v1.4.5

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

CHANGELOG.md

@@ -1,5 +1,40 @@
 # @changesets/action
 
+## 1.4.5
+
+### Patch Changes
+
+- [#282](https://github.com/changesets/action/pull/282) [`eb19e25`](https://github.com/changesets/action/commit/eb19e25e7797cf33dc2de4caa071e85a8057a0f0) Thanks [@mark-omarov](https://github.com/mark-omarov)! - Updated a few dependencies to patch the security vulnerabilities that were reported for their older versions.
+
+## 1.4.4
+
+### Patch Changes
+
+- [#291](https://github.com/changesets/action/pull/291) [`db8a109`](https://github.com/changesets/action/commit/db8a1099bc0ba1dd6f46a5b9df4212e4f69e78c9) Thanks [@varl](https://github.com/varl)! - Wire up [`@octokit/plugin-throttling`](https://github.com/octokit/plugin-throttling.js) with all GitHub Octokit instances
+
+## 1.4.3
+
+### Patch Changes
+
+- [#289](https://github.com/changesets/action/pull/289) [`8b28186`](https://github.com/changesets/action/commit/8b2818674de86a7fc69aebb9ed6b486ee32eb96e) Thanks [@varl](https://github.com/varl)! - Use logging provided by `@actions/core`
+
+## 1.4.2
+
+### Patch Changes
+
+- [#286](https://github.com/changesets/action/pull/286) [`225a1e8`](https://github.com/changesets/action/commit/225a1e8cbcabb7b585174ba0ad806549db40d4cd) Thanks [@varl](https://github.com/varl)! - This patch implements the [`@octokit/plugin-throttling`](https://github.com/octokit/plugin-throttling.js) plugin and [wires
+  it up with the internal GitHub Octokit instance](https://github.com/actions/toolkit/tree/457303960f03375db6f033e214b9f90d79c3fe5c/packages/github#extending-the-octokit-instance).
+
+  This plugin is recommended by [the Octokit docs](://octokit.github.io/rest.js/v19#throttling) as it implements all the GitHub [best practices for integrators](https://docs.github.com/en/rest/guides/best-practices-for-integrators?apiVersion=2022-11-28).
+
+  This should help with `changesets/action` gitting spurious secondary rate limits and failing CI jobs, for which the only known workaround is to simply re-run the job.
+
+## 1.4.1
+
+### Patch Changes
+
+- [#123](https://github.com/changesets/action/pull/123) [`b78f480`](https://github.com/changesets/action/commit/b78f48099899f0a853c5d9cd3feb21a5440babbd) Thanks [@Andarist](https://github.com/Andarist)! - Updated `@actions/*` dependencies to avoid using deprecated features of the runner.
+
 ## 1.4.0
 
 ### Minor Changes

README.md

@@ -41,12 +41,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
-      - name: Setup Node.js 12.x
+      - name: Setup Node.js 16
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@v3
         with:
-          node-version: 12.x
+          node-version: 16
 
       - name: Install Dependencies
         run: yarn
@@ -77,12 +77,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
-      - name: Setup Node.js 12.x
+      - name: Setup Node.js 16.x
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@v3
         with:
-          node-version: 12.x
+          node-version: 16.x
 
       - name: Install Dependencies
         run: yarn
@@ -142,12 +142,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
-      - name: Setup Node.js 12.x
+      - name: Setup Node.js 16.x
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@v3
         with:
-          node-version: 12.x
+          node-version: 16.x
 
       - name: Install Dependencies
         run: yarn
@@ -186,12 +186,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
-      - name: Setup Node.js 12.x
+      - name: Setup Node.js 16.x
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@v3
         with:
-          node-version: 12.x
+          node-version: 16.x
 
