v2.1.2

Version Packages (#726 )
Co-authored-by: changesets-org-version-bot[bot] <288406890+changesets-org-version-bot[bot]@users.noreply.github.com>
2026-10-26 16:39:56 +08:00 · 2026-09-07 11:58:07 +00:00 · 2026-09-07 11:50:58 +00:00 · 2026-09-07 11:45:47 +00:00 · 2026-09-04 18:07:20 +00:00 · 2026-09-01 06:34:13 +00:00
62 changed files with 3377 additions and 2572 deletions
@@ -1,13 +1,14 @@
 {
-  "$schema": "https://unpkg.com/@changesets/config@1.6.2/schema.json",
-  "changelog": [
-    "@changesets/changelog-github",
-    { "repo": "changesets/action" }
-  ],
+  "$schema": "https://unpkg.com/@changesets/config@4.0.0-next.6/schema.json",
+  "changelog": "@changesets/changelog-github",
  "commit": false,
  "linked": [],
  "access": "restricted",
  "baseBranch": "main",
  "updateInternalDependencies": "patch",
-  "ignore": []
+  "ignore": [],
+  "privatePackages": {
+    "version": true,
+    "tag": true
+  }
 }
@@ -1,5 +0,0 @@
---
-"@changesets/action": minor
---
-
-Add new `/select-mode`, `/version`, and `/publish` sub-actions to better control version and publish steps
@@ -1,5 +0,0 @@
---
-"@changesets/action": major
---
-
-Removed compatibility support for old Changesets v1.
@@ -1,5 +0,0 @@
---
-"@changesets/action": major
---
-
-Remove `cwd` option for `changesets/action`. Use the step `working-directory` option instead to change the directory.
@@ -1,8 +0,0 @@
-{
-  "mode": "pre",
-  "tag": "next",
-  "initialVersions": {
-    "@changesets/action": "1.9.0"
-  },
-  "changesets": ["eight-clocks-pull", "eighty-doors-swim", "lemon-turtles-itch"]
-}
@@ -1,4 +1,4 @@
-/.github/workflows/** @Andarist @bluwy @emmatown
+/.github/** @Andarist @bluwy @emmatown
 /action.yml @Andarist @bluwy @emmatown
 /scripts/bump.ts @Andarist @bluwy @emmatown
 /scripts/release.ts @Andarist @bluwy @emmatown
@@ -10,6 +10,11 @@ inputs:
 runs:
  using: composite
  steps:
+    - name: Check out repo
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      with:
+        persist-credentials: false
+
    - name: Set up pnpm
      uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6.0.5

@@ -0,0 +1,44 @@
+name: Setup bot auth
+description: Create a GitHub App token and configure matching git identity
+
+inputs:
+  client-id:
+    description: GitHub App client ID
+    required: true
+  private-key:
+    description: GitHub App private key
+    required: true
+  permission-contents:
+    description: Contents permission for the GitHub App token
+    required: false
+    default: write
+  permission-pull-requests:
+    description: Pull requests permission for the GitHub App token
+    required: false
+
+outputs:
+  token:
+    description: GitHub App installation access token
+    value: ${{ steps.app-token.outputs.token }}
+
+runs:
+  using: composite
+  steps:
+    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      id: app-token
+      with:
+        client-id: ${{ inputs.client-id }}
+        private-key: ${{ inputs.private-key }}
+        permission-contents: ${{ inputs.permission-contents }}
+        permission-pull-requests: ${{ inputs.permission-pull-requests }}
+
+    - name: Setup Git user
+      shell: bash
+      run: |
+        app_user="$APP_SLUG[bot]"
+        app_id="$(gh api "/users/$app_user" --jq .id)"
+        git config user.name "$app_user"
+        git config user.email "$app_id+$app_user@users.noreply.github.com"
+      env:
+        APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
+        GH_TOKEN: ${{ steps.app-token.outputs.token }}
@@ -27,12 +27,12 @@ jobs:
      security-events: write # allow writing security events
    steps:
      - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
        with:
          persona: pedantic
          annotations: true
@@ -43,12 +43,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
-      - name: Check out repo
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - uses: ./.github/actions/ci-setup
+      - uses: $/.github/actions/ci-setup

      - name: Test
        run: pnpm test
@@ -58,12 +53,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
-      - name: Check out repo
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - uses: ./.github/actions/ci-setup
+      - uses: $/.github/actions/ci-setup

      - name: Typecheck
        run: pnpm typecheck
@@ -73,12 +63,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
-      - name: Check out repo
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - uses: ./.github/actions/ci-setup
+      - uses: $/.github/actions/ci-setup

      - name: Format
        run: pnpm format
@@ -15,30 +15,45 @@ concurrency:
 permissions: {} # each job should define its own permission explicitly

 jobs:
-  version:
-    name: Version
+  select-mode:
+    name: Select mode
    runs-on: ubuntu-latest
-    environment: version
    timeout-minutes: 20
    outputs:
-      hasChangesets: ${{ steps.changesets.outputs.hasChangesets }}
+      mode: ${{ steps.select-mode.outputs.mode }}
    permissions:
      contents: read # to check out repo (actions/checkout)
    steps:
-      - name: Check out repo
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - uses: ./.github/actions/ci-setup
+      - uses: $/.github/actions/ci-setup
        with:
          skip-cache: true # avoid cache poisoning attacks

      - name: Build
        run: pnpm build

-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        id: app-token
+      - name: Select mode
+        id: select-mode
+        uses: ./select-mode
+
+  version:
+    name: Version
+    if: needs.select-mode.outputs.mode == 'version'
+    needs: select-mode
+    runs-on: ubuntu-latest
+    environment: version
+    timeout-minutes: 20
+    permissions:
+      contents: read # to check out repo (actions/checkout)
+    steps:
+      - uses: $/.github/actions/ci-setup
+        with:
+          skip-cache: true # avoid cache poisoning attacks
+
+      - name: Build
+        run: pnpm build
+
+      - uses: $/.github/actions/setup-bot-auth
+        id: bot-auth
        with:
          client-id: ${{ vars.APP_CLIENT_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
@@ -47,42 +62,37 @@ jobs:

      - name: Create or update release pull request
        id: changesets
-        uses: ./
+        uses: ./version
        with:
-          github-token: ${{ steps.app-token.outputs.token }}
-          version: pnpm bump
+          github-token: ${{ steps.bot-auth.outputs.token }}
+          script: pnpm bump

  publish:
    name: Publish
-    if: needs.version.outputs.hasChangesets == 'false'
-    needs: version
+    if: needs.select-mode.outputs.mode == 'publish'
+    needs: select-mode
    runs-on: ubuntu-latest
    environment: marketplace
    timeout-minutes: 20
    permissions:
      contents: write # to create release and have it authored by github-actions (changesets/action)
    steps:
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        id: app-token
-        with:
-          client-id: ${{ vars.APP_CLIENT_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-          permission-contents: write # to bypass branch and tag protection rules (release.ts)
-
-      - name: Check out repo
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - uses: ./.github/actions/ci-setup
+      - uses: $/.github/actions/ci-setup
        with:
          skip-cache: true # avoid cache poisoning attacks

      - name: Build
        run: pnpm build

-      - name: Publish to marketplace
-        uses: ./
+      - uses: $/.github/actions/setup-bot-auth
+        id: bot-auth
        with:
-          github-token: ${{ steps.app-token.outputs.token }}
-          publish: pnpm release
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write # to bypass branch and tag protection rules (release.ts)
+
+      - name: Publish to marketplace
+        uses: ./publish
+        with:
+          github-token: ${{ steps.bot-auth.outputs.token }}
+          script: pnpm release
@@ -122,19 +122,7 @@ jobs:
      pull-requests: write # to comment on the pull request with the release result (changesets/action)

    steps:
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        id: app-token
-        with:
-          client-id: ${{ vars.APP_CLIENT_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-          permission-contents: write # to push the release snapshot branch (release-pr.ts)
-
-      - name: Check out repo
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - uses: ./.github/actions/ci-setup
+      - uses: $/.github/actions/ci-setup
        with:
          skip-cache: true # avoid cache poisoning attacks

@@ -173,15 +161,17 @@ jobs:
      - name: Build
        run: pnpm build

-      - name: Setup Git user
-        run: |
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+      - uses: $/.github/actions/setup-bot-auth
+        id: bot-auth
+        with:
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write # to push the release snapshot branch (release-pr.ts)

      - name: Release snapshot version
        run: pnpm release:pr
        env:
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+          GITHUB_TOKEN: ${{ steps.bot-auth.outputs.token }}

