b/package.json": JSON.stringify({
+      name: "changesets-dev-simple-project-pkg-b",
+      version: "1.0.0",
+    }),
+    "package.json": JSON.stringify({
+      name: "simple-project",
+      version: "1.0.0",
+      private: true,
+      workspaces: ["packages/*"],
+    }),
+    "package-lock.json": "",
+  });
+}
+
+function createIgnoredPackageFixture() {
+  return gitdir({
+    node_modules: (api) => api.symlink(nodeModulesDir),
+    ".changeset/config.json": JSON.stringify({
+      ignore: ["changesets-dev-ignored-package-pkg-a"],
+    }),
+    "packages/pkg-a/package.json": JSON.stringify({
+      name: "changesets-dev-ignored-package-pkg-a",
+      version: "1.0.0",
+      dependencies: {
+        "changesets-dev-ignored-package-pkg-b": "1.0.0",
+      },
+    }),
+    "packages/pkg-b/package.json": JSON.stringify({
+      name: "changesets-dev-ignored-package-pkg-b",
+      version: "1.0.0",
+    }),
+    "package.json": JSON.stringify({
+      name: "ignored-package",
+      version: "1.0.0",
+      private: true,
+      workspaces: ["packages/*"],
+    }),
+    "package-lock.json": "",
+  });
+}
 
-const linkNodeModules = async (cwd: string) => {
-  await fs.symlink(
-    path.join(__dirname, "..", "node_modules"),
-    path.join(cwd, "node_modules")
-  );
-};
 const writeChangesets = (changesets: Changeset[], cwd: string) => {
   return Promise.all(changesets.map((commit) => writeChangeset(commit, cwd)));
 };
 
+const createGithub = (cwd: string) =>
+  new GitHub({
+    cwd,
+    githubToken: "@@GITHUB_TOKEN",
+    pushWithGitCli: false,
+  });
+
+async function updateGithubContext(cwd: string) {
+  const head = await exec("git", ["rev-parse", "HEAD"], {
+    nodeOptions: { cwd },
+  });
+  github.context.sha = head.stdout.trim();
+}
+
+function resetGithubContext() {
+  github.context.sha = "xeac7";
+}
+
 beforeEach(() => {
-  jest.clearAllMocks();
+  vi.clearAllMocks();
+  resetGithubContext();
+});
+
+afterEach(() => {
+  vi.unstubAllEnvs();
+});
+
+describe("publish", () => {
+  it("warns when a custom publish script does not create the output file", async () => {
+    await using fixture = await createSimpleProjectFixture();
+    const cwd = fixture.path;
+    await updateGithubContext(cwd);
+    vi.stubEnv("RUNNER_TEMP", cwd);
+
+    const result = await runPublish({
+      script: 'node -e "void 0"',
+      github: createGithub(cwd),
+      createGithubReleases: true,
+      pushGitTags: true,
+      cwd,
+    });
+
+    expect(result).toEqual({ published: false, exitCode: 0 });
+    expect(core.warning).toHaveBeenCalledWith(
+      expect.stringContaining(
+        "GitHub releases and git tags cannot be created without this output",
+      ),
+    );
+  });
+
+  it("throws when the built-in publish command does not create the output file", async () => {
+    await using fixture = await gitdir({
+      "node_modules/@changesets/cli/package.json": JSON.stringify({
+        name: "@changesets/cli",
+        type: "module",
+      }),
+      "node_modules/@changesets/cli/bin.js": "",
+      "package.json": JSON.stringify({
+        name: "simple-project",
+        version: "1.0.0",
+      }),
+      "package-lock.json": "",
+    });
+    const cwd = fixture.path;
+    await updateGithubContext(cwd);
+    vi.stubEnv("RUNNER_TEMP", cwd);
+
+    await expect(
+      runPublish({
+        github: createGithub(cwd),
+        createGithubReleases: true,
+        pushGitTags: true,
+        cwd,
+      }),
+    ).rejects.toThrow("Failed to read changesets output at");
+  });
 });
 
 describe("version", () => {
   it("creates simple PR", async () => {
-    let cwd = f.copy("simple-project");
-    linkNodeModules(cwd);
+    await using fixture = await createSimpleProjectFixture();
+    const cwd = fixture.path;
+    await updateGithubContext(cwd);
 
-    mockedGithubMethods.search.issuesAndPullRequests.mockImplementationOnce(
-      () => ({ data: { items: [] } })
-    );
+    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({ data: [] }));
 
     mockedGithubMethods.pulls.create.mockImplementationOnce(() => ({
       data: { number: 123 },
@@ -66,35 +195,34 @@ describe("version", () => {
         {
           releases: [
             {
-              name: "simple-project-pkg-a",
+              name: "changesets-dev-simple-project-pkg-a",
               type: "minor",
             },
             {
-              name: "simple-project-pkg-b",
+              name: "changesets-dev-simple-project-pkg-b",
               type: "minor",
             },
           ],
           summary: "Awesome feature",
         },
       ],
-      cwd
+      cwd,
     );
 
     await runVersion({
-      githubToken: "@@GITHUB_TOKEN",
+      github: createGithub(cwd),
       cwd,
     });
 
     expect(mockedGithubMethods.pulls.create.mock.calls[0]).toMatchSnapshot();
   });
 
-  it("only includes bumped packages in the PR body", async () => {
-    let cwd = f.copy("simple-project");
-    linkNodeModules(cwd);
+  it('creates a draft PR when prDraft is "create"', async () => {
+    await using fixture = await createSimpleProjectFixture();
+    const cwd = fixture.path;
+    await updateGithubContext(cwd);
 
-    mockedGithubMethods.search.issuesAndPullRequests.mockImplementationOnce(
-      () => ({ data: { items: [] } })
-    );
+    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({ data: [] }));
 
     mockedGithubMethods.pulls.create.mockImplementationOnce(() => ({
       data: { number: 123 },
@@ -105,18 +233,53 @@ describe("version", () => {
         {
           releases: [
             {
-              name: "simple-project-pkg-a",
+              name: "changesets-dev-simple-project-pkg-a",
               type: "minor",
             },
           ],
           summary: "Awesome feature",
         },
       ],
-      cwd
+      cwd,
     );
 
     await runVersion({
-      githubToken: "@@GITHUB_TOKEN",
+      github: createGithub(cwd),
+      cwd,
+      prDraft: "create",
+    });
+
+    expect(mockedGithubMethods.pulls.create.mock.calls[0]).toMatchSnapshot();
+  });
+
+  it("only includes bumped packages in the PR body", async () => {
+    await using fixture = await createSimpleProjectFixture();
+    const cwd = fixture.path;
+    await updateGithubContext(cwd);
+
+    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({ data: [] }));
+
+    mockedGithubMethods.pulls.create.mockImplementationOnce(() => ({
+      data: { number: 123 },
+    }));
+
+    await writeChangesets(
+      [
+        {
+          releases: [
+            {
+              name: "changesets-dev-simple-project-pkg-a",
+              type: "minor",
+            },
+          ],
+          summary: "Awesome feature",
+        },
+      ],
+      cwd,
+    );
+
+    await runVersion({
+      github: createGithub(cwd),
       cwd,
     });
 
@@ -124,12 +287,11 @@ describe("version", () => {
   });
 
   it("doesn't include ignored package that got a dependency update in the PR body", async () => {
-    let cwd = f.copy("ignored-package");
-    linkNodeModules(cwd);
+    await using fixture = await createIgnoredPackageFixture();
+    const cwd = fixture.path;
+    await updateGithubContext(cwd);
 
-    mockedGithubMethods.search.issuesAndPullRequests.mockImplementationOnce(
-      () => ({ data: { items: [] } })
-    );
+    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({ data: [] }));
 
     mockedGithubMethods.pulls.create.mockImplementationOnce(() => ({
       data: { number: 123 },
@@ -140,18 +302,18 @@ describe("version", () => {
         {
           releases: [
             {
-              name: "ignored-package-pkg-b",
+              name: "changesets-dev-ignored-package-pkg-b",
               type: "minor",
             },
           ],
           summary: "Awesome feature",
         },
       ],
-      cwd
+      cwd,
     );
 
     await runVersion({
-      githubToken: "@@GITHUB_TOKEN",
+      github: createGithub(cwd),
       cwd,
     });
 
@@ -159,12 +321,11 @@ describe("version", () => {
   });
 
   it("does not include changelog entries if full message exceeds size limit", async () => {
-    let cwd = f.copy("simple-project");
-    linkNodeModules(cwd);
+    await using fixture = await createSimpleProjectFixture();
+    const cwd = fixture.path;
+    await updateGithubContext(cwd);
 