       - name: Install Dependencies
         run: yarn

package.json

@@ -1,19 +1,29 @@
 {
   "name": "@changesets/action",
-  "version": "1.4.0",
+  "version": "1.4.5",
   "main": "dist/index.js",
   "license": "MIT",
   "devDependencies": {
     "@changesets/changelog-github": "^0.4.2",
     "@changesets/cli": "^2.20.0",
     "@changesets/write": "^0.1.6",
+    "@vercel/ncc": "^0.36.1",
     "fixturez": "^1.1.0",
-    "parcel": "^1.12.3",
     "prettier": "^2.0.5",
-    "typescript": "^3.5.3"
+    "typescript": "^5.0.4",
+    "@babel/core": "^7.13.10",
+    "@babel/preset-env": "^7.13.10",
+    "@babel/preset-typescript": "^7.13.0",
+    "@types/fs-extra": "^8.0.0",
+    "@types/jest": "^29.5.1",
+    "@types/node": "^12.7.1",
+    "@types/semver": "^6.0.2",
+    "babel-jest": "^29.5.0",
+    "husky": "^3.0.3",
+    "jest": "^29.5.0"
   },
   "scripts": {
-    "build": "parcel build ./src/index.ts --no-source-maps --target=node --bundle-node-modules",
+    "build": "ncc build src/index.ts -o dist --transpile-only --minify",
     "test": "jest",
     "test:watch": "yarn test --watch",
     "changeset": "changeset",
@@ -24,23 +34,14 @@
     "node": ">= 16"
   },
   "dependencies": {
-    "@actions/core": "^1.3.0",
+    "@actions/core": "^1.10.0",
-    "@actions/exec": "^1.1.0",
+    "@actions/exec": "^1.1.1",
-    "@actions/github": "^4.0.0",
+    "@actions/github": "^5.1.1",
-    "@babel/core": "^7.13.10",
-    "@babel/preset-env": "^7.13.10",
-    "@babel/preset-typescript": "^7.13.0",
     "@changesets/pre": "^1.0.9",
     "@changesets/read": "^0.5.3",
     "@manypkg/get-packages": "^1.1.3",
-    "@types/fs-extra": "^8.0.0",
+    "@octokit/plugin-throttling": "^5.2.1",
-    "@types/jest": "^24.0.18",
-    "@types/node": "^12.7.1",
-    "@types/semver": "^6.0.2",
-    "babel-jest": "^24.9.0",
     "fs-extra": "^8.1.0",
-    "husky": "^3.0.3",
-    "jest": "^24.9.0",
     "mdast-util-to-string": "^1.0.6",
     "remark-parse": "^7.0.1",
     "remark-stringify": "^7.0.3",
@@ -51,5 +52,10 @@
   "husky": {
     "hooks": {}
   },
-  "prettier": {}
+  "prettier": {},
+  "resolutions": {
+    "**/@octokit/core": "4.2.0",
+    "trim": "^0.0.3",
+    "y18n": "^4.0.1"
+  }
 }

src/__snapshots__/run.test.ts.snap

@@ -1,8 +1,8 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
 exports[`version creates simple PR 1`] = `
-Array [
+[
-  Object {
+  {
     "base": "some-branch",
     "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
 
@@ -34,8 +34,8 @@ Array [
 `;
 
 exports[`version does not include any release information if a message with simplified release info exceeds size limit 1`] = `
-Array [
+[
-  Object {
+  {
     "base": "some-branch",
     "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
 
@@ -52,8 +52,8 @@ Array [
 `;
 
 exports[`version does not include changelog entries if full message exceeds size limit 1`] = `
-Array [
+[
-  Object {
+  {
     "base": "some-branch",
     "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
 
@@ -74,8 +74,8 @@ Array [
 `;
 
 exports[`version doesn't include ignored package that got a dependency update in the PR body 1`] = `
-Array [
+[
-  Object {
+  {
     "base": "some-branch",
     "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
 
@@ -96,8 +96,8 @@ Array [
 `;
 
 exports[`version only includes bumped packages in the PR body 1`] = `
-Array [
+[
-  Object {
+  {
     "base": "some-branch",
     "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
 

src/__snapshots__/utils.test.ts.snap

@@ -1,18 +1,18 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
 exports[`it sorts the things right 1`] = `
-Array [
+[
-  Object {
+  {
     "highestLevel": 3,
     "name": "c",
     "private": false,
   },
-  Object {
+  {
     "highestLevel": 1,
     "name": "b",
     "private": false,
   },
-  Object {
+  {
     "highestLevel": 3,
     "name": "a",
     "private": true,

src/gitUtils.ts

@@ -1,5 +1,4 @@
-import { exec } from "@actions/exec";
+import { exec, getExecOutput } from "@actions/exec";
-import { execWithOutput } from "./utils";
 
 export const setupUser = async () => {
   await exec("git", [
@@ -35,7 +34,7 @@ export const pushTags = async () => {
 };
 