      - name: Add success reaction
        run: gh api "/repos/$GH_REPO/issues/comments/$COMMENT_ID/reactions" -f content='rocket'
@@ -2,5 +2,6 @@ node_modules
 .parcel-cache
 .cache
 *.log
+.env

 dist/
@@ -1,5 +1,171 @@
 # @changesets/action

+## 2.1.2
+
+### Patch Changes
+
+- [#735](https://github.com/changesets/action/pull/735) [`8833883`](https://github.com/changesets/action/commit/88338839e35c3e0fa61f3c9c3f27e7572cd5f2cf) Thanks [@bluwy](https://github.com/bluwy)! - Handle error when pushing git tags with the git CLI
+
+- [#724](https://github.com/changesets/action/pull/724) [`36f529f`](https://github.com/changesets/action/commit/36f529f13ab58bbcf6331035cb950385586e8a89) Thanks [@bluwy](https://github.com/bluwy)! - Improve log messages
+
+- [#724](https://github.com/changesets/action/pull/724) [`36f529f`](https://github.com/changesets/action/commit/36f529f13ab58bbcf6331035cb950385586e8a89) Thanks [@bluwy](https://github.com/bluwy)! - Fix root action double error logs
+
+- [#729](https://github.com/changesets/action/pull/729) [`ca85897`](https://github.com/changesets/action/commit/ca8589735af2ff6977a0f6474537d550040530d8) Thanks [@bluwy](https://github.com/bluwy)! - Always switch and reset branch when generating version commits, similar to if `push-with-git-cli` is enabled
+
+## 2.1.1
+
+### Patch Changes
+
+- [#721](https://github.com/changesets/action/pull/721) [`da1ea29`](https://github.com/changesets/action/commit/da1ea291ef93203a08fad360eac36f4858dd0514) Thanks [@KEBABSELLER6](https://github.com/KEBABSELLER6)! - Fixed typo in renamed inputs from v1 to v2
+
+## 2.1.0
+
+### Minor Changes
+
+- [#718](https://github.com/changesets/action/pull/718) [`3b7c71c`](https://github.com/changesets/action/commit/3b7c71c440e75fca5d335f779290425fc1117fe8) Thanks [@bluwy](https://github.com/bluwy)! - Add a `cwd` input to the root action, `/select-mode`, `/version`, `/pack`, and `/publish` sub-actions to set the current working directory to execute Changesets in. This input existed in v1 but was incorrectly removed.
+
+### Patch Changes
+
+- [#716](https://github.com/changesets/action/pull/716) [`6f58ba3`](https://github.com/changesets/action/commit/6f58ba35801ec075a1c87569277591f8ef1a3029) Thanks [@bluwy](https://github.com/bluwy)! - Update `pr-status` message to link to the new faq page
+
+## 2.0.0
+
+### Major Changes
+
+- [#692](https://github.com/changesets/action/pull/692) [`cb3f011`](https://github.com/changesets/action/commit/cb3f0110d7423cd340b1c5d63584c0ea6ee63959) Thanks [@Andarist](https://github.com/Andarist)! - Release commits and tags are now pushed using the GitHub API by default.
+
+  Replace the `commit-mode` input with the boolean `push-with-git-cli` input. Set `push-with-git-cli: true` to continue using the Git CLI.
+
+  Regardless of the push mode, custom GitHub tokens must be passed explicitly through the `github-token` input. The `GITHUB_TOKEN` environment variable and credentials configured by `actions/checkout` or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, `github-token` takes precedence over those repository credentials.
+
+- [#680](https://github.com/changesets/action/pull/680) [`ca57073`](https://github.com/changesets/action/commit/ca57073900dc678254406a052a03c0c8824e319d) Thanks [@bluwy](https://github.com/bluwy)! - Add a new `push-git-tags` option that complements `create-github-releases` to control specifically if git tags should be created but not GitHub releases.
+
+  If `create-github-releases` was previously set to `false`, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set `push-git-tags` to `false` explicitly.
+
+- [#657](https://github.com/changesets/action/pull/657) [`4f718b5`](https://github.com/changesets/action/commit/4f718b5921490b1efeb015a81abb6a4633892851) Thanks [@Andarist](https://github.com/Andarist)! - Removed compatibility support for old Changesets v1.
+
+- [#681](https://github.com/changesets/action/pull/681) [`7359107`](https://github.com/changesets/action/commit/73591071e61c7f61cf322dd7a6341dc29a8e1d4e) Thanks [@bluwy](https://github.com/bluwy)! - Rename the root action inputs and outputs to better match the sub-actions' conventions.
+
+  Inputs:
+
+  - `version` -> `version-script`
+  - `publish` -> `publish-script`
+  - `commit` -> `commit-message`
+  - `title` -> `pr-title`
+  - `branch` -> `pr-base-branch`
+
+  Outputs:
+
+  - `pull-request-number` -> `pr-number`
+
+- [#674](https://github.com/changesets/action/pull/674) [`164652b`](https://github.com/changesets/action/commit/164652bdd60525670d95291addb8c6f92833ac60) Thanks [@bluwy](https://github.com/bluwy)! - Remove support for passing custom GitHub token through the GITHUB_TOKEN environment variable. It should be passed to the `github-token` input instead.
+
+- [#659](https://github.com/changesets/action/pull/659) [`5649ff4`](https://github.com/changesets/action/commit/5649ff41b8eb1b7a281011e45df781c6d4628fd0) Thanks [@bluwy](https://github.com/bluwy)! - Remove `cwd` option for `changesets/action`. Use the step `working-directory` option instead to change the directory.
+
+- [#673](https://github.com/changesets/action/pull/673) [`823cf74`](https://github.com/changesets/action/commit/823cf741ca57c5e22652123d3a847dfafcd77ca0) Thanks [@bluwy](https://github.com/bluwy)! - Update to Changesets v3 packages
+
+- [#695](https://github.com/changesets/action/pull/695) [`469993c`](https://github.com/changesets/action/commit/469993ce5783c6a38e72541d4ba0d25588702b9a) Thanks [@bluwy](https://github.com/bluwy)! - Removed `.npmrc` handling when the `NPM_TOKEN` environment variable is set.
+
+  Authentication should be handled via Trusted Publishing instead. If a token is still needed, use `actions/setup-node` to set it up instead via the `registry-url` option. Check out the updated action README for more information of setting up npm authentication in GitHub Actions.
+
+- [#668](https://github.com/changesets/action/pull/668) [`0eae789`](https://github.com/changesets/action/commit/0eae789230defbc4ad287e9b476aba7e842e34e0) Thanks [@bluwy](https://github.com/bluwy)! - Rename the input and output names to kebab-case instead of camelCase to match the official GitHub actions pattern
+
+### Minor Changes
+
+- [#656](https://github.com/changesets/action/pull/656) [`a12d90d`](https://github.com/changesets/action/commit/a12d90de8394e63c952622b2fd3f98c8729c48b0) Thanks [@bluwy](https://github.com/bluwy)! - Add new `/select-mode`, `/version`, and `/publish` sub-actions to better control version and publish steps
+
+- [#678](https://github.com/changesets/action/pull/678) [`f71ae04`](https://github.com/changesets/action/commit/f71ae043ed5deb17952900091e009a60edef9507) Thanks [@Andarist](https://github.com/Andarist)! - Published packages detection done through stdout parsing was replaced with one based on the shared output file using `CHANGESETS_OUTPUT` environment variable. When using custom scripts this environment variable should always be passed down to the Changesets CLI invocations.
+
+### Patch Changes
+
+- [#699](https://github.com/changesets/action/pull/699) [`5b307d3`](https://github.com/changesets/action/commit/5b307d3df25daf51c41dff70d2f66df1579ae9fa) Thanks [@Andarist](https://github.com/Andarist)! - Validate that projects use Changesets CLI v3 and direct Changesets CLI v2 users to `changesets/action@v1`.
+
+- [#697](https://github.com/changesets/action/pull/697) [`84d78c6`](https://github.com/changesets/action/commit/84d78c68f98f20e24dfff22b22193e7b4f326ad9) Thanks [@Andarist](https://github.com/Andarist)! - Allow custom publish scripts to complete without a Changesets output file, warning that GitHub releases and git tags cannot be created when that file is missing.
+
+- [#670](https://github.com/changesets/action/pull/670) [`5a8b9b7`](https://github.com/changesets/action/commit/5a8b9b721bf683e3bf9bd72ea92a685dc024147b) Thanks [@Andarist](https://github.com/Andarist)! - Authenticate git CLI pushes with the configured GitHub token using Git extra headers instead of writing to a global `.netrc` file.
+
+- [#670](https://github.com/changesets/action/pull/670) [`5a8b9b7`](https://github.com/changesets/action/commit/5a8b9b721bf683e3bf9bd72ea92a685dc024147b) Thanks [@Andarist](https://github.com/Andarist)! - Derive the Git server URL from the GitHub Actions context when configuring git CLI authentication to support GitHub Enterprise Server setups.
+
+- [#688](https://github.com/changesets/action/pull/688) [`219ea82`](https://github.com/changesets/action/commit/219ea82e52caaff2a10a5e34d3455093cf958238) Thanks [@Andarist](https://github.com/Andarist)! - Remove the `setup-git-user` input. Complete custom Git identities are now preserved automatically, while `github-actions[bot]` is configured as a fallback before creating local release commits or tags.
+
+## 2.0.0-next.5
+
+### Patch Changes
+
+- [#711](https://github.com/changesets/action/pull/711) [`5fa6767`](https://github.com/changesets/action/commit/5fa67671df41b7a8a9d8123e8e446b1a8ad423db) Thanks [@Andarist](https://github.com/Andarist)! - Fix support for prerelease exits using the new `.changeset/pre` layout.
+
+## 2.0.0-next.4
+
+### Major Changes
+
+- [#692](https://github.com/changesets/action/pull/692) [`cb3f011`](https://github.com/changesets/action/commit/cb3f0110d7423cd340b1c5d63584c0ea6ee63959) Thanks [@Andarist](https://github.com/Andarist)! - Release commits and tags are now pushed using the GitHub API by default.
+
+  Replace the `commit-mode` input with the boolean `push-with-git-cli` input. Set `push-with-git-cli: true` to continue using the Git CLI.
+
+  Regardless of the push mode, custom GitHub tokens must be passed explicitly through the `github-token` input. The `GITHUB_TOKEN` environment variable and credentials configured by `actions/checkout` or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, `github-token` takes precedence over those repository credentials.
+
+- [#695](https://github.com/changesets/action/pull/695) [`469993c`](https://github.com/changesets/action/commit/469993ce5783c6a38e72541d4ba0d25588702b9a) Thanks [@bluwy](https://github.com/bluwy)! - Removed `.npmrc` handling when the `NPM_TOKEN` environment variable is set.
+
+  Authentication should be handled via Trusted Publishing instead. If a token is still needed, use `actions/setup-node` to set it up instead via the `registry-url` option. Check out the updated action README for more information of setting up npm authentication in GitHub Actions.
+
+### Patch Changes
+
+- [#699](https://github.com/changesets/action/pull/699) [`5b307d3`](https://github.com/changesets/action/commit/5b307d3df25daf51c41dff70d2f66df1579ae9fa) Thanks [@Andarist](https://github.com/Andarist)! - Validate that projects use Changesets CLI v3 and direct Changesets CLI v2 users to `changesets/action@v1`.
+
+- [#697](https://github.com/changesets/action/pull/697) [`84d78c6`](https://github.com/changesets/action/commit/84d78c68f98f20e24dfff22b22193e7b4f326ad9) Thanks [@Andarist](https://github.com/Andarist)! - Allow custom publish scripts to complete without a Changesets output file, warning that GitHub releases and git tags cannot be created when that file is missing.
+
+- [#705](https://github.com/changesets/action/pull/705) [`77be81b`](https://github.com/changesets/action/commit/77be81bcb9d2d1007c53c4f98bffe51da428d6a5) Thanks [@Andarist](https://github.com/Andarist)! - Fixed a regression making it impossible to sync new versions of versioning pull requests with base branch updates when using GitHub API pushes.
+
+- [#688](https://github.com/changesets/action/pull/688) [`219ea82`](https://github.com/changesets/action/commit/219ea82e52caaff2a10a5e34d3455093cf958238) Thanks [@Andarist](https://github.com/Andarist)! - Remove the `setup-git-user` input. Complete custom Git identities are now preserved automatically, while `github-actions[bot]` is configured as a fallback before creating local release commits or tags.
+
+## 2.0.0-next.3
+
+### Major Changes
+
+- [#680](https://github.com/changesets/action/pull/680) [`ca57073`](https://github.com/changesets/action/commit/ca57073900dc678254406a052a03c0c8824e319d) Thanks [@bluwy](https://github.com/bluwy)! - Add a new `push-git-tags` option that complements `create-github-releases` to control specifically if git tags should be created but not GitHub releases.
+
+  If `create-github-releases` was previously set to `false`, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set `push-git-tags` to `false` explicitly.
+
+- [#681](https://github.com/changesets/action/pull/681) [`7359107`](https://github.com/changesets/action/commit/73591071e61c7f61cf322dd7a6341dc29a8e1d4e) Thanks [@bluwy](https://github.com/bluwy)! - Rename the root action inputs and outputs to better match the sub-actions' conventions.
+
+  Inputs:
+  - `version` -> `version-script`
+  - `publish` -> `publish-script`
+  - `commit` -> `commit-message`
+  - `title` -> `pr-title`
+  - `branch` -> `pr-base-branch`
+
+  Outputs:
+  - `pull-request-number` -> `pr-number`
+
+- [#674](https://github.com/changesets/action/pull/674) [`164652b`](https://github.com/changesets/action/commit/164652bdd60525670d95291addb8c6f92833ac60) Thanks [@bluwy](https://github.com/bluwy)! - Remove support for passing custom GitHub token through the GITHUB_TOKEN environment variable. It should be passed to the `github-token` input instead.
+
+- [#673](https://github.com/changesets/action/pull/673) [`823cf74`](https://github.com/changesets/action/commit/823cf741ca57c5e22652123d3a847dfafcd77ca0) Thanks [@bluwy](https://github.com/bluwy)! - Update to Changesets v3 packages
+
+- [#668](https://github.com/changesets/action/pull/668) [`0eae789`](https://github.com/changesets/action/commit/0eae789230defbc4ad287e9b476aba7e842e34e0) Thanks [@bluwy](https://github.com/bluwy)! - Rename the input and output names to kebab-case instead of camelCase to match the official GitHub actions pattern
+
+### Minor Changes
+
+- [#678](https://github.com/changesets/action/pull/678) [`f71ae04`](https://github.com/changesets/action/commit/f71ae043ed5deb17952900091e009a60edef9507) Thanks [@Andarist](https://github.com/Andarist)! - Published packages detection done through stdout parsing was replaced with one based on the shared output file using `CHANGESETS_OUTPUT` environment variable. When using custom scripts this environment variable should always be passed down to the Changesets CLI invocations.
+
+## 2.0.0-next.2
+
+### Patch Changes
+
+- [#670](https://github.com/changesets/action/pull/670) [`5a8b9b7`](https://github.com/changesets/action/commit/5a8b9b721bf683e3bf9bd72ea92a685dc024147b) Thanks [@Andarist](https://github.com/Andarist)! - Authenticate git CLI pushes with the configured GitHub token using Git extra headers instead of writing to a global `.netrc` file.
+
+- [#670](https://github.com/changesets/action/pull/670) [`5a8b9b7`](https://github.com/changesets/action/commit/5a8b9b721bf683e3bf9bd72ea92a685dc024147b) Thanks [@Andarist](https://github.com/Andarist)! - Derive the Git server URL from the GitHub Actions context when configuring git CLI authentication to support GitHub Enterprise Server setups.
+
+## 2.0.0-next.1
+
+### Patch Changes
+
+- [#663](https://github.com/changesets/action/pull/663) [`ccb3811`](https://github.com/changesets/action/commit/ccb38113eaaa4a13eb6aabe09520e49cc8519b84) Thanks [@Andarist](https://github.com/Andarist)! - Fix the computed publish plan path passed internally to `changeset pack` by the `/pack` subaction.
+
+- [#662](https://github.com/changesets/action/pull/662) [`5c88881`](https://github.com/changesets/action/commit/5c88881fff1f0d8b055d4a2d3a74a8ce843db6f3) Thanks [@Andarist](https://github.com/Andarist)! - Fixed usage of `--from-publish-plan` flag used by the `/pack` subaction
+
+- [#666](https://github.com/changesets/action/pull/666) [`dc29b73`](https://github.com/changesets/action/commit/dc29b738b532d9e95f46b9bf493e2e3fdf48a7ed) Thanks [@Andarist](https://github.com/Andarist)! - Fix the `/version` subaction to not crash on missing `pr-base-branch` input. This input is meant to be optional.
+
 ## 2.0.0-next.0