-    mockedGithubMethods.search.issuesAndPullRequests.mockImplementationOnce(
-      () => ({ data: { items: [] } })
-    );
+    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({ data: [] }));
 
     mockedGithubMethods.pulls.create.mockImplementationOnce(() => ({
       data: { number: 123 },
@@ -175,7 +336,7 @@ describe("version", () => {
         {
           releases: [
             {
-              name: "simple-project-pkg-a",
+              name: "changesets-dev-simple-project-pkg-a",
               type: "minor",
             },
           ],
@@ -202,28 +363,27 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
 `,
         },
       ],
-      cwd
+      cwd,
     );
 
     await runVersion({
-      githubToken: "@@GITHUB_TOKEN",
+      github: createGithub(cwd),
       cwd,
       prBodyMaxCharacters: 1000,
     });
 
     expect(mockedGithubMethods.pulls.create.mock.calls[0]).toMatchSnapshot();
     expect(mockedGithubMethods.pulls.create.mock.calls[0][0].body).toMatch(
-      /The changelog information of each package has been omitted from this message/
+      /The changelog information of each package has been omitted from this message/,
     );
   });
 
   it("does not include any release information if a message with simplified release info exceeds size limit", async () => {
-    let cwd = f.copy("simple-project");
-    linkNodeModules(cwd);
+    await using fixture = await createSimpleProjectFixture();
+    const cwd = fixture.path;
+    await updateGithubContext(cwd);
 
-    mockedGithubMethods.search.issuesAndPullRequests.mockImplementationOnce(
-      () => ({ data: { items: [] } })
-    );
+    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({ data: [] }));
 
     mockedGithubMethods.pulls.create.mockImplementationOnce(() => ({
       data: { number: 123 },
@@ -234,7 +394,7 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
         {
           releases: [
             {
-              name: "simple-project-pkg-a",
+              name: "changesets-dev-simple-project-pkg-a",
               type: "minor",
             },
           ],
@@ -261,18 +421,84 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
 `,
         },
       ],
-      cwd
+      cwd,
     );
 
     await runVersion({
-      githubToken: "@@GITHUB_TOKEN",
+      github: createGithub(cwd),
       cwd,
       prBodyMaxCharacters: 500,
     });
 
     expect(mockedGithubMethods.pulls.create.mock.calls[0]).toMatchSnapshot();
     expect(mockedGithubMethods.pulls.create.mock.calls[0][0].body).toMatch(
-      /All release information have been omitted from this message, as the content exceeds the size limit/
+      /All release information have been omitted from this message, as the content exceeds the size limit/,
     );
   });
+
+  it('updates an existing PR via GraphQL without converting it to draft when prDraft is "create"', async () => {
+    await using fixture = await createSimpleProjectFixture();
+    const cwd = fixture.path;
+    await updateGithubContext(cwd);
+
+    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({
+      data: [{ number: 123, node_id: "PR_kwDOA" }],
+    }));
+
+    await writeChangesets(
+      [
+        {
+          releases: [
+            {
+              name: "changesets-dev-simple-project-pkg-a",
+              type: "minor",
+            },
+          ],
+          summary: "Awesome feature",
+        },
+      ],
+      cwd,
+    );
+
+    await runVersion({
+      github: createGithub(cwd),
+      cwd,
+      prDraft: "create",
+    });
+
+    expect(mockedGraphql.mock.calls[0]).toMatchSnapshot();
+  });
+
+  it('updates an existing PR via GraphQL and converts it to draft when prDraft is "always"', async () => {
+    await using fixture = await createSimpleProjectFixture();
+    const cwd = fixture.path;
+    await updateGithubContext(cwd);
+
+    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({
+      data: [{ number: 123, node_id: "PR_kwDOA" }],
+    }));
+
+    await writeChangesets(
+      [
+        {
+          releases: [
+            {
+              name: "changesets-dev-simple-project-pkg-a",
+              type: "minor",
+            },
+          ],
+          summary: "Awesome feature",
+        },
+      ],
+      cwd,
+    );
+
+    await runVersion({
+      github: createGithub(cwd),
+      cwd,
+      prDraft: "always",
+    });
+
+    expect(mockedGraphql.mock.calls[0]).toMatchSnapshot();
+  });
 });

src/run.ts

@@ -1,20 +1,29 @@
-import { exec } from "@actions/exec";
-import * as github from "@actions/github";
-import fs from "fs-extra";
-import { getPackages, Package } from "@manypkg/get-packages";
-import path from "path";
-import * as semver from "semver";
-import { PreState } from "@changesets/types";
+import { randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import * as core from "@actions/core";
 import {
-  getChangelogEntry,
-  execWithOutput,
+  exec,
+  getExecOutput,
+  type ExecOptions,
+  type ExecOutput,
+} from "@actions/exec";
+import { context } from "@actions/github";
+import type { PreState } from "@changesets/types";
+import { type Package, getPackages } from "@manypkg/get-packages";
+import type { GitHub } from "./github.ts";
+import type { Octokit } from "./octokit.ts";
+import readChangesetState from "./readChangesetState.ts";
+import {
+  execChangesetsCli,
   getChangedPackages,
-  sortTheThings,
+  getChangelogEntry,
+  getExecOutputChangesetsCli,
   getVersionsByDirectory,
-} from "./utils";
-import * as gitUtils from "./gitUtils";
-import readChangesetState from "./readChangesetState";
-import resolveFrom from "resolve-from";
+  isErrorWithCode,
+  sortTheThings,
+} from "./utils.ts";
 
 // GitHub Issues/PRs messages have a max size limit on the
 // message body payload.
@@ -23,158 +32,233 @@ import resolveFrom from "resolve-from";
 const MAX_CHARACTERS_PER_MESSAGE = 60000;
 
 const createRelease = async (
-  octokit: ReturnType<typeof github.getOctokit>,
-  { pkg, tagName }: { pkg: Package; tagName: string }
+  octokit: Octokit,
+  { pkg, tagName }: { pkg: Package; tagName: string },
 ) => {
+  let changelog;
   try {
-    let changelogFileName = path.join(pkg.dir, "CHANGELOG.md");
-
-    let changelog = await fs.readFile(changelogFileName, "utf8");
-
+    changelog = await fs.readFile(path.join(pkg.dir, "CHANGELOG.md"), "utf8");
+  } catch (err) {
+    if (isErrorWithCode(err, "ENOENT")) {
+      // if we can't find a changelog, the user has probably disabled changelogs
+      return;
+    }
+    throw err;
+  }
   let changelogEntry = getChangelogEntry(changelog, pkg.packageJson.version);
   if (!changelogEntry) {
     // we can find a changelog but not the entry for this version
     // if this is true, something has probably gone wrong
     throw new Error(
-        `Could not find changelog entry for ${pkg.packageJson.name}@${pkg.packageJson.version}`
+      `Could not find changelog entry for ${pkg.packageJson.name}@${pkg.packageJson.version}`,
     );
   }
 
-    await octokit.repos.createRelease({
+  await octokit.rest.repos.createRelease({
     name: tagName,
     tag_name: tagName,
     body: changelogEntry.content,
     prerelease: pkg.packageJson.version.includes("-"),
-      ...github.context.repo,
+    ...context.repo,
   });
-  } catch (err: any) {
-    // if we can't find a changelog, the user has probably disabled changelogs
-    if (err.code !== "ENOENT") {
-      throw err;
-    }
-  }
 };
 
 type PublishOptions = {
-  script: string;
-  githubToken: string;
+  script?: string;
+  fromPackDir?: string;
   createGithubReleases: boolean;
-  cwd?: string;
+  pushGitTags: boolean;
+  github: GitHub;
+  cwd: string;
 };
 
 type PublishedPackage = { name: string; version: string };
+type ChangesetsOutputEvent = {
+  type: "git-tag";
+  tag: string;
+  packageName: string;
+};
+
+class ChangesetsOutputReadError extends Error {}
 
 type PublishResult =
   | {
       published: true;
       publishedPackages: PublishedPackage[];
+      exitCode: number;
     }
   | {
       published: false;
+      exitCode: number;
     };
 