 export const switchToMaybeExistingBranch = async (branch: string) => {
-  let { stderr } = await execWithOutput("git", ["checkout", branch], {
+  let { stderr } = await getExecOutput("git", ["checkout", branch], {
     ignoreReturnCode: true,
   });
   let isCreatingBranch = !stderr
@@ -59,6 +58,6 @@ export const commitAll = async (message: string) => {
 };
 
 export const checkIfClean = async (): Promise<boolean> => {
-  const { stdout } = await execWithOutput("git", ["status", "--porcelain"]);
+  const { stdout } = await getExecOutput("git", ["status", "--porcelain"]);
   return !stdout.length;
 };

src/index.ts

@@ -16,18 +16,18 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
 
   const inputCwd = core.getInput("cwd");
   if (inputCwd) {
-    console.log("changing directory to the one given as the input");
+    core.info("changing directory to the one given as the input");
     process.chdir(inputCwd);
   }
 
   let setupGitUser = core.getBooleanInput("setupGitUser");
 
   if (setupGitUser) {
-    console.log("setting git user");
+    core.info("setting git user");
     await gitUtils.setupUser();
   }
 
-  console.log("setting GitHub credentials");
+  core.info("setting GitHub credentials");
   await fs.writeFile(
     `${process.env.HOME}/.netrc`,
     `machine github.com\nlogin github-actions[bot]\npassword ${githubToken}`
@@ -48,27 +48,27 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
 
   switch (true) {
     case !hasChangesets && !hasPublishScript:
-      console.log("No changesets found");
+      core.info("No changesets found");
       return;
     case !hasChangesets && hasPublishScript: {
-      console.log(
+      core.info(
         "No changesets found, attempting to publish any unpublished packages to npm"
       );
 
       let userNpmrcPath = `${process.env.HOME}/.npmrc`;
       if (fs.existsSync(userNpmrcPath)) {
-        console.log("Found existing user .npmrc file");
+        core.info("Found existing user .npmrc file");
         const userNpmrcContent = await fs.readFile(userNpmrcPath, "utf8");
         const authLine = userNpmrcContent.split("\n").find((line) => {
           // check based on https://github.com/npm/cli/blob/8f8f71e4dd5ee66b3b17888faad5a7bf6c657eed/test/lib/adduser.js#L103-L105
           return /^\s*\/\/registry\.npmjs\.org\/:[_-]authToken=/i.test(line);
         });
         if (authLine) {
-          console.log(
+          core.info(
             "Found existing auth token for the npm registry in the user .npmrc file"
           );
         } else {
-          console.log(
+          core.info(
             "Didn't find existing auth token for the npm registry in the user .npmrc file, creating one"
           );
           fs.appendFileSync(
@@ -77,7 +77,7 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
           );
         }
       } else {
-        console.log("No user .npmrc file found, creating one");
+        core.info("No user .npmrc file found, creating one");
         fs.writeFileSync(
           userNpmrcPath,
           `//registry.npmjs.org/:_authToken=${process.env.NPM_TOKEN}\n`
@@ -100,7 +100,7 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
       return;
     }
     case hasChangesets && !hasNonEmptyChangesets:
-      console.log("All changesets are empty; not creating PR");
+      core.info("All changesets are empty; not creating PR");
       return;
     case hasChangesets:
       const { pullRequestNumber } = await runVersion({
@@ -116,6 +116,6 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
       return;
   }
 })().catch((err) => {
-  console.error(err);
+  core.error(err);
   core.setFailed(err.message);
 });

src/readChangesetState.ts

@@ -11,17 +11,19 @@ export default async function readChangesetState(
   cwd: string = process.cwd()
 ): Promise<ChangesetState> {
   let preState = await readPreState(cwd);
-  let isInPreMode = preState !== undefined && preState.mode === "pre";
-
   let changesets = await readChangesets(cwd);
 