 ### Major Changes
@@ -1,232 +1,77 @@
-# Changesets Release Action
+# Changesets GitHub Action

 > [!IMPORTANT]
 > This is the development branch for `changesets/action` v2 compatible with Changesets v3. For the v1 code compatible with Changesets v2, check out the [`maintenance/v1`](https://github.com/changesets/action/tree/maintenance/v1) branch.

-This action for [Changesets](https://github.com/changesets/changesets) creates a pull request with all of the package versions updated and changelogs updated and when there are new changesets on [your configured `baseBranch`](https://github.com/changesets/changesets/blob/main/docs/config-file-options.md#basebranch-git-branch-name), the PR will be updated. When you're ready, you can merge the pull request and you can either publish the packages to npm manually or setup the action to do it for you.
+This repo contains a collection of GitHub Actions for [Changesets](https://changesets.dev). Check out the [Automating Changesets](https://changesets.dev/guide/automating) guide to learn how to use these actions to automate your workflow.

-There are also sub-actions hosted in this repository. Check out their respective READMEs for more details:
+- [changesets/action](./README.md): (This README. See below for details.)
+- [changesets/action/select-mode](./select-mode/README.md): Select the mode to run a Changesets workflow.
+- [changesets/action/version](./version/README.md): Version packages and create or update a pull request with the changes.
+- [changesets/action/pack](./pack/README.md): Pack publishable packages into tarballs.
+- [changesets/action/publish](./publish/README.md): Publish packages to npm.
+- [changesets/action/pr-status](./pr-status/README.md): Generate changeset status in PRs.
+- [changesets/action/pr-comment](./pr-comment/README.md): Create or update comments on PRs.