+function isObject(value: unknown) {
+  return typeof value === "object" && value !== null;
+}
+
+function isChangesetsOutputEvent(
+  value: unknown,
+): value is ChangesetsOutputEvent {
+  return (
+    isObject(value) &&
+    "type" in value &&
+    value.type === "git-tag" &&
+    "tag" in value &&
+    typeof value.tag === "string" &&
+    "packageName" in value &&
+    typeof value.packageName === "string"
+  );
+}
+
+async function readChangesetsOutput(outputPath: string) {
+  let rawOutput: string;
+  try {
+    rawOutput = await fs.readFile(outputPath, "utf8");
+  } catch (err) {
+    throw new ChangesetsOutputReadError(
+      `Failed to read changesets output at ${outputPath}`,
+      { cause: err },
+    );
+  }
+
+  const events: ChangesetsOutputEvent[] = [];
+
+  let lineStart = 0;
+  while (lineStart <= rawOutput.length) {
+    let lineEnd = rawOutput.indexOf("\n", lineStart);
+    if (lineEnd === -1) {
+      lineEnd = rawOutput.length;
+    }
+    const line = rawOutput.slice(lineStart, lineEnd);
+    lineStart = lineEnd + 1;
+
+    if (/^\s*$/.test(line)) {
+      continue;
+    }
+
+    let event: unknown;
+    try {
+      event = JSON.parse(line);
+    } catch (err) {
+      throw new Error(`Failed to parse changesets output event: ${line}`, {
+        cause: err,
+      });
+    }
+
+    if (!isChangesetsOutputEvent(event)) {
+      continue;
+    }
+
+    events.push(event);
+  }
+
+  return events;
+}
+
 export async function runPublish({
   script,
-  githubToken,
+  fromPackDir,
+  github,
   createGithubReleases,
-  cwd = process.cwd(),
+  pushGitTags,
+  cwd,
 }: PublishOptions): Promise<PublishResult> {
-  let octokit = github.getOctokit(githubToken);
-  let [publishCommand, ...publishArgs] = script.split(/\s+/);
+  const { octokit } = github;
+  // Changesets creates annotated tags locally, including when the action pushes those tags through the GitHub API.
+  // It might also be important for custom publish scripts to have a valid git user configured.
+  await github.ensureGitUser();
 
-  let changesetPublishOutput = await execWithOutput(
-    publishCommand,
-    publishArgs,
-    { cwd }
+  let changesetPublishOutput: ExecOutput;
+  const outputFile = path.join(
+    process.env.RUNNER_TEMP ?? (await fs.realpath(os.tmpdir())),
+    `changesets-output-${randomUUID()}.ndjson`,
   );
+  const execOptions: ExecOptions = {
+    cwd,
+    ignoreReturnCode: true,
+    env: {
+      ...process.env,
+      GITHUB_TOKEN: github.getToken(),
+      CHANGESETS_OUTPUT: outputFile,
+    },
+  };
 
-  await gitUtils.pushTags();
+  if (script) {
+    changesetPublishOutput = await getExecOutput(
+      script,
+      undefined,
+      execOptions,
+    );
+  } else {
+    const args = ["publish"];
+    if (fromPackDir) {
+      args.push("--from-pack-dir", fromPackDir);
+    }
+    changesetPublishOutput = await getExecOutputChangesetsCli(
+      args,
+      execOptions,
+    );
+  }
 
   let { packages, tool } = await getPackages(cwd);
-  let releasedPackages: Package[] = [];
-
-  if (tool !== "root") {
-    let newTagRegex = /New tag:\s+(@[^/]+\/[^@]+|[^/]+)@([^\s]+)/;
   let packagesByName = new Map(packages.map((x) => [x.packageJson.name, x]));
-
-    for (let line of changesetPublishOutput.stdout.split("\n")) {
-      let match = line.match(newTagRegex);
-      if (match === null) {
-        continue;
+  let output: ChangesetsOutputEvent[];
+  try {
+    output = await readChangesetsOutput(outputFile);
+  } catch (err) {
+    if (!script || !(err instanceof ChangesetsOutputReadError)) {
+      throw err;
     }
-      let pkgName = match[1];
-      let pkg = packagesByName.get(pkgName);
+    core.warning(
+      `${err.message}. GitHub releases and git tags cannot be created without this output. Ensure the custom publish script passes CHANGESETS_OUTPUT to the Changesets CLI.`,
+    );
+    output = [];
+  }
+  let releases = output.map((event) => {
+    let pkg = packagesByName.get(event.packageName);
     if (pkg === undefined) {
       throw new Error(
-          `Package "${pkgName}" not found.` +
-            "This is probably a bug in the action, please open an issue"
+        `Package "${event.packageName}" not found.` +
+          "This is probably a bug in the action, please open an issue",
       );
     }
-      releasedPackages.push(pkg);
-    }
+    return { pkg, tag: event.tag };
+  });
 
-    if (createGithubReleases) {
-      await Promise.all(
-        releasedPackages.map((pkg) =>
-          createRelease(octokit, {
-            pkg,
-            tagName: `${pkg.packageJson.name}@${pkg.packageJson.version}`,
-          })
-        )
-      );
-    }
-  } else {
-    if (packages.length === 0) {
+  if (tool.type === "root" && packages.length === 0) {
     throw new Error(
       `No package found.` +
-          "This is probably a bug in the action, please open an issue"
+        "This is probably a bug in the action, please open an issue",
     );
   }
-    let pkg = packages[0];
-    let newTagRegex = /New tag:/;
 
-    for (let line of changesetPublishOutput.stdout.split("\n")) {
-      let match = line.match(newTagRegex);
-
-      if (match) {
-        releasedPackages.push(pkg);
+  if (createGithubReleases || pushGitTags) {
+    await Promise.all(
+      releases.map(async ({ pkg, tag }) => {
+        if (pushGitTags) {
+          await github.pushTag(tag);
+        }
         if (createGithubReleases) {
-          await createRelease(octokit, {
-            pkg,
-            tagName: `v${pkg.packageJson.version}`,
-          });
-        }
-        break;
-      }
+          await createRelease(octokit, { pkg, tagName: tag });
         }
+      }),
+    );
   }
 
-  if (releasedPackages.length) {
+  if (releases.length) {
     return {
       published: true,
-      publishedPackages: releasedPackages.map((pkg) => ({
+      publishedPackages: releases.map(({ pkg }) => ({
         name: pkg.packageJson.name,
         version: pkg.packageJson.version,
       })),
+      exitCode: changesetPublishOutput.exitCode,
     };
   }
 
-  return { published: false };
+  return { published: false, exitCode: changesetPublishOutput.exitCode };
 }
 
-const requireChangesetsCliPkgJson = (cwd: string) => {
-  try {
-    return require(resolveFrom(cwd, "@changesets/cli/package.json"));
-  } catch (err: any) {
-    if (err && err.code === "MODULE_NOT_FOUND") {
-      throw new Error(
-        `Have you forgotten to install \`@changesets/cli\` in "${cwd}"?`
-      );
-    }
-    throw err;
-  }
-};
-
 type GetMessageOptions = {
   hasPublishScript: boolean;
   branch: string;
@@ -246,12 +330,14 @@ export async function getVersionPrBody({
 
 type VersionOptions = {
   script?: string;
-  githubToken: string;
+  github: GitHub;
   cwd?: string;
   prTitle?: string;
   commitMessage?: string;
   hasPublishScript?: boolean;
   prBodyMaxCharacters?: number;
+  prDraft?: "always" | "create";
+  branch?: string;
 };
 
 type RunVersionResult = {
@@ -260,47 +346,38 @@ type RunVersionResult = {
 
 export async function runVersion({
   script,
-  githubToken,
+  github,
   cwd = process.cwd(),
   prTitle = "Version Packages",
   commitMessage = "Version Packages",
   hasPublishScript = false,
   prBodyMaxCharacters = MAX_CHARACTERS_PER_MESSAGE,
+  branch = context.ref.replace("refs/heads/", ""),
+  prDraft,
 }: VersionOptions): Promise<RunVersionResult> {
-  let repo = `${github.context.repo.owner}/${github.context.repo.repo}`;
-  let branch = github.context.ref.replace("refs/heads/", "");
+  const { octokit } = github;
   let versionBranch = `changeset-release/${branch}`;
-  let octokit = github.getOctokit(githubToken);
+
   let { preState } = await readChangesetState(cwd);
 
-  await gitUtils.switchToMaybeExistingBranch(versionBranch);
-  await gitUtils.reset(github.context.sha);
+  await github.prepareBranch(versionBranch);
 
   let versionsByDirectory = await getVersionsByDirectory(cwd);
 