-  if (isInPreMode) {
+  if (preState !== undefined && preState.mode === "pre") {
     let changesetsToFilter = new Set(preState.changesets);
-    changesets = changesets.filter((x) => !changesetsToFilter.has(x.id));
+
+    return {
+      preState,
+      changesets: changesets.filter((x) => !changesetsToFilter.has(x.id)),
+    };
   }
 
   return {
-    preState: isInPreMode ? preState : undefined,
+    preState: undefined,
     changesets,
   };
 }

src/run.test.ts

@@ -1,5 +1,6 @@
 import fixturez from "fixturez";
 import * as github from "@actions/github";
+import * as githubUtils from "@actions/github/lib/utils";
 import fs from "fs-extra";
 import path from "path";
 import writeChangeset from "@changesets/write";
@@ -15,7 +16,19 @@ jest.mock("@actions/github", () => ({
     ref: "refs/heads/some-branch",
     sha: "xeac7",
   },
-  getOctokit: jest.fn(),
+}));
+jest.mock("@actions/github/lib/utils", () => ({
+    GitHub: {
+        plugin: () => {
+            // function necessary to be used as constructor
+            return function() {
+                return {
+                    rest: mockedGithubMethods,
+                }
+            }
+        },
+    },
+    getOctokitOptions: jest.fn(),
 }));
 jest.mock("./gitUtils");
 
@@ -30,7 +43,6 @@ let mockedGithubMethods = {
     createRelease: jest.fn(),
   },
 };
-(github.getOctokit as any).mockImplementation(() => mockedGithubMethods);
 
 let f = fixturez(__dirname);
 

src/run.ts

@@ -1,5 +1,7 @@
-import { exec } from "@actions/exec";
+import { exec, getExecOutput } from "@actions/exec";
+import { GitHub, getOctokitOptions } from "@actions/github/lib/utils";
 import * as github from "@actions/github";
+import * as core from "@actions/core";
 import fs from "fs-extra";
 import { getPackages, Package } from "@manypkg/get-packages";
 import path from "path";
@@ -7,7 +9,6 @@ import * as semver from "semver";
 import { PreState } from "@changesets/types";
 import {
   getChangelogEntry,
-  execWithOutput,
   getChangedPackages,
   sortTheThings,
   getVersionsByDirectory,
@@ -15,6 +16,7 @@ import {
 import * as gitUtils from "./gitUtils";
 import readChangesetState from "./readChangesetState";
 import resolveFrom from "resolve-from";
+import { throttling } from "@octokit/plugin-throttling";
 
 // GitHub Issues/PRs messages have a max size limit on the
 // message body payload.
@@ -22,8 +24,42 @@ import resolveFrom from "resolve-from";
 // To avoid that, we ensure to cap the message to 60k chars.
 const MAX_CHARACTERS_PER_MESSAGE = 60000;
 
+const setupOctokit = (githubToken: string) => {
+  return new (GitHub.plugin(throttling))(
+    getOctokitOptions(githubToken, {
+      throttle: {
+        onRateLimit: (retryAfter, options: any, octokit, retryCount) => {
+          core.warning(
+            `Request quota exhausted for request ${options.method} ${options.url}`
+          );
+
+          if (retryCount <= 2) {
+            core.info(`Retrying after ${retryAfter} seconds!`);
+            return true;
+          }
+        },
+        onSecondaryRateLimit: (
+          retryAfter,
+          options: any,
+          octokit,
+          retryCount
+        ) => {
+          core.warning(
+            `SecondaryRateLimit detected for request ${options.method} ${options.url}`
+          );
+
+          if (retryCount <= 2) {
+            core.info(`Retrying after ${retryAfter} seconds!`);
+            return true;
+          }
+        },
+      },
+    })
+  );
+};
+
 const createRelease = async (
-  octokit: ReturnType<typeof github.getOctokit>,
+  octokit: ReturnType<typeof setupOctokit>,
   { pkg, tagName }: { pkg: Package; tagName: string }
 ) => {
   try {
@@ -40,16 +76,21 @@ const createRelease = async (
       );
     }
 
-    await octokit.repos.createRelease({
+    await octokit.rest.repos.createRelease({
       name: tagName,
       tag_name: tagName,
       body: changelogEntry.content,
       prerelease: pkg.packageJson.version.includes("-"),
       ...github.context.repo,
     });
-  } catch (err: any) {
+  } catch (err) {
     // if we can't find a changelog, the user has probably disabled changelogs
-    if (err.code !== "ENOENT") {
+    if (
+      err &&
+      typeof err === "object" &&
+      "code" in err &&
+      err.code !== "ENOENT"
+    ) {
       throw err;
     }
   }
@@ -79,10 +120,11 @@ export async function runPublish({
   createGithubReleases,
   cwd = process.cwd(),
 }: PublishOptions): Promise<PublishResult> {
-  let octokit = github.getOctokit(githubToken);
+  const octokit = setupOctokit(githubToken);
+
   let [publishCommand, ...publishArgs] = script.split(/\s+/);
 