- [pr-status](./pr-status/README.md): Generate changeset status in PRs.
- [pr-comment](./pr-comment/README.md): Comment on PRs.
+## changesets/action

-## Usage
+This action handles versioning and publishing of packages. It's the equivalent of setting up the `changesets/action/select-mode`, `changesets/action/version`, and `changesets/action/publish` actions in a workflow, but with the required permissions combined.

-### Inputs
+If using [trusted publishing](https://docs.npmjs.com/trusted-publishers), it's recommended to set up the individual sub-actions instead to tighten publish permissions.

- publish - The command to use to build and publish packages
- version - The command to update version, edit CHANGELOG, read and delete changesets. Default to `changeset version` if not provided
- commit - The commit message to use. Default to `Version Packages`
- title - The pull request title. Default to `Version Packages`
- setupGitUser - Sets up the git user for commits as `"github-actions[bot]"`. Default to `true`
- createGithubReleases - A boolean value to indicate whether to create Github releases after `publish` or not. Default to `true`
- commitMode - Specifies the commit mode. Use `"git-cli"` to push changes using the Git CLI, or `"github-api"` to push changes via the GitHub API. When using `"github-api"`, all commits and tags are GPG-signed and attributed to the user or app who owns the `GITHUB_TOKEN`. Default to `git-cli`.
- cwd - Changes node's `process.cwd()` if the project is not located on the root. Default to `process.cwd()`
- prDraft - Controls draft PR behavior. Use `create` to create new version PRs as draft, or `always` to also convert existing version PRs back to draft when updating them. By default, version PRs are not forced into draft mode.
+### Requirements

-### Outputs
+- Needs repo checked out and `@changesets/cli` installed
+- [Job permissions][job-permissions]:
+  - `contents: write`: to commit version changes
+  - `pull-requests: write`: to create pull request
+  - `id-token: write`: if using [trusted publishing](https://docs.npmjs.com/trusted-publishers)
+- [Workflow triggers][workflow-triggers]: _any_

- published - A boolean value to indicate whether a publishing has happened or not
- publishedPackages - A JSON array to present the published packages. The format is `[{"name": "@xx/xx", "version": "1.2.0"}, {"name": "@xx/xy", "version": "0.8.9"}]`
+> [!NOTE]
+> In your repository settings, in `Actions > General`, also ensure the `Allow GitHub Actions to create and approve pull requests` option is enabled

-### Example workflow
+### Usage

-#### Without Publishing
+> [!TIP]
+> Check out [the docs](https://changesets.dev/guide/automating#how-do-i-run-the-version-and-publish-commands) to learn how to set up the version and publish workflow.

-Create a file at `.github/workflows/release.yml` with the following content.
+> [!IMPORTANT]
+> To use a custom GitHub token, pass it explicitly through the `github-token` input:
+>
+> ```yaml
+> with:
+>   github-token: ${{ secrets.CUSTOM_GITHUB_TOKEN }}
+> ```
+>
+> Setting the `GITHUB_TOKEN` environment variable does not configure the action. This applies whether release changes are pushed using the GitHub API or the Git CLI.

-```yml
-name: Release
+### API

-on:
-  push:
-    branches:
-      - main
+<!-- api-start -->

-concurrency: ${{ github.workflow }}-${{ github.ref }}
+| Inputs                   | Description                                                                                                                                                                                                                                               |
+| ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `github-token`           | The GitHub token to use for authentication. Defaults to the GitHub-provided token. To use a custom token, pass it explicitly to this input.                                                                                                               |
+| `publish-script`         | The command to use to build and publish packages                                                                                                                                                                                                          |
+| `version-script`         | The command to update version, edit CHANGELOG, read and delete changesets. Default to `changeset version` if not provided                                                                                                                                 |
+| `commit-message`         | The commit message. Default to `Version Packages`                                                                                                                                                                                                         |
+| `pr-title`               | The pull request title. Default to `Version Packages`                                                                                                                                                                                                     |
+| `pr-draft`               | Controls draft PR behavior. Use 'create' to create new version PRs as draft, or 'always' to also convert existing version PRs back to draft when updating them.                                                                                           |
+| `pr-base-branch`         | Sets the base branch of the PR. Defaults to `github.ref_name`.                                                                                                                                                                                            |
+| `create-github-releases` | Whether to create Github releases after publish                                                                                                                                                                                                           |
+| `push-git-tags`          | Whether to create git tags after publish. If `create-github-releases` is set to `true`, this option will also always be `true`.                                                                                                                           |
+| `push-with-git-cli`      | Whether to use the Git CLI instead of the GitHub API to push release commits and tags. Defaults to `false`. When using the GitHub API, commits and tags are signed using GitHub's GPG key and attributed to the user or app that owns the `github-token`. |
+| `cwd`                    | The working directory to execute Changesets in. Defaults to the root of the repository.                                                                                                                                                                   |

-jobs:
-  release:
-    name: Release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v6
+| Outputs              | Description                                                                                                                                      |
+| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `published`          | A "true" or "false" string value to indicate whether a publishing is happened or not                                                             |
+| `published-packages` | A JSON array to present the published packages. The format is `[{"name": "@xx/xx", "version": "1.2.0"}, {"name": "@xx/xy", "version": "0.8.9"}]` |
+| `has-changesets`     | A "true" or "false" string value about whether there were changesets. Useful if you want to create your own publishing functionality.            |
+| `pr-number`          | The pull request number that was created or updated                                                                                              |