+  const env = { ...process.env, GITHUB_TOKEN: github.getToken() };
+
   if (script) {
-    let [versionCommand, ...versionArgs] = script.split(/\s+/);
-    await exec(versionCommand, versionArgs, { cwd });
+    await exec(script, undefined, { cwd, env });
   } else {
-    let changesetsCliPkgJson = requireChangesetsCliPkgJson(cwd);
-    let cmd = semver.lt(changesetsCliPkgJson.version, "2.0.0")
-      ? "bump"
-      : "version";
-    await exec("node", [resolveFrom(cwd, "@changesets/cli/bin.js"), cmd], {
-      cwd,
-    });
+    await execChangesetsCli(["version"], { cwd, env });
   }
 
-  let searchQuery = `repo:${repo}+state:open+head:${versionBranch}+base:${branch}`;
-  let searchResultPromise = octokit.search.issuesAndPullRequests({
-    q: searchQuery,
-  });
   let changedPackages = await getChangedPackages(cwd, versionsByDirectory);
   let changedPackagesInfoPromises = Promise.all(
     changedPackages.map(async (pkg) => {
       let changelogContents = await fs.readFile(
         path.join(pkg.dir, "CHANGELOG.md"),
-        "utf8"
+        "utf8",
       );
 
       let entry = getChangelogEntry(changelogContents, pkg.packageJson.version);
@@ -310,23 +387,32 @@ export async function runVersion({
         content: entry.content,
         header: `## ${pkg.packageJson.name}@${pkg.packageJson.version}`,
       };
-    })
+    }),
   );
 
   const finalPrTitle = `${prTitle}${!!preState ? ` (${preState.tag})` : ""}`;
-
-  // project with `commit: true` setting could have already committed files
-  if (!(await gitUtils.checkIfClean())) {
   const finalCommitMessage = `${commitMessage}${
     !!preState ? ` (${preState.tag})` : ""
   }`;
-    await gitUtils.commitAll(finalCommitMessage);
-  }
 
-  await gitUtils.push(versionBranch, { force: true });
+  const existingPullRequests = await octokit.rest.pulls.list({
+    ...context.repo,
+    state: "open",
+    head: `${context.repo.owner}:${versionBranch}`,
+    base: branch,
+  });
+  core.debug(
+    `Existing pull requests: ${JSON.stringify(
+      existingPullRequests.data,
+      null,
+      2,
+    )}`,
+  );
 
-  let searchResult = await searchResultPromise;
-  console.log(JSON.stringify(searchResult.data, null, 2));
+  await github.pushChanges({
+    branch: versionBranch,
+    message: finalCommitMessage,
+  });
 
   const changedPackagesInfo = (await changedPackagesInfoPromises)
     .filter((x) => x)
@@ -340,28 +426,64 @@ export async function runVersion({
     prBodyMaxCharacters,
   });
 
-  if (searchResult.data.items.length === 0) {
-    console.log("creating pull request");
-    const { data: newPullRequest } = await octokit.pulls.create({
+  if (existingPullRequests.data.length === 0) {
+    core.info("Creating pull request");
+    const { data: newPullRequest } = await octokit.rest.pulls.create({
       base: branch,
       head: versionBranch,
       title: finalPrTitle,
       body: prBody,
-      ...github.context.repo,
+      draft: prDraft !== undefined,
+      ...context.repo,
     });
 
     return {
       pullRequestNumber: newPullRequest.number,
     };
   } else {
-    const [pullRequest] = searchResult.data.items;
+    const [pullRequest] = existingPullRequests.data;
 
-    console.log(`updating found pull request #${pullRequest.number}`);
-    await octokit.pulls.update({
-      pull_number: pullRequest.number,
+    core.info(`Updating found pull request #${pullRequest.number}`);
+    const convertPullRequestToDraftMutation =
+      prDraft === "always"
+        ? `
+        convertPullRequestToDraft(
+          input: {
+            pullRequestId: $pullRequestId
+          }
+        ) {
+          pullRequest {
+            id
+          }
+        }`
+        : "";
+    const updatePullRequestMutation = `
+      mutation UpdatePullRequest(
+        $pullRequestId: ID!
+        $title: String!
+        $body: String!
+      ) {
+        ${convertPullRequestToDraftMutation}
+
+        updatePullRequest(
+          input: {
+            pullRequestId: $pullRequestId
+            title: $title
+            body: $body
+            state: OPEN
+          }
+        ) {
+          pullRequest {
+            id
+          }
+        }
+      }
+    `;
+
+    await octokit.graphql(updatePullRequestMutation, {
+      pullRequestId: pullRequest.node_id,
       title: finalPrTitle,
       body: prBody,
-      ...github.context.repo,
     });
 
     return {

src/select-mode/index.ts

@@ -0,0 +1,125 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import artifact from "@actions/artifact";
+import * as core from "@actions/core";
+import readChangesetState from "../readChangesetState.ts";
+import {
+  execChangesetsCli,
+  getOptionalInput,
+  validateChangesetsCliVersion,
+} from "../utils.ts";
+
+type ModeResult =
+  | {
+      mode: "none";
+    }
+  | {
+      mode: "version";
+    }
+  | {
+      mode: "publish";
+      publishPlanPath: string;
+    };
+
+type PublishPlan = unknown[];
+
+try {
+  await main();
+} catch (err) {
+  core.setFailed((err as Error).message);
+}
+
+async function main() {
+  const cwd = getOptionalInput("cwd") || process.cwd();
+  await validateChangesetsCliVersion(cwd);
+
+  const result = await getMode(cwd);
+  core.setOutput("mode", result.mode);
+  if (result.mode === "publish") {
+    const publishPlanArtifact = await artifact.uploadArtifact(
+      path.basename(result.publishPlanPath, ".json"),
+      [result.publishPlanPath],
+      path.dirname(result.publishPlanPath),
+      {
+        skipArchive: true,
+        retentionDays: 30,
+      },
+    );
+    if (publishPlanArtifact.id === undefined) {
+      throw new Error(
+        "Publish plan artifact upload did not return an artifact id",
+      );
+    }
+    core.setOutput("publish-plan-artifact-id", String(publishPlanArtifact.id));
+  }
+}
+
+async function getMode(cwd: string): Promise<ModeResult> {
+  const { changesets } = await readChangesetState(cwd);
+
+  if (changesets.length > 0) {
+    const hasNonEmptyChangesets = changesets.some(
+      (changeset) => changeset.releases.length > 0,
+    );
+    if (hasNonEmptyChangesets) {
+      return { mode: "version" };
+    }
+    return { mode: "none" };
+  }
+
+  const publishPlanPath = path.join(
+    process.env.RUNNER_TEMP ?? (await fs.realpath(os.tmpdir())),
+    `changeset-publish-plan-${Date.now()}`,
+    // we need a stable filename here (in a unique dirname) so the artifact download can find this cleanly
+    "publish-plan.json",
+  );
+  await execChangesetsCli(["publish-plan", "--output", publishPlanPath], {
+    cwd,
+    env: process.env,
+  });
+
+  const publishPlan = await readPublishPlan(publishPlanPath);
+  if (publishPlan.length === 0) {
+    return { mode: "none" };
+  }
+
+  return {
+    mode: "publish",
+    publishPlanPath,
+  };
+}
+
+async function readPublishPlan(publishPlanPath: string): Promise<PublishPlan> {
+  let rawPlan: string;
+  try {
+    rawPlan = await fs.readFile(publishPlanPath, "utf8");
+  } catch (err) {
+    throw new Error(`Failed to read publish plan at ${publishPlanPath}`, {
+      cause: err,
+    });
+  }
+
+  let plan: unknown;
+  try {
+    plan = JSON.parse(rawPlan);
+  } catch (err) {
+    throw new Error(`Failed to parse publish plan at ${publishPlanPath}`, {
+      cause: err,
+    });
+  }
+
+  if (
+    typeof plan !== "object" ||
+    plan === null ||
+    !("version" in plan) ||
+    typeof plan.version !== "number" ||
+    !("plan" in plan) ||
+    !Array.isArray(plan.plan)
+  ) {
+    throw new Error(
+      `Invalid publish plan at ${publishPlanPath}: expected { version: number; plan: unknown[] }`,
+    );
+  }
+  return plan.plan;
+}