-  let changesetPublishOutput = await execWithOutput(
+  let changesetPublishOutput = await getExecOutput(
     publishCommand,
     publishArgs,
     { cwd }
@@ -165,8 +207,13 @@ export async function runPublish({
 const requireChangesetsCliPkgJson = (cwd: string) => {
   try {
     return require(resolveFrom(cwd, "@changesets/cli/package.json"));
-  } catch (err: any) {
+  } catch (err) {
-    if (err && err.code === "MODULE_NOT_FOUND") {
+    if (
+      err &&
+      typeof err === "object" &&
+      "code" in err &&
+      err.code === "MODULE_NOT_FOUND"
+    ) {
       throw new Error(
         `Have you forgotten to install \`@changesets/cli\` in "${cwd}"?`
       );
@@ -267,10 +314,12 @@ export async function runVersion({
   hasPublishScript = false,
   prBodyMaxCharacters = MAX_CHARACTERS_PER_MESSAGE,
 }: VersionOptions): Promise<RunVersionResult> {
+  const octokit = setupOctokit(githubToken);
+
   let repo = `${github.context.repo.owner}/${github.context.repo.repo}`;
   let branch = github.context.ref.replace("refs/heads/", "");
   let versionBranch = `changeset-release/${branch}`;
-  let octokit = github.getOctokit(githubToken);
+
   let { preState } = await readChangesetState(cwd);
 
   await gitUtils.switchToMaybeExistingBranch(versionBranch);
@@ -292,7 +341,7 @@ export async function runVersion({
   }
 
   let searchQuery = `repo:${repo}+state:open+head:${versionBranch}+base:${branch}+is:pull-request`;
-  let searchResultPromise = octokit.search.issuesAndPullRequests({
+  let searchResultPromise = octokit.rest.search.issuesAndPullRequests({
     q: searchQuery,
   });
   let changedPackages = await getChangedPackages(cwd, versionsByDirectory);
@@ -326,7 +375,7 @@ export async function runVersion({
   await gitUtils.push(versionBranch, { force: true });
 
   let searchResult = await searchResultPromise;
-  console.log(JSON.stringify(searchResult.data, null, 2));
+  core.info(JSON.stringify(searchResult.data, null, 2));
 
   const changedPackagesInfo = (await changedPackagesInfoPromises)
     .filter((x) => x)
@@ -341,8 +390,8 @@ export async function runVersion({
   });
 
   if (searchResult.data.items.length === 0) {
-    console.log("creating pull request");
+    core.info("creating pull request");
-    const { data: newPullRequest } = await octokit.pulls.create({
+    const { data: newPullRequest } = await octokit.rest.pulls.create({
       base: branch,
       head: versionBranch,
       title: finalPrTitle,
@@ -356,8 +405,8 @@ export async function runVersion({
   } else {
     const [pullRequest] = searchResult.data.items;
 
-    console.log(`updating found pull request #${pullRequest.number}`);
+    core.info(`updating found pull request #${pullRequest.number}`);
-    await octokit.pulls.update({
+    await octokit.rest.pulls.update({
       pull_number: pullRequest.number,
       title: finalPrTitle,
       body: prBody,

src/utils.ts

@@ -3,7 +3,6 @@ import remarkParse from "remark-parse";
 import remarkStringify from "remark-stringify";
 // @ts-ignore
 import mdastToString from "mdast-util-to-string";
-import { exec } from "@actions/exec";
 import { getPackages, Package } from "@manypkg/get-packages";
 
 export const BumpLevels = {
@@ -87,32 +86,6 @@ export function getChangelogEntry(changelog: string, version: string) {
   };
 }
 
-export async function execWithOutput(
-  command: string,
-  args?: string[],
-  options?: { ignoreReturnCode?: boolean; cwd?: string }
-) {
-  let myOutput = "";
-  let myError = "";
-
-  return {
-    code: await exec(command, args, {
-      listeners: {
-        stdout: (data: Buffer) => {
-          myOutput += data.toString();
-        },
-        stderr: (data: Buffer) => {
-          myError += data.toString();
-        },
-      },
-
-      ...options,
-    }),
-    stdout: myOutput,
-    stderr: myError,
-  };
-}
-
 export function sortTheThings(
   a: { private: boolean; highestLevel: number },
   b: { private: boolean; highestLevel: number }