-      - name: Setup pnpm
-        uses: pnpm/action-setup@v6
+<!-- api-end -->

-      - name: Setup Node.js 26
-        uses: actions/setup-node@v6
-        with:
-          node-version: 26
-
-      - name: Install Dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Create Release Pull Request
-        uses: changesets/action@v1
-```
-
-#### With Publishing
-
-Before you can setup this action with publishing, you'll need to have an [npm token](https://docs.npmjs.com/creating-and-viewing-authentication-tokens) that can publish the packages in the repo you're setting up the action for and doesn't have 2FA on publish enabled ([2FA on auth can be enabled](https://docs.npmjs.com/about-two-factor-authentication)). You'll also need to [add it as a secret on your GitHub repo](https://help.github.com/en/articles/virtual-environments-for-github-actions#creating-and-using-secrets-encrypted-variables) with the name `NPM_TOKEN`. Once you've done that, you can create a file at `.github/workflows/release.yml` with the following content.
-
-```yml
-name: Release
-
-on:
-  push:
-    branches:
-      - main
-
-concurrency: ${{ github.workflow }}-${{ github.ref }}
-
-jobs:
-  release:
-    name: Release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v6
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v6
-
-      - name: Setup Node.js 26
-        uses: actions/setup-node@v6
-        with:
-          node-version: 26
-
-      - name: Install Dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Create Release Pull Request or Publish to npm
-        id: changesets
-        uses: changesets/action@v1
-        with:
-          # This expects you to have a script called release which does a build for your packages and calls changeset publish
-          publish: pnpm release
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Send a Slack notification if a publish happens
-        if: steps.changesets.outputs.published == 'true'
-        # You can do something when a publish happens.
-        run: my-slack-bot send-notification --message "A new version of ${GITHUB_REPOSITORY} was published!"
-```
-
-By default the GitHub Action creates a `.npmrc` file with the following content:
-
-```txt
-//registry.npmjs.org/:_authToken=${process.env.NPM_TOKEN}
-```
-
-However, if a `.npmrc` file is found, the GitHub Action does not recreate the file. This is useful if you need to configure the `.npmrc` file on your own.
-For example, you can add a step before running the Changesets GitHub Action:
-
-```yml
- name: Creating .npmrc
-  run: |
-    cat << EOF > "$HOME/.npmrc"
-      //registry.npmjs.org/:_authToken=$NPM_TOKEN
-    EOF
-  env:
-    NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-```
-
-#### Custom Publishing
-
-If you want to hook into when publishing should occur but have your own publishing functionality, you can utilize the `hasChangesets` output.
-
-Note that you might need to account for things already being published in your script because a commit without any new changesets can always land on your base branch after a successful publish. In such a case you need to figure out on your own how to skip over the actual publishing logic or handle errors gracefully as most package registries won't allow you to publish over already published version.
-
-```yml
-name: Release
-
-on:
-  push:
-    branches:
-      - main
-
-jobs:
-  release:
-    name: Release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v6
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v6
-
-      - name: Setup Node.js 26
-        uses: actions/setup-node@v6
-        with:
-          node-version: 26
-
-      - name: Install Dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Create Release Pull Request or Publish to npm
-        id: changesets
-        uses: changesets/action@v1
-
-      - name: Publish
-        if: steps.changesets.outputs.hasChangesets == 'false'
-        # You can do something when a publish should happen.
-        run: pnpm publish
-```
-
-#### With version script
-
-If you need to add additional logic to the version command, you can do so by using a version script.
-
-If the version script is present, this action will run that script instead of `changeset version`, so please make sure that your script calls `changeset version` at some point. All the changes made by the script will be included in the PR.
-
-```yml
-name: Release
-
-on:
-  push:
-    branches:
-      - main
-
-concurrency: ${{ github.workflow }}-${{ github.ref }}
-
-jobs:
-  release:
-    name: Release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v6
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v6
-
-      - name: Setup Node.js 26
-        uses: actions/setup-node@v6
-        with:
-          node-version: 26
-
-      - name: Install Dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Create Release Pull Request
-        uses: changesets/action@v1
-        with:
-          # this expects you to have a npm script called version that runs some logic and then calls `changeset version`.
-          version: pnpm version
-```
-
-#### With Yarn 2 / Plug'n'Play
-
-If you are using [Yarn Plug'n'Play](https://yarnpkg.com/features/pnp), you should use a custom `version` command so that the action can resolve the `changeset` CLI:
-
-```yaml
- uses: changesets/action@v1
-  with:
-    version: yarn changeset version
-    # ...
-```
+[job-permissions]: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idpermissions
+[workflow-triggers]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
@@ -5,53 +5,60 @@ runs:
  main: "dist/index.js"
 inputs:
  github-token:
-    description: "The GitHub token to use for authentication. Defaults to the GitHub-provided token."
+    description: >
+      The GitHub token to use for authentication. Defaults to the GitHub-provided token.
+      To use a custom token, pass it explicitly to this input.
    required: false
    default: ${{ github.token }}
-  publish:
+  publish-script:
    description: "The command to use to build and publish packages"
    required: false
-  version:
+  version-script:
    description: "The command to update version, edit CHANGELOG, read and delete changesets. Default to `changeset version` if not provided"
    required: false
-  commit:
-    description: |
-      The commit message. Default to `Version Packages`
+  commit-message:
+    description: "The commit message. Default to `Version Packages`"
    required: false
-  title:
-    description: The pull request title. Default to `Version Packages`
+    default: "Version Packages"
+  pr-title:
+    description: "The pull request title. Default to `Version Packages`"
    required: false
-  setupGitUser:
-    description: Sets up the git user for commits as `"github-actions[bot]"`. Default to `true`
+    default: "Version Packages"
+  pr-draft:
+    description: "Controls draft PR behavior. Use 'create' to create new version PRs as draft, or 'always' to also convert existing version PRs back to draft when updating them."
+    required: false
+  pr-base-branch:
+    description: "Sets the base branch of the PR. Defaults to `github.ref_name`."
+    required: false
+  create-github-releases:
+    description: "Whether to create Github releases after publish"
    required: false
    default: true
-  createGithubReleases:
-    description: "A boolean value to indicate whether to create Github releases after `publish` or not"
-    required: false
-    default: true
-  commitMode:
+  push-git-tags:
    description: >
-      An enum to specify the commit mode. Use "git-cli" to push changes using the Git CLI,
-      or "github-api" to push changes via the GitHub API. When using "github-api",
-      all commits and tags are signed using GitHub's GPG key and attributed to the user
-      or app who owns the GITHUB_TOKEN.
+      Whether to create git tags after publish. If `create-github-releases` is set to `true`,
+      this option will also always be `true`.
    required: false
-    default: "git-cli"
-  branch:
-    description: Sets the branch in which the action will run. Default to `github.ref_name` if not provided
+    default: true
+  push-with-git-cli:
+    description: >
+      Whether to use the Git CLI instead of the GitHub API to push release commits and tags.
+      Defaults to `false`. When using the GitHub API, commits and tags are signed using
+      GitHub's GPG key and attributed to the user or app that owns the `github-token`.
    required: false
-  prDraft:
-    description: 'Controls draft PR behavior. Use "create" to create new version PRs as draft, or "always" to also convert existing version PRs back to draft when updating them.'
+    default: false
+  cwd:
+    description: "The working directory to execute Changesets in. Defaults to the root of the repository."
    required: false
 outputs:
  published:
-    description: A boolean value to indicate whether a publishing is happened or not
-  publishedPackages:
+    description: A "true" or "false" string value to indicate whether a publishing is happened or not
+  published-packages:
    description: >
      A JSON array to present the published packages. The format is `[{"name": "@xx/xx", "version": "1.2.0"}, {"name": "@xx/xy", "version": "0.8.9"}]`
-  hasChangesets:
-    description: A boolean about whether there were changesets. Useful if you want to create your own publishing functionality.
-  pullRequestNumber:
+  has-changesets:
+    description: A "true" or "false" string value about whether there were changesets. Useful if you want to create your own publishing functionality.
+  pr-number:
    description: The pull request number that was created or updated
 branding:
  icon: "package"
@@ -0,0 +1 @@
+import{A as e,D as t,O as n,f as r,j as i,k as a,m as o,o as s,p as c,s as l}from"./utils-j_VOz275.js";import{n as u,r as d,t as f}from"./run-CIL9Fbt6.js";import{t as p}from"./readChangesetState-DLdyz-Wv.js";try{await m()}catch(t){e(t.message)}async function m(){let m=s(`cwd`)||process.cwd();await o(m),c({publish:`publish-script`,version:`version-script`,commit:`commit-message`,title:`pr-title`,branch:`pr-base-branch`,prDraft:`pr-draft`,createGithubReleases:`create-github-releases`}),r();let h=l(`github-token`);if(process.env.GITHUB_TOKEN&&process.env.GITHUB_TOKEN!==h)throw Error(`The GITHUB_TOKEN environment variable is set and does not match the "github-token" input. Please pass the custom GitHub token to the "github-token" input and remove the GITHUB_TOKEN environment variable to avoid conflicts.`);let g=t(`push-with-git-cli`),_=s(`pr-draft`);if(_!==void 0&&_!==`always`&&_!==`create`){e(`Invalid pr-draft: ${_}`);return}let v=new d({cwd:m,githubToken:h,pushWithGitCli:g}),{changesets:y}=await p(m),b=n(`publish-script`),x=y.length!==0,S=y.some(e=>e.releases.length>0),C=!!b;switch(i(`published`,`false`),i(`published-packages`,`[]`),i(`has-changesets`,String(x)),!0){case!x&&!C:a(`No changesets present or were removed by merging version PR. Not publishing because publish-script is not set.`);return;case!x&&C:{a(`No changesets found. Attempting to publish any unpublished packages to npm`);let e=t(`create-github-releases`),n=t(`push-git-tags`);if(e&&!n)throw Error(`The input 'create-github-releases' is set to true, but 'push-git-tags' is set to false. Creating GitHub releases requires pushing git tags. Please set 'push-git-tags' to true or set 'create-github-releases' to false.`);let r=await f({script:b,github:v,createGithubReleases:e,pushGitTags:n,cwd:m});if(r.published&&(i(`published`,`true`),i(`published-packages`,JSON.stringify(r.publishedPackages))),r.exitCode!==0)throw Error(`Publish command exited with code ${r.exitCode}${r.published?`, but some packages were published: ${r.publishedPackages.map(e=>`${e.name}@${e.version}`).join(`, `)}`:``}`);return}case x&&!S:a(`All changesets are empty. Not creating PR`);return;case x:{let{pullRequestNumber:e}=await u({script:s(`version-script`),github:v,cwd:m,prTitle:s(`pr-title`),commitMessage:s(`commit-message`),hasPublishScript:C,prDraft:_,branch:s(`pr-base-branch`)});i(`pr-number`,String(e));return}}}export{};
@@ -0,0 +1 @@
+import{A as e,j as t,m as n,n as r,o as i,t as a,y as o}from"./utils-j_VOz275.js";import s from"node:fs/promises";import c from"node:path";import l from"node:os";try{await u()}catch(t){e(t.message)}async function u(){let e=i(`cwd`)||process.cwd();await n(e);let r=i(`publish-plan-artifact-id`),a=process.env.RUNNER_TEMP??await s.realpath(l.tmpdir()),u=c.join(a,`changeset-pack-${Date.now()}`);await d(e,{outDir:u,publishPlanPath:r?await f(a,Number(r)):void 0});let m=await o.uploadArtifact(`changeset-pack-${Date.now()}`,await p(u),u,{retentionDays:30});if(m.id===void 0)throw Error(`Packed artifact upload did not return an artifact id`);t(`pack-dir-artifact-id`,String(m.id))}async function d(e,t){let n=[`pack`,`--out-dir`,t.outDir];t.publishPlanPath&&n.push(`--from-publish-plan`,t.publishPlanPath),await r(n,{cwd:e,env:process.env})}async function f(e,t){let n=await a(e,t,`changeset-publish-plan`);return c.join(n,`publish-plan.json`)}async function p(e){let t=await s.readdir(e,{withFileTypes:!0});return(await Promise.all(t.map(async t=>{let n=c.join(e,t.name);return t.isDirectory()?p(n):[n]}))).flat()}export{};
@@ -0,0 +1 @@
+import{A as e,T as t,j as n,k as r,o as i,s as a,w as o}from"./utils-j_VOz275.js";try{await s()}catch(t){e(t.message)}async function s(){let e=o.payload.pull_request;if(!e)throw Error("This action should only be run on `pull_request_target` or `pull_request` events");let s=a(`github-token`),l=a(`body`),u=i(`update-id`),d=u?c(u):null,f=d?`${d}\n\n${l}`:l,p={repo:e.base.repo.name,owner:e.base.repo.owner.login,issue_number:e.number,body:f},m=t(s),h;if(d&&(r(`Checking for existing comment...`),h=await m.rest.issues.listComments({repo:e.base.repo.name,owner:e.base.repo.owner.login,issue_number:e.number}).then(e=>e.data.find(e=>e.body?.includes(d))?.id)),h)r(`Updating existing comment (id: ${h})...`),await m.rest.issues.updateComment({...p,comment_id:h}),n(`comment-id`,h);else{r(`Creating new comment...`);let e=await m.rest.issues.createComment(p);n(`comment-id`,e.data.id)}r(`Done!`)}function c(e){let t=`changesets-action-pr-comment`;return t===e?`<!-- ${t} -->`:`<!-- ${t}:${e} -->`}export{};
@@ -0,0 +1 @@
+import{A as e,D as t,j as n,m as r,o as i,s as a,t as o}from"./utils-j_VOz275.js";import{r as s,t as c}from"./run-CIL9Fbt6.js";import l from"node:fs/promises";import u from"node:os";try{await d()}catch(t){e(t.message)}async function d(){let e=i(`cwd`)||process.cwd();await r(e);let d=a(`github-token`),f=i(`script`),p=i(`pack-dir-artifact-id`),m=t(`create-github-releases`),h=t(`push-git-tags`);if(m&&!h)throw Error(`The input 'create-github-releases' is set to true, but 'push-git-tags' is set to false. Creating GitHub releases requires pushing git tags. Please set 'push-git-tags' to true or set 'create-github-releases' to false.`);let g=new s({cwd:e,githubToken:d}),_=p?await o(process.env.RUNNER_TEMP??await l.realpath(u.tmpdir()),Number(p),`changeset-pack`):void 0,v=await c({script:f,github:g,createGithubReleases:m,pushGitTags:h,cwd:e,fromPackDir:_});if(v.published?(n(`published`,`true`),n(`published-packages`,JSON.stringify(v.publishedPackages))):n(`published`,`false`),v.exitCode!==0)throw Error(`Publish command exited with code ${v.exitCode}${v.published?`, but some packages were published: ${v.publishedPackages.map(e=>`${e.name}@${e.version}`).join(`, `)}`:``}`)}export{};
@@ -0,0 +1 @@
+import{i as e,t}from"./dist-BjZhuI7Y.js";async function n(n=process.cwd()){let r=await e(n),i=await t(n);return r!==void 0&&r.mode===`pre`?{preState:r,changesets:i.filter(e=>!e.id.startsWith(`pre/`))}:{preState:void 0,changesets:i}}export{n as t};
@@ -0,0 +1 @@
+import{A as e,j as t,m as n,n as r,o as i,y as a}from"./utils-j_VOz275.js";import{t as o}from"./readChangesetState-DLdyz-Wv.js";import s from"node:fs/promises";import c from"node:path";import l from"node:os";try{await u()}catch(t){e(t.message)}async function u(){let e=i(`cwd`)||process.cwd();await n(e);let r=await d(e);if(t(`mode`,r.mode),r.mode===`publish`){let e=await a.uploadArtifact(c.basename(r.publishPlanPath,`.json`),[r.publishPlanPath],c.dirname(r.publishPlanPath),{skipArchive:!0,retentionDays:30});if(e.id===void 0)throw Error(`Publish plan artifact upload did not return an artifact id`);t(`publish-plan-artifact-id`,String(e.id))}}async function d(e){let{changesets:t}=await o(e);if(t.length>0)return t.some(e=>e.releases.length>0)?{mode:`version`}:{mode:`none`};let n=c.join(process.env.RUNNER_TEMP??await s.realpath(l.tmpdir()),`changeset-publish-plan-${Date.now()}`,`publish-plan.json`);return await r([`publish-plan`,`--output`,n],{cwd:e,env:process.env}),(await f(n)).length===0?{mode:`none`}:{mode:`publish`,publishPlanPath:n}}async function f(e){let t;try{t=await s.readFile(e,`utf8`)}catch(t){throw Error(`Failed to read publish plan at ${e}`,{cause:t})}let n;try{n=JSON.parse(t)}catch(t){throw Error(`Failed to parse publish plan at ${e}`,{cause:t})}if(typeof n!=`object`||!n||!(`version`in n)||typeof n.version!=`number`||!(`plan`in n)||!Array.isArray(n.plan))throw Error(`Invalid publish plan at ${e}: expected { version: number; plan: unknown[] }`);return n.plan}export{};
@@ -0,0 +1 @@
+import{A as e,D as t,f as n,j as r,m as i,o as a,s as o}from"./utils-j_VOz275.js";import{n as s,r as c}from"./run-CIL9Fbt6.js";try{await l()}catch(t){e(t.message)}async function l(){let e=a(`cwd`)||process.cwd();await i(e),n();let l=o(`github-token`),u=a(`script`),d=o(`commit-message`),f=o(`pr-title`),p=a(`pr-draft`),m=a(`pr-base-branch`),h=t(`push-with-git-cli`);if(p!==void 0&&p!==`always`&&p!==`create`)throw Error(`Invalid pr-draft input: ${p}`);let g=new c({cwd:e,githubToken:l,pushWithGitCli:h}),{pullRequestNumber:_}=await s({script:u,github:g,cwd:e,prTitle:f,commitMessage:d,hasPublishScript:!0,prDraft:p,branch:m});r(`pr-number`,String(_))}export{};
@@ -1,3 +1,32 @@
 # changesets/action/pack