src/test-utils.ts

@@ -0,0 +1,293 @@
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import fsp from "node:fs/promises";
+import http, { type IncomingMessage, type ServerResponse } from "node:http";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { createFixture, type FileTree } from "fs-fixture";
+import { exec } from "tinyexec";
+import { moveDisposable } from "./utils.ts";
+
+export type Fixture = FileTree;
+
+export async function testdir(dir?: Fixture) {
+  return createFixture(dir, {
+    fs: {
+      ...fsp,
+      rm: (filePath, options) =>
+        fsp.rm(filePath, {
+          maxRetries: 3,
+          retryDelay: 100,
+          ...options,
+        }),
+    },
+  });
+}
+
+// Git maintenance can race with fixture cleanup by touching pack files.
+export async function disableGitBackgroundMaintenance(cwd: string) {
+  await exec("git", ["config", "gc.auto", "0"], {
+    nodeOptions: { cwd },
+    throwOnError: true,
+  });
+  await exec("git", ["config", "maintenance.auto", "false"], {
+    nodeOptions: { cwd },
+    throwOnError: true,
+  });
+}
+
+export async function gitdir(dir: Fixture) {
+  await using stack = new AsyncDisposableStack();
+  const fixture = stack.use(
+    await testdir({
+      ".gitattributes": "* text=auto eol=lf\n",
+      ...dir,
+    }),
+  );
+  const cwd = fixture.path;
+
+  await exec("git", ["init"], {
+    nodeOptions: { cwd },
+    throwOnError: true,
+  });
+  await disableGitBackgroundMaintenance(cwd);
+
+  const { stdout } = await exec("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+    nodeOptions: { cwd },
+  });
+  if (stdout.trim() !== "main") {
+    await exec("git", ["checkout", "-b", "main"], {
+      nodeOptions: { cwd },
+      throwOnError: true,
+    });
+  }
+
+  const gitConfig = `
+[user]
+    email = x@y.z
+    name = xyz
+[commit]
+    gpgSign = false
+[tag]
+    gpgSign = false
+    forceSignAnnotated = false
+  `.trim();
+  await fsp.appendFile(path.join(cwd, ".git/config"), gitConfig, "utf8");
+
+  await exec("git", ["add", "."], {
+    nodeOptions: { cwd },
+    throwOnError: true,
+  });
+  await exec("git", ["commit", "-m", "initial commit", "--allow-empty"], {
+    nodeOptions: { cwd },
+    throwOnError: true,
+  });
+
+  return moveDisposable(stack, fixture);
+}
+
+export async function shallowClone(cwd: string, depth = 1) {
+  await using stack = new AsyncDisposableStack();
+  const fixture = stack.use(await testdir());
+  await exec(
+    "git",
+    ["clone", "--depth", depth.toString(), pathToFileURL(cwd).toString(), "."],
+    {
+      nodeOptions: { cwd: fixture.path },
+      throwOnError: true,
+    },
+  );
+  await disableGitBackgroundMaintenance(fixture.path);
+  return moveDisposable(stack, fixture);
+}
+
+async function runGitHttpBackend(
+  cwd: string,
+  request: IncomingMessage,
+  response: ServerResponse,
+) {
+  // `git http-backend` speaks CGI: request metadata goes through environment
+  // variables, the request body through stdin, and the response through stdout.
+  const requestUrl = new URL(
+    request.url ?? "/",
+    `http://${request.headers.host ?? "localhost"}`,
+  );
+  const env: NodeJS.ProcessEnv = {
+    ...process.env,
+    CONTENT_LENGTH: request.headers["content-length"] ?? "0",
+    GATEWAY_INTERFACE: "CGI/1.1",
+    GIT_HTTP_EXPORT_ALL: "1",
+    GIT_PROJECT_ROOT: cwd,
+    PATH_INFO: decodeURIComponent(requestUrl.pathname),
+    QUERY_STRING: requestUrl.search.slice(1),
+    REMOTE_ADDR: request.socket.remoteAddress ?? "",
+    REQUEST_METHOD: request.method ?? "GET",
+    SERVER_PROTOCOL: `HTTP/${request.httpVersion}`,
+  };
+  if (request.headers["content-type"] !== undefined) {
+    env.CONTENT_TYPE = request.headers["content-type"];
+  }
+
+  const backend = spawn("git", ["http-backend"], {
+    env,
+    stdio: ["pipe", "pipe", "pipe"],
+  });
+  request.pipe(backend.stdin);
+
+  // Buffer stdout so the CGI headers can be separated from the response body.
+  // Keep stderr only to explain a backend failure.
+  const stdout: Buffer[] = [];
+  const stderr: Buffer[] = [];
+  backend.stdout.on("data", (chunk: Buffer) => stdout.push(chunk));
+  backend.stderr.on("data", (chunk: Buffer) => stderr.push(chunk));
+
+  const exitCode = await new Promise<number | null>((resolve, reject) => {
+    backend.on("error", reject);
+    backend.on("close", resolve);
+  });
+  if (exitCode !== 0) {
+    throw new Error(
+      `git http-backend exited with ${exitCode}: ${Buffer.concat(stderr).toString("utf8")}`,
+    );
+  }
+
+  const output = Buffer.concat(stdout);
+  // CGI ends its response headers with a blank line; accept CRLF and LF output.
+  let separator = Buffer.from("\r\n\r\n");
+  let headerEnd = output.indexOf(separator);
+  if (headerEnd === -1) {
+    separator = Buffer.from("\n\n");
+    headerEnd = output.indexOf(separator);
+  }
+  if (headerEnd === -1) {
+    throw new Error("git http-backend returned an invalid CGI response");
+  }
+
+  // Translate CGI status and headers, then forward the remaining bytes as body.
+  let status = 200;
+  const headers = output.subarray(0, headerEnd).toString("utf8").split(/\r?\n/);
+  for (const header of headers) {
+    const separatorIndex = header.indexOf(":");
+    if (separatorIndex === -1) continue;
+
+    const name = header.slice(0, separatorIndex);
+    const value = header.slice(separatorIndex + 1).trim();
+    if (name.toLowerCase() === "status") {
+      status = Number.parseInt(value, 10);
+    } else {
+      response.setHeader(name, value);
+    }
+  }
+
+  response.writeHead(status);
+  response.end(output.subarray(headerEnd + separator.length));
+}
+
+async function listen(server: http.Server) {
+  const waiter = Promise.withResolvers();
+
+  server.on("listening", waiter.resolve);
+  server.on("error", waiter.reject);
+
+  server.listen(0);
+
+  try {
+    await waiter.promise;
+    return server;
+  } finally {
+    server.off("listening", waiter.resolve);
+    server.off("error", waiter.reject);
+  }
+}
+
+type RecordedRequest = {
+  method: string;
+  url: string;
+  headers: NodeJS.Dict<string[]>;
+};
+
+function recordRequest(request: IncomingMessage): RecordedRequest {
+  return {
+    method: request.method ?? "GET",
+    url: request.url ?? "/",
+    headers: request.headersDistinct,
+  };
+}
+
+async function createGitHttpServer(cwd: string) {
+  const requests: RecordedRequest[] = [];
+  const server = http.createServer((request, response) => {
+    const recordedRequest = recordRequest(request);
+    requests.push(recordedRequest);
+
+    void runGitHttpBackend(cwd, request, response).catch((error: unknown) => {
+      response.destroy(
+        Error.isError(error)
+          ? error
+          : new Error("Server error", { cause: error }),
+      );
+    });
+  });
+
+  await listen(server);
+  const address = server.address();
+  assert(
+    !!address && typeof address !== "string",
+    "Failed to get server address",
+  );
+
+  return {
+    origin: `http://127.0.0.1:${address.port}`,
+    requests,
+    async [Symbol.asyncDispose]() {
+      await new Promise<void>((resolve, reject) => {
+        server.close((error) => {
+          if (error) {
+            reject(error);
+            return;
+          }
+          resolve();
+        });
+      });
+    },
+  };
+}
+
+async function createLocalRemote(dir: Fixture) {
+  await using stack = new AsyncDisposableStack();
+  const fixture = stack.use(await testdir());
+  const remote = fixture.path;
+  {
+    // Use a working repository to create the bare remote's initial history.
+    // Once cloned, the remote owns that history and the source can be disposed.
+    await using sourceFixture = await gitdir(dir);
+    await exec(
+      "git",
+      ["clone", "--bare", pathToFileURL(sourceFixture.path).toString(), "."],
+      {
+        nodeOptions: { cwd: remote },
+        throwOnError: true,
+      },
+    );
+  }
+  await disableGitBackgroundMaintenance(remote);
+  await exec("git", ["config", "http.receivepack", "true"], {
+    nodeOptions: { cwd: remote },
+    throwOnError: true,
+  });
+  return moveDisposable(stack, fixture);
+}
+
+export async function createGitHttpRemote(files: Fixture) {
+  await using stack = new AsyncDisposableStack();
+  const fixture = stack.use(await createLocalRemote(files));
+  const server = stack.use(
+    await createGitHttpServer(path.dirname(fixture.path)),
+  );
+
+  return moveDisposable(stack, {
+    path: fixture.path,
+    url: `${server.origin}/${path.basename(fixture.path)}`,
+    requests: server.requests,
+  });
+}

src/utils.test.ts

@@ -1,4 +1,12 @@
-import { getChangelogEntry, BumpLevels, sortTheThings } from "./utils";
+import { createFixture } from "fs-fixture";
+import { afterEach, expect, test, vi } from "vitest";
+import {
+  BumpLevels,
+  getChangelogEntry,
+  sortTheThings,
+  throwOnRemovedCommitModeInput,
+  validateChangesetsCliVersion,
+} from "./utils.ts";
 
 let changelog = `# @keystone-alpha/email
 
@@ -67,6 +75,10 @@ let changelog = `# @keystone-alpha/email
   - Update mjml-dependency
 `;
 
+afterEach(() => {
+  vi.unstubAllEnvs();
+});
+
 test("it works", () => {
   let entry = getChangelogEntry(changelog, "3.0.0");
   expect(entry.content).toMatchSnapshot();
@@ -99,3 +111,62 @@ test("it sorts the things right", () => {
   ];
   expect(things.sort(sortTheThings)).toMatchSnapshot();
 });
+
+test.each([
+  ["commit-mode", "git-cli", "push-with-git-cli: true"],
+  ["commit-mode", "github-api", "push-with-git-cli: false"],
+  ["commitMode", "git-cli", "push-with-git-cli: true"],
+  ["commitMode", "github-api", "push-with-git-cli: false"],
+])(
+  "explains how to migrate the removed %s input from %s",
+  (inputName, value, replacement) => {
+    vi.stubEnv(`INPUT_${inputName.toUpperCase()}`, value);
+    expect(() => throwOnRemovedCommitModeInput()).toThrow(replacement);
+  },
+);
+
+test("throws when the project declares Changesets CLI v2", async () => {
+  await using fixture = await createFixture({
+    "package.json": JSON.stringify({
+      name: "project",
+      devDependencies: { "@changesets/cli": "^2.29.7" },
+    }),
+    "package-lock.json": "",
+  });
+
+  await expect(validateChangesetsCliVersion(fixture.path)).rejects.toThrow(
+    "This version of the Changesets action is designed to work with Changesets CLI v3. Changesets CLI v2 is not supported; use Changesets action v1 instead, which is compatible with CLI v2.",
+  );
+});
+
+test("accepts a Changesets CLI v3 contract without an installed CLI", async () => {
+  await using fixture = await createFixture({
+    "package.json": JSON.stringify({
+      name: "project",
+      devDependencies: { "@changesets/cli": "^3.0.0" },
+    }),
+    "package-lock.json": "",
+  });
+
+  await expect(
+    validateChangesetsCliVersion(fixture.path),
+  ).resolves.toBeUndefined();
+});
+
+test("throws when the project has Changesets CLI v2 installed", async () => {
+  await using fixture = await createFixture({
+    "package.json": JSON.stringify({
+      name: "project",
+      devDependencies: { "@changesets/cli": "^3.0.0" },
+    }),
+    "package-lock.json": "",
+    "node_modules/@changesets/cli/package.json": JSON.stringify({
+      name: "@changesets/cli",
+      version: "2.29.7",
+    }),
+  });
+
+  await expect(validateChangesetsCliVersion(fixture.path)).rejects.toThrow(
+    "This version of the Changesets action is designed to work with Changesets CLI v3. Changesets CLI v2 is not supported; use Changesets action v1 instead, which is compatible with CLI v2.",
+  );
+});

src/utils.ts

@@ -1,10 +1,19 @@
-import unified from "unified";
-import remarkParse from "remark-parse";
-import remarkStringify from "remark-stringify";
-// @ts-ignore
-import mdastToString from "mdast-util-to-string";
-import { exec } from "@actions/exec";
-import { getPackages, Package } from "@manypkg/get-packages";
+import fs from "node:fs/promises";
+import { createRequire } from "node:module";
+import path from "node:path";
+import artifact from "@actions/artifact";
+import * as core from "@actions/core";
+import {
+  exec,
+  getExecOutput,
+  type ExecOptions as ActionsExecOptions,
+  type ExecOutput,
+} from "@actions/exec";
+import { getPackages, type Package } from "@manypkg/get-packages";
+import major from "semver/functions/major.js";
+import subset from "semver/ranges/subset.js";
+
+const require = createRequire(import.meta.url);
 
 export const BumpLevels = {
   dep: 0,
@@ -20,7 +29,7 @@ export async function getVersionsByDirectory(cwd: string) {
 
 export async function getChangedPackages(
   cwd: string,
-  previousVersions: Map<string, string>
+  previousVersions: Map<string, string>,
 ) {
   let { packages } = await getPackages(cwd);
   let changedPackages = new Set<Package>();
@@ -36,86 +45,61 @@ export async function getChangedPackages(
 }
 
 export function getChangelogEntry(changelog: string, version: string) {
-  let ast = unified().use(remarkParse).parse(changelog);
-
   let highestLevel: number = BumpLevels.dep;
-
-  let nodes = ast.children as Array<any>;
-  let headingStartInfo:
-    | {
-        index: number;
-        depth: number;
-      }
-    | undefined;
+  let headingStartInfo: { index: number; depth: number } | undefined;
   let endIndex: number | undefined;
 
-  for (let i = 0; i < nodes.length; i++) {
-    let node = nodes[i];
-    if (node.type === "heading") {
-      let stringified: string = mdastToString(node);
-      let match = stringified.toLowerCase().match(/(major|minor|patch)/);
-      if (match !== null) {
-        let level = BumpLevels[match[0] as "major" | "minor" | "patch"];
-        highestLevel = Math.max(level, highestLevel);
-      }
-      if (headingStartInfo === undefined && stringified === version) {
-        headingStartInfo = {
-          index: i,
-          depth: node.depth,
-        };
+  // Iterate through each headings and code blocks (for skipping its contents)
+  const regex = /^(#{1,6})\s(.*)$|^(`{3,})/gm;
+  let match: RegExpExecArray | null;
+  while ((match = regex.exec(changelog)) != null) {
+    // Skip over code blocks so we don't match any headings inside of them
+    if (match[3]) {
+      const endOfCodeBlockRegex = new RegExp(`^${match[3]}`, "gm");
+      endOfCodeBlockRegex.lastIndex = regex.lastIndex;
+      const endMatch = endOfCodeBlockRegex.exec(changelog);
+      if (endMatch) {
+        // Start next search for headings after the end of the code block
+        regex.lastIndex = endOfCodeBlockRegex.lastIndex;
         continue;
-      }
-      if (
-        endIndex === undefined &&
-        headingStartInfo !== undefined &&
-        headingStartInfo.depth === node.depth
-      ) {
-        endIndex = i;
+      } else {
+        // Can't find end of code block, probably malformed
         break;
       }
     }
-  }
-  if (headingStartInfo) {
-    ast.children = (ast.children as any).slice(
-      headingStartInfo.index + 1,
-      endIndex
-    );
-  }
-  return {
-    content: unified().use(remarkStringify).stringify(ast),
-    highestLevel: highestLevel,
-  };
-}
 