-TODO
+This action packs publishable packages into tarballs, complements [changesets/action/publish](../publish/README.md) to publish them in a later step.
+
+## Requirements
+
+- Needs repo checked out and `@changesets/cli` installed
+- [Job permissions][job-permissions]: _none_
+- [Workflow triggers][workflow-triggers]: _any_
+
+## Usage
+
+> [!TIP]
+> Check out [the docs](https://changesets.dev/guide/automating#how-do-i-run-the-version-and-publish-commands) to learn how to set up the version and publish workflow.
+
+## API
+
+<!-- api-start -->
+
+| Inputs                     | Description                                                                             |
+| -------------------------- | --------------------------------------------------------------------------------------- |
+| `publish-plan-artifact-id` | Artifact id for a publish plan generated by the select-mode subaction                   |
+| `cwd`                      | The working directory to execute Changesets in. Defaults to the root of the repository. |
+
+| Outputs                | Description                                 |
+| ---------------------- | ------------------------------------------- |
+| `pack-dir-artifact-id` | Artifact id for the packed output directory |
+
+<!-- api-end -->
+
+[job-permissions]: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idpermissions
+[workflow-triggers]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
@@ -7,6 +7,9 @@ inputs:
  publish-plan-artifact-id:
    description: "Artifact id for a publish plan generated by the select-mode subaction"
    required: false
+  cwd:
+    description: "The working directory to execute Changesets in. Defaults to the root of the repository."
+    required: false
 outputs:
  pack-dir-artifact-id:
    description: "Artifact id for the packed output directory"
@@ -1,6 +1,7 @@
 {
  "name": "@changesets/action",
-  "version": "2.0.0-next.0",
+  "version": "2.1.2",
+  "private": true,
  "license": "MIT",
  "type": "module",
  "main": "dist/index.js",
@@ -12,44 +13,46 @@
    "format": "oxfmt --check",
    "format:fix": "oxfmt",
    "changeset": "changeset",
-    "bump": "node --experimental-strip-types ./scripts/bump.ts",
-    "release": "node --experimental-strip-types ./scripts/release.ts",
-    "release:pr": "node --experimental-strip-types ./scripts/release-pr.ts"
+    "bump": "node ./scripts/bump.ts",
+    "update-readme": "node ./scripts/update-readme.ts",
+    "release": "node ./scripts/release.ts",
+    "release:pr": "node ./scripts/release-pr.ts"
  },
  "dependencies": {
    "@actions/artifact": "^6.2.1",
    "@actions/core": "^3.0.1",
    "@actions/exec": "^3.0.0",
    "@actions/github": "^9.1.1",
-    "@changesets/get-release-plan": "^4.0.16",
-    "@changesets/ghcommit": "^2.1.1",
-    "@changesets/git": "^3.0.4",
-    "@changesets/pre": "^2.0.2",
-    "@changesets/read": "^0.6.7",
-    "@manypkg/get-packages": "^1.1.3",
-    "@octokit/core": "^7.0.6",
-    "@octokit/plugin-throttling": "^11.0.3",
-    "human-id": "^4.1.3",
+    "@changesets/get-release-plan": "^5.0.0",
+    "@changesets/ghcommit": "^3.0.0",
+    "@changesets/git": "^4.0.0",
+    "@changesets/pre": "^3.0.0",
+    "@changesets/read": "^1.0.0",
+    "@manypkg/get-packages": "^3.1.0",
+    "@octokit/core": "^7.0.7",
+    "@octokit/plugin-throttling": "^11.0.5",
+    "human-id": "^4.2.1",
    "markdown-table": "^3.0.4",
-    "semver": "^7.8.1",
-    "tinyexec": "^1.2.4"
+    "semver": "^7.8.5",
+    "tinyexec": "^1.3.0"
  },
  "devDependencies": {
-    "@changesets/changelog-github": "^0.7.0",
-    "@changesets/cli": "^2.31.0",
-    "@changesets/types": "^6.1.0",
-    "@changesets/write": "^0.4.0",
-    "@tsconfig/node24": "^24.0.4",
-    "@types/node": "^24.12.4",
-    "@types/semver": "^7.7.1",
-    "fs-fixture": "^2.13.0",
-    "oxfmt": "^0.48.0",
-    "rolldown": "^1.0.1",
+    "@changesets/changelog-github": "^1.0.0",
+    "@changesets/cli": "^3.0.1",
+    "@changesets/types": "^7.0.0",
+    "@changesets/write": "^1.0.1",
+    "@tsconfig/node24": "^24.0.5",
+    "@types/node": "^26.3.0",
+    "@types/semver": "^7.8.0",
+    "fs-fixture": "^2.14.0",
+    "oxfmt": "^0.65.0",
+    "rolldown": "^1.2.5",
    "typescript": "^6.0.3",
-    "vitest": "^4.1.6"
+    "vitest": "^4.1.11",
+    "yaml": "^2.9.0"
  },
  "engines": {
    "node": ">=24"
  },
-  "packageManager": "pnpm@11.1.1+sha512.d1fdf5f73c617b64fa1a56a81c3c8dfe0e966e33a6010aa256b517ae77be21d93e05affc0de1a83b0e4f29d569f68b446ae8f068cd7247c0bb3df0fb4d7bdf9a"
+  "packageManager": "pnpm@11.20.0+sha512.9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee"
 }
@@ -3,7 +3,24 @@ dedupePeers: true
 dedupePeerDependents: true
 minimumReleaseAge: 10080
 minimumReleaseAgeExclude:
-  - "@changesets/ghcommit@2.1.1"
+  - "@changesets/apply-release-plan@8.0.0"
+  - "@changesets/assemble-release-plan@7.0.0"
+  - "@changesets/changelog-git@1.0.0"
+  - "@changesets/changelog-github@1.0.0"
+  - "@changesets/cli@3.0.0"
+  - "@changesets/config@4.0.0"
+  - "@changesets/errors@1.0.0"
+  - "@changesets/get-dependents-graph@3.0.0"
+  - "@changesets/get-github-info@1.0.0"
+  - "@changesets/get-release-plan@5.0.0"
+  - "@changesets/git@4.0.0"
+  - "@changesets/parse@1.0.0"
+  - "@changesets/pre@3.0.0"
+  - "@changesets/read@1.0.0"
+  - "@changesets/should-skip-package@1.0.0"
+  - "@changesets/types@7.0.0"
+  - "@changesets/write@1.0.0"
+  - "vite@8.2.0"

 overrides:
  lightningcss: "-" # we do not bundle any css
@@ -1,16 +1,28 @@
-# @changesets/action/pr-comment
+# changesets/action/pr-comment

-A simple GitHub Action to comment on PRs aimed to complement [`@changesets/action/pr-status`](../pr-status/README.md).
+This action creates or updates comments on PRs, aimed to complement [changesets/action/pr-status](../pr-status/README.md).

-This action is intentionally simple without advanced features. Check out other actions if so, such as [mshick/add-pr-comment](https://github.com/marketplace/actions/add-pr-comment) and [peter-evans/create-or-update-comment](https://github.com/marketplace/actions/create-or-update-comment).
+Its features are kept intentionally simple. For advanced usecases, check out other actions such as [mshick/add-pr-comment](https://github.com/marketplace/actions/add-pr-comment) and [peter-evans/create-or-update-comment](https://github.com/marketplace/actions/create-or-update-comment).

-See the [action metadata](action.yml) for details on the inputs and outputs.
+## Requirements

-## Example setup
+- [Job permissions][job-permissions]:
+  - `pull-requests: write`: to create and update comments on PRs
+- [Workflow triggers][workflow-triggers]:
+  - [`pull_request`][trigger-pull-request]
+  - [`pull_request_target`][trigger-pull-request-target]
+
+> [!CAUTION]
+> **Do not run untrusted code** when using the `pull_request_target` event.
+>
+> `pull_request_target` can be useful to support PRs from forks, however it enables write permissions by default which can be a security risk if untrusted code is executed and the permissions aren't scoped down.
+
+## Usage
+
+> [!TIP]
+> Check out [the docs](https://changesets.dev/guide/automating#non-blocking) to learn how to set up commenting changesets status on PRs.

 ```yaml
-name: PR Comment
-
 on:
  pull_request:

@@ -18,21 +30,25 @@ jobs:
  pr-comment:
    runs-on: ubuntu-slim
    permissions:
-      pull-requests: write # to create and update comments on PRs
+      pull-requests: write # to create and update comments on PRs (changesets/action/pr-comment)
    steps:
-      - uses: changesets/action/pr-comment@v1
+      - name: Comment on PR
+        uses: changesets/action/pr-comment@v2
        with:
          body: Hello world!
 ```

-When called repeatedly, the action will update the comment it created by default. If you use this action to create different types of comments, pass an `update-id` value to differentiate them.
+If the action is called again for the same PR, for example, if called in another workflow run, it will update the comment it created by default.
+
+If you use the action to create different types of comments, pass an `update-id` value to differentiate them.

 ```yaml
 jobs:
  pr-comment:
    # ...
    steps:
-      - uses: changesets/action/pr-comment@v1
+      - name: Comment on PR
+        uses: changesets/action/pr-comment@v2
        with:
          body: Hello world!
          update-id: my-tag
@@ -45,8 +61,29 @@ jobs:
  pr-comment:
    # ...
    steps:
-      - uses: changesets/action/pr-comment@v1
+      - uses: changesets/action/pr-comment@v2
        with:
          body: Hello world!
          update-id: ""
 ```
+
+## API
+
+<!-- api-start -->
+
+| Inputs         | Description                                                                                                                                                                         |
+| -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `github-token` | The GitHub token to use for authentication. Defaults to the GitHub-provided token. To use a custom token, pass it explicitly to this input.                                         |
+| `body`         | **Required.** The comment body to post on the PR.                                                                                                                                   |
+| `update-id`    | By default, the action will create and update a comment with this id. Pass a different id to create and update a new comment, or pass an empty string to disable updating comments. |
+
+| Outputs      | Description                                                |
+| ------------ | ---------------------------------------------------------- |
+| `comment-id` | The comment id of the comment that was created or updated. |
+
+<!-- api-end -->
+
+[job-permissions]: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idpermissions
+[workflow-triggers]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
+[trigger-pull-request]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request
+[trigger-pull-request-target]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target
@@ -1,11 +1,13 @@
 name: Changesets - PR Comment
-description: A simple GitHub Action to comment on PRs
+description: Create or update comments on PRs
 runs:
  using: node24
  main: ../dist/pr-comment.js
 inputs:
  github-token:
-    description: "The GitHub token to use for authentication. Defaults to the GitHub-provided token."
+    description: >
+      The GitHub token to use for authentication. Defaults to the GitHub-provided token.
+      To use a custom token, pass it explicitly to this input.
    required: false
    default: ${{ github.token }}
  body:
@@ -1,71 +1,40 @@
 # changesets/action/pr-status

-This action generates the changesets status in PRs, e.g. whether it has changeset files and which packages will be released if the PR is merged.
+This action generates the changesets status in PRs, for example, whether it has changeset files and which packages will be released if the PR is merged.

-It requires the repo to be checked out, and automatically fetches the PR head ref into a temporary detached worktree in order to infer the changed files and packages.
+It requires the repo to be checked out, and will automatically fetch the PR head ref into a temporary detached worktree in order to infer the changed files and packages.

-See the [action metadata](action.yml) for details on the inputs and outputs.
+## Requirements
+
+- Needs repo checked out
+- [Job permissions][job-permissions]: _none_
+- [Workflow triggers][workflow-triggers]:
+  - [`pull_request`][trigger-pull-request]
+  - [`pull_request_target`][trigger-pull-request-target]

 > [!CAUTION]
-> **This action uses `pull_request_target` by default to support PRs from forks.**
->
 > **Do not run untrusted code** when using the `pull_request_target` event.
 >
-> The example below only **_checks out_** and **_reads_** code, and does not **_execute_** any code from the fork.
->
-> Read more about the `pull_request_target` event in the [GitHub documentation](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target).
+> `pull_request_target` can be useful to support PRs from forks, however it enables write permissions by default which can be a security risk if untrusted code is executed and the permissions aren't scoped down.

-You can also use the [`pull_request`](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request) event if you prefer to lock permissions down and not run for PRs from forks. Make sure to add an if check to prevent the action from failing in fork PRs:
+[job-permissions]: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idpermissions
+[workflow-triggers]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
+[trigger-pull-request]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request
+[trigger-pull-request-target]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target

-```yaml
-jobs:
-  pr-status:
-    if: github.event.pull_request.head.repo.full_name == github.repository
-    # ...
-```
+## Usage

-You can also use the [Changesets Bot](https://github.com/apps/changeset-bot) if you don't want an extra action in your repo, or are worried about the `pull_request_target` event.
+> [!TIP]
+> Check out [the docs](https://changesets.dev/guide/automating#non-blocking) to learn how to set up commenting changesets status on PRs.