-export async function execWithOutput(
-  command: string,
-  args?: string[],
-  options?: { ignoreReturnCode?: boolean; cwd?: string }
-) {
-  let myOutput = "";
-  let myError = "";
+    const headingDepth = match[1].length;
+    const headingText = match[2].trim();
+
+    // Search for the highest bump level in the entire changelog
+    const levelMatch = /(major|minor|patch)/.exec(headingText.toLowerCase());
+    if (levelMatch != null) {
+      const level = BumpLevels[levelMatch[0] as "major" | "minor" | "patch"];
+      highestLevel = Math.max(level, highestLevel);
+    }
+
+    // Search for heading of the entry
+    if (headingText === version) {
+      headingStartInfo = { index: regex.lastIndex, depth: headingDepth };
+      continue;
+    }
+
+    // If we've found the entry heading, search for the closing heading with the same depth
+    if (headingStartInfo && headingDepth === headingStartInfo.depth) {
+      endIndex = match.index;
+      break;
+    }
+  }
 
   return {
-    code: await exec(command, args, {
-      listeners: {
-        stdout: (data: Buffer) => {
-          myOutput += data.toString();
-        },
-        stderr: (data: Buffer) => {
-          myError += data.toString();
-        },
-      },
-
-      ...options,
-    }),
-    stdout: myOutput,
-    stderr: myError,
+    content: changelog.slice(headingStartInfo?.index, endIndex).trim(),
+    highestLevel,
   };
 }
 
 export function sortTheThings(
   a: { private: boolean; highestLevel: number },
-  b: { private: boolean; highestLevel: number }
+  b: { private: boolean; highestLevel: number },
 ) {
   if (a.private === b.private) {
     return b.highestLevel - a.highestLevel;
@@ -125,3 +109,178 @@ export function sortTheThings(
   }
   return -1;
 }
+
+export function isErrorWithCode(err: unknown, code: string) {
+  return (
+    typeof err === "object" &&
+    err !== null &&
+    "code" in err &&
+    err.code === code
+  );
+}
+
+export type WithAsyncDispose<T> = T & {
+  [Symbol.asyncDispose](): Promise<void>;
+};
+
+export function moveDisposable<T extends object>(
+  stack: AsyncDisposableStack,
+  value: T,
+): WithAsyncDispose<T> {
+  const moved = stack.move();
+  return Object.assign(value, {
+    async [Symbol.asyncDispose]() {
+      await moved.disposeAsync();
+    },
+  });
+}
+
+export function getOptionalInput(name: string) {
+  // normalize empty string default return value of `core.getInput` to undefined
+  return core.getInput(name) || undefined;
+}
+
+export function getRequiredInput(name: string) {
+  // it's just a small utility wrapper, mainly introduced for usage parity with our custom `getOptionalInput`
+  // note: `core.getBooleanInput` gets used directly as it already normalizes the return value nicely
+  return core.getInput(name, { required: true });
+}
+
+export function throwOnRemovedCommitModeInput() {
+  for (const inputName of ["commit-mode", "commitMode"]) {
+    const value = getOptionalInput(inputName);
+    if (value === undefined) continue;
+
+    const migration =
+      value === "git-cli"
+        ? 'Replace it with "push-with-git-cli: true".'
+        : value === "github-api"
+          ? 'Remove it or replace it with "push-with-git-cli: false"; GitHub API pushes are now the default.'
+          : 'Set "push-with-git-cli" to true for Git CLI pushes or false for GitHub API pushes.';
+    throw new Error(
+      `The "${inputName}" input has been replaced by the boolean "push-with-git-cli" input. ${migration}`,
+    );
+  }
+}
+
+export function throwOnRenamedInputs(renames: Record<string, string>) {
+  const references: Record<string, string> = {};
+
+  for (const [oldInput, newInput] of Object.entries(renames)) {
+    if (core.getInput(oldInput)) {
+      references[oldInput] = newInput;
+    }
+  }
+
+  if (Object.keys(references).length > 0) {
+    const list = Object.entries(references)
+      .map(([oldInput, newInput]) => `- "${oldInput}" -> "${newInput}"`)
+      .join("\n");
+    throw new Error(
+      `The following inputs have been renamed:\n${list}\nPlease update your workflow file.`,
+    );
+  }
+}
+
+const changesetsCliCompatibilityError =
+  "This version of the Changesets action is designed to work with Changesets CLI v3. " +
+  "Changesets CLI v2 is not supported; use Changesets action v1 instead, which is compatible with CLI v2.";
+
+export async function validateChangesetsCliVersion(cwd: string) {
+  const { rootPackage } = await getPackages(cwd);
+  const packageJson = rootPackage?.packageJson;
+  const declaredVersion =
+    packageJson?.devDependencies?.["@changesets/cli"] ??
+    packageJson?.dependencies?.["@changesets/cli"];
+
+  if (typeof declaredVersion === "string") {
+    const range = declaredVersion.startsWith("workspace:")
+      ? declaredVersion.slice("workspace:".length)
+      : declaredVersion;
+
+    let isV2 = false;
+
+    try {
+      isV2 = subset(range, ">=2.0.0-0 <3.0.0-0", {
+        includePrerelease: true,
+      });
+    } catch {
+      // it could be a non-semver protocol
+    }
+
+    if (isV2) {
+      throw new Error(changesetsCliCompatibilityError);
+    }
+  }
+
+  let cliPackageJson;
+
+  try {
+    cliPackageJson = require(
+      require.resolve("@changesets/cli/package.json", { paths: [cwd] }),
+    );
+  } catch {
+    return;
+  }
+
+  if (
+    typeof cliPackageJson.version === "string" &&
+    major(cliPackageJson.version) === 2
+  ) {
+    throw new Error(changesetsCliCompatibilityError);
+  }
+}
+
+function resolveChangesetsCli(cwd: string) {
+  return require.resolve("@changesets/cli/bin.js", {
+    paths: [cwd],
+  });
+}
+
+interface ExecOptions extends Omit<ActionsExecOptions, "env"> {
+  env?: Record<string, string | undefined>;
+}
+
+export function execChangesetsCli(args: string[], options?: ExecOptions) {
+  return exec(
+    "node",
+    [resolveChangesetsCli(options?.cwd ?? process.cwd()), ...args],
+    options as ActionsExecOptions,
+  );
+}
+
+export function getExecOutputChangesetsCli(
+  args: string[],
+  options?: ExecOptions,
+): Promise<ExecOutput> {
+  return getExecOutput(
+    "node",
+    [resolveChangesetsCli(options?.cwd ?? process.cwd()), ...args],
+    options as ActionsExecOptions,
+  );
+}
+
+export async function downloadArtifact(
+  tmpDir: string,
+  artifactId: number,
+  name: string,
+) {
+  if (!Number.isInteger(artifactId) || artifactId <= 0) {
+    throw new Error(
+      `Invalid ${JSON.stringify(name)} artifact id: ${artifactId}`,
+    );
+  }
+
+  const downloadPath = path.join(tmpDir, `${name}-${artifactId}-${Date.now()}`);
+  const result = await artifact.downloadArtifact(artifactId, {
+    path: downloadPath,
+  });
+
+  if (!result.downloadPath) {
+    throw new Error(
+      `${JSON.stringify(name)} artifact download did not return a path for artifact ${artifactId}`,
+    );
+  }
+
+  return result.downloadPath;
+}

src/version/index.ts

@@ -0,0 +1,53 @@
+import * as core from "@actions/core";
+import { GitHub } from "../github.ts";
+import { runVersion } from "../run.ts";
+import {
+  getOptionalInput,
+  getRequiredInput,
+  throwOnRemovedCommitModeInput,
+  validateChangesetsCliVersion,
+} from "../utils.ts";
+
+try {
+  await main();
+} catch (err) {
+  core.setFailed((err as Error).message);
+}
+
+async function main() {
+  const cwd = getOptionalInput("cwd") || process.cwd();
+  await validateChangesetsCliVersion(cwd);
+  throwOnRemovedCommitModeInput();
+
+  const githubToken = getRequiredInput("github-token");
+  const script = getOptionalInput("script");
+  const commitMessage = getRequiredInput("commit-message");
+  const prTitle = getRequiredInput("pr-title");
+  const prDraft = getOptionalInput("pr-draft");
+  const prBaseBranch = getOptionalInput("pr-base-branch");
+  const pushWithGitCli = core.getBooleanInput("push-with-git-cli");
+
+  // Validations
+  if (prDraft !== undefined && prDraft !== "always" && prDraft !== "create") {
+    throw new Error(`Invalid pr-draft input: ${prDraft}`);
+  }
+  const github = new GitHub({
+    cwd,
+    githubToken,
+    pushWithGitCli,
+  });
+
+  const { pullRequestNumber } = await runVersion({
+    script,
+    github,
+    cwd,
+    prTitle,
+    commitMessage,
+    // TODO: Use neutral message for PR description
+    hasPublishScript: true,
+    prDraft,
+    branch: prBaseBranch,
+  });
+
+  core.setOutput("pr-number", String(pullRequestNumber));
+}

tsconfig.json

@@ -1,63 +1,11 @@
 {
+  "extends": "@tsconfig/node24/tsconfig.json",
   "compilerOptions": {
-    /* Basic Options */
-    // "incremental": true,                   /* Enable incremental compilation */
-    "target": "esnext" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */,
-    "module": "commonjs" /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */,
-    // "lib": [],                             /* Specify library files to be included in the compilation. */
-    // "allowJs": true,                       /* Allow javascript files to be compiled. */
-    // "checkJs": true,                       /* Report errors in .js files. */
-    // "jsx": "preserve",                     /* Specify JSX code generation: 'preserve', 'react-native', or 'react'. */
-    // "declaration": true,                   /* Generates corresponding '.d.ts' file. */
-    // "declarationMap": true,                /* Generates a sourcemap for each corresponding '.d.ts' file. */
-    // "sourceMap": true,                     /* Generates corresponding '.map' file. */
-    // "outFile": "./",                       /* Concatenate and emit output to single file. */
-    // "outDir": "./",                        /* Redirect output structure to the directory. */
-    // "rootDir": "./",                       /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */
-    // "composite": true,                     /* Enable project compilation */
-    // "tsBuildInfoFile": "./",               /* Specify file to store incremental compilation information */
-    // "removeComments": true,                /* Do not emit comments to output. */
-    "noEmit": true /* Do not emit outputs. */,
-    // "importHelpers": true,                 /* Import emit helpers from 'tslib'. */
-    // "downlevelIteration": true,            /* Provide full support for iterables in 'for-of', spread, and destructuring when targeting 'ES5' or 'ES3'. */
-    "isolatedModules": true /* Transpile each file as a separate module (similar to 'ts.transpileModule'). */,
-
-    /* Strict Type-Checking Options */
-    "strict": true /* Enable all strict type-checking options. */,
-    // "noImplicitAny": true,                 /* Raise error on expressions and declarations with an implied 'any' type. */
-    // "strictNullChecks": true,              /* Enable strict null checks. */
-    // "strictFunctionTypes": true,           /* Enable strict checking of function types. */
-    // "strictBindCallApply": true,           /* Enable strict 'bind', 'call', and 'apply' methods on functions. */
-    // "strictPropertyInitialization": true,  /* Enable strict checking of property initialization in classes. */
-    // "noImplicitThis": true,                /* Raise error on 'this' expressions with an implied 'any' type. */
-    // "alwaysStrict": true,                  /* Parse in strict mode and emit "use strict" for each source file. */
-
-    /* Additional Checks */
-    // "noUnusedLocals": true,                /* Report errors on unused locals. */
-    // "noUnusedParameters": true,            /* Report errors on unused parameters. */
-    // "noImplicitReturns": true,             /* Report error when not all code paths in function return a value. */
-    // "noFallthroughCasesInSwitch": true,    /* Report errors for fallthrough cases in switch statement. */
-
-    /* Module Resolution Options */
-    // "moduleResolution": "node",            /* Specify module resolution strategy: 'node' (Node.js) or 'classic' (TypeScript pre-1.6). */
-    // "baseUrl": "./",                       /* Base directory to resolve non-absolute module names. */
-    // "paths": {},                           /* A series of entries which re-map imports to lookup locations relative to the 'baseUrl'. */
-    // "rootDirs": [],                        /* List of root folders whose combined content represents the structure of the project at runtime. */
-    // "typeRoots": [],                       /* List of folders to include type definitions from. */
-    // "types": [],                           /* Type declaration files to be included in compilation. */
-    // "allowSyntheticDefaultImports": true,  /* Allow default imports from modules with no default export. This does not affect code emit, just typechecking. */
-    "esModuleInterop": true /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */
-    // "preserveSymlinks": true,              /* Do not resolve the real path of symlinks. */
-    // "allowUmdGlobalAccess": true,          /* Allow accessing UMD globals from modules. */
-
-    /* Source Map Options */
-    // "sourceRoot": "",                      /* Specify the location where debugger should locate TypeScript files instead of source locations. */
-    // "mapRoot": "",                         /* Specify the location where debugger should locate map files instead of generated locations. */
-    // "inlineSourceMap": true,               /* Emit a single file with source maps instead of having a separate file. */
-    // "inlineSources": true,                 /* Emit the source alongside the sourcemaps within a single file; requires '--inlineSourceMap' or '--sourceMap' to be set. */
-
-    /* Experimental Options */
-    // "experimentalDecorators": true,        /* Enables experimental support for ES7 decorators. */
-    // "emitDecoratorMetadata": true,         /* Enables experimental support for emitting type metadata for decorators. */
+    "allowImportingTsExtensions": true,
+    "erasableSyntaxOnly": true,
+    "verbatimModuleSyntax": true,
+    "strict": true,
+    "noEmit": true,
+    "types": ["node"]
   }
 }

types/fixturez.d.ts

@@ -1,17 +0,0 @@
-type Opts = {
-  glob?: string | Array<string>;
-  root?: string;
-  cleanup?: boolean;
-};
-
-declare module "fixturez" {
-  export default function (
-    cwd: string,
-    opts?: Opts
-  ): {
-    find: (a: string) => string;
-    temp: () => string;
-    copy: (a: string) => string;
-    cleanup: () => any;
-  };
-}

version/README.md

@@ -0,0 +1,43 @@
+# changesets/action/version
+
+This action versions packages and creates or updates a pull request with the changes.
+
+## Requirements
+
+- Needs repo checked out and `@changesets/cli` installed
+- [Job permissions][job-permissions]:
+  - `contents: write`: to commit version changes
+  - `pull-requests: write`: to create pull request
+- [Workflow triggers][workflow-triggers]: _any_
+
+> [!NOTE]
+> In your repository settings, in `Actions > General`, also ensure the `Allow GitHub Actions to create and approve pull requests` option is enabled
+
+## Usage
+
+> [!TIP]
+> Check out [the docs](https://changesets.dev/guide/automating#how-do-i-run-the-version-and-publish-commands) to learn how to set up the version and publish workflow.
+
+## API
+
+<!-- api-start -->
+
+| Inputs              | Description                                                                                                                                                                                                                             |
+| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `github-token`      | The GitHub token to use for authentication. Defaults to the GitHub-provided token. To use a custom token, pass it explicitly to this input.                                                                                             |
+| `script`            | The command to use to version packages                                                                                                                                                                                                  |
+| `commit-message`    | The commit message. Default to `Version Packages`                                                                                                                                                                                       |
+| `pr-title`          | The pull request title. Default to `Version Packages`                                                                                                                                                                                   |
+| `pr-draft`          | Controls draft PR behavior. Use 'create' to create new version PRs as draft, or 'always' to also convert existing version PRs back to draft when updating them.                                                                         |
+| `pr-base-branch`    | Sets the base branch of the PR. Defaults to `github.ref_name`.                                                                                                                                                                          |
+| `push-with-git-cli` | Whether to use the Git CLI instead of the GitHub API to push release commits. Defaults to `false`. When using the GitHub API, commits are signed using GitHub's GPG key and attributed to the user or app that owns the `github-token`. |
+| `cwd`               | The working directory to execute Changesets in. Defaults to the root of the repository.                                                                                                                                                 |
+
+| Outputs     | Description                                         |
+| ----------- | --------------------------------------------------- |
+| `pr-number` | The pull request number that was created or updated |
+
+<!-- api-end -->
+
+[job-permissions]: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idpermissions
+[workflow-triggers]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows

version/action.yml

@@ -0,0 +1,45 @@
+name: Changesets - Version
+description: Version packages
+runs:
+  using: node24
+  main: ../dist/version.js
+inputs:
+  github-token:
+    description: >
+      The GitHub token to use for authentication. Defaults to the GitHub-provided token.
+      To use a custom token, pass it explicitly to this input.
+    required: false
+    default: ${{ github.token }}
+  script:
+    description: "The command to use to version packages"
+    required: false
+  commit-message:
+    description: "The commit message. Default to `Version Packages`"
+    required: false
+    default: "Version Packages"
+  pr-title:
+    description: "The pull request title. Default to `Version Packages`"
+    required: false
+    default: "Version Packages"
+  pr-draft:
+    description: "Controls draft PR behavior. Use 'create' to create new version PRs as draft, or 'always' to also convert existing version PRs back to draft when updating them."
+    required: false
+  pr-base-branch:
+    description: "Sets the base branch of the PR. Defaults to `github.ref_name`."
+    required: false
+  push-with-git-cli:
+    description: >
+      Whether to use the Git CLI instead of the GitHub API to push release commits.
+      Defaults to `false`. When using the GitHub API, commits are signed using GitHub's
+      GPG key and attributed to the user or app that owns the `github-token`.
+    required: false
+    default: false
+  cwd:
+    description: "The working directory to execute Changesets in. Defaults to the root of the repository."
+    required: false
+outputs:
+  pr-number:
+    description: The pull request number that was created or updated
+branding:
+  icon: package
+  color: blue