-## Example setup
+## API

-```yaml
-# .github/workflows/comment-changesets-pr-status.yml
-name: Comment Changesets status in PRs
+<!-- api-start -->

-on:
-  pull_request_target:
+Inputs: _none_

-permissions: {} # require explicitly stating all permissions in each job
+| Outputs        | Description                                                         |
+| -------------- | ------------------------------------------------------------------- |
+| `comment-body` | The generated comment body to present the changesets status in PRs. |

-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  pr-status:
-    runs-on: ubuntu-slim
-    permissions:
-      contents: read # to check out files in the repo
-    outputs:
-      comment-body: ${{ steps.pr-status.outputs.comment-body }}
-    steps:
-      - name: Check out repo
-        uses: actions/checkout@v6
-
-      - name: Generate status
-        id: pr-status
-        uses: changesets/action/pr-status@v1
-
-  pr-comment:
-    needs: pr-status
-    runs-on: ubuntu-slim
-    permissions:
-      pull-requests: write # to create and update comments on PRs
-    steps:
-      - name: Comment on PR
-        uses: changesets/action/pr-comment@v1
-        with:
-          body: ${{ needs.pr-status.outputs.comment-body }}
-```
-
-The workflow uses [`@changesets/action/pr-comment`](../pr-comment/README.md), which is a simple GitHub Action to comment on PRs.
+<!-- api-end -->
@@ -1,3 +1,38 @@
 # changesets/action/publish

-TODO
+This action publishes packages to npm.
+
+## Requirements
+
+- Needs repo checked out and `@changesets/cli` installed
+- [Job permissions][job-permissions]:
+  - `id-token: write`: if using [trusted publishing](https://docs.npmjs.com/trusted-publishers)
+- [Workflow triggers][workflow-triggers]: _any_
+
+## Usage
+
+> [!TIP]
+> Check out [the docs](https://changesets.dev/guide/automating#how-do-i-run-the-version-and-publish-commands) to learn how to set up the version and publish workflow.
+
+## API
+
+<!-- api-start -->
+
+| Inputs                   | Description                                                                                                                                 |
+| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------- |
+| `github-token`           | The GitHub token to use for authentication. Defaults to the GitHub-provided token. To use a custom token, pass it explicitly to this input. |
+| `script`                 | The command to use to publish packages                                                                                                      |
+| `pack-dir-artifact-id`   | Artifact id for packed publish output generated by the pack subaction                                                                       |
+| `create-github-releases` | Whether to create Github releases after publish                                                                                             |
+| `push-git-tags`          | Whether to create git tags after publish. If `create-github-releases` is set to `true`, this option will also always be `true`.             |
+| `cwd`                    | The working directory to execute Changesets in. Defaults to the root of the repository.                                                     |
+
+| Outputs              | Description                                                                                                                                      |
+| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `published`          | A "true" or "false" string value to indicate whether a publishing has happened or not                                                            |
+| `published-packages` | A JSON array to present the published packages. The format is `[{"name": "@xx/xx", "version": "1.2.0"}, {"name": "@xx/xy", "version": "0.8.9"}]` |
+
+<!-- api-end -->
+
+[job-permissions]: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idpermissions
+[workflow-triggers]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
@@ -5,7 +5,9 @@ runs:
  main: ../dist/publish.js
 inputs:
  github-token:
-    description: "The GitHub token to use for authentication. Defaults to the GitHub-provided token."
+    description: >
+      The GitHub token to use for authentication. Defaults to the GitHub-provided token.
+      To use a custom token, pass it explicitly to this input.
    required: false
    default: ${{ github.token }}
  script:
@@ -18,9 +20,18 @@ inputs:
    description: "Whether to create Github releases after publish"
    required: false
    default: true
+  push-git-tags:
+    description: >
+      Whether to create git tags after publish. If `create-github-releases` is set to `true`,
+      this option will also always be `true`.
+    required: false
+    default: true
+  cwd:
+    description: "The working directory to execute Changesets in. Defaults to the root of the repository."
+    required: false
 outputs:
  published:
-    description: "A boolean value to indicate whether a publishing has happened or not"
+    description: A "true" or "false" string value to indicate whether a publishing has happened or not
  published-packages:
    description: >
      A JSON array to present the published packages. The format is `[{"name": "@xx/xx", "version": "1.2.0"}, {"name": "@xx/xy", "version": "0.8.9"}]`
@@ -1,12 +1,14 @@
 import fs from "node:fs";
 import path from "node:path";
 import { exec } from "@actions/exec";
-import pkgJson from "../package.json" with { type: "json" };

 process.chdir(path.join(import.meta.dirname, ".."));

 await exec("changeset", ["version"]);

+// read after versioning to get the new version
+const pkgJson = (await import("../package.json", { with: { type: "json" } }))
+  .default;
 const releaseLine = `v${pkgJson.version.split(".")[0]}`;

 const readmePath = path.join(import.meta.dirname, "..", "README.md");
@@ -1,6 +1,6 @@
 import { Buffer } from "node:buffer";
 import path from "node:path";
-import { exec, getExecOutput } from "@actions/exec";
+import { exec } from "@actions/exec";
 import pkgJson from "../package.json" with { type: "json" };

 const tag = `v${pkgJson.version}`;
@@ -20,37 +20,17 @@ const gitEnv = {

 process.chdir(path.join(import.meta.dirname, ".."));

-(async () => {
-  const { exitCode, stderr } = await getExecOutput(
-    `git`,
-    ["ls-remote", "--exit-code", "origin", "--tags", `refs/tags/${tag}`],
-    {
-      ignoreReturnCode: true,
-    },
-  );
-  if (exitCode === 0) {
-    console.log(
-      `Action is not being published because version ${tag} is already published`,
-    );
-    return;
-  }
-  if (exitCode !== 2) {
-    throw new Error(`git ls-remote exited with ${exitCode}:\n${stderr}`);
-  }
+await exec("git", ["checkout", "--detach"]);
+await exec("git", ["add", "--force", "dist"]);
+await exec("git", ["commit", "-m", tag]);

-  await exec("git", ["checkout", "--detach"]);
-  await exec("git", ["add", "--force", "dist"]);
-  await exec("git", ["commit", "-m", tag]);
-
-  await exec("changeset", ["tag"]);
-
-  if (isPrerelease) {
-    await exec("git", ["push", "origin", `refs/tags/${tag}`], {
-      env: gitEnv,
-    });
-    return;
-  }
+await exec("changeset", ["git-tag"]);

+if (isPrerelease) {
+  await exec("git", ["push", "origin", `refs/tags/${tag}`], {
+    env: gitEnv,
+  });
+} else {
  await exec(
    "git",
    [
@@ -64,4 +44,4 @@ process.chdir(path.join(import.meta.dirname, ".."));
      env: gitEnv,
    },
  );
-})();
+}
@@ -0,0 +1,46 @@
+import * as fs from "node:fs/promises";
+import path from "node:path";
+import { markdownTable } from "markdown-table";
+import * as yaml from "yaml";
+
+await main();
+
+async function main() {
+  for await (const readmePath of fs.glob("**/README.md", {
+    exclude: ["**/node_modules/**"],
+  })) {
+    const actionPath = path.join(path.dirname(readmePath), "action.yml");
+    const actionExists = await fs.stat(actionPath).catch(() => null);
+    if (!actionExists) continue;
+
+    const action = yaml.parse(await fs.readFile(actionPath, "utf8"));
+    const inputs = action.inputs ?? {};
+    const outputs = action.outputs ?? {};
+
+    const content = [
+      renderSection("Inputs", inputs),
+      renderSection("Outputs", outputs),
+    ].join("\n\n");
+
+    const readme = await fs.readFile(readmePath, "utf8");
+    const updated = readme.replace(
+      /<!-- api-start -->[\s\S]*?<!-- api-end -->/,
+      `<!-- api-start -->\n\n${content}\n\n<!-- api-end -->`,
+    );
+    await fs.writeFile(readmePath, updated);
+  }
+}
+
+function renderSection(title: string, entries: Record<string, any>) {
+  const rows: string[][] = [];
+  for (const [name, entry] of Object.entries(entries)) {
+    let description = (entry.description ?? "").trim().replace(/\|/g, "\\|");
+    if (entry.required) description = `**Required.** ${description}`;
+    rows.push([`\`${name}\``, description]);
+  }
+  if (rows.length === 0) {
+    return `${title}: _none_`;
+  }
+  rows.unshift([title, "Description"]);
+  return markdownTable(rows);
+}
@@ -1,3 +1,35 @@
 # changesets/action/select-mode

-TODO
+This action selects the mode to run a Changesets workflow:
+
+- `"version"`: Changesets are found. The workflow should version packages and create a pull request with the changes.
+- `"publish"`: No changesets are found and they are publishable packages. The workflow should publish them.
+- `"none"`: No changesets are found and there are no publishable packages. The workflow should do nothing.
+
+## Requirements
+
+- [Job permissions][job-permissions]: _none_
+- [Workflow triggers][workflow-triggers]: _any_
+
+## Usage
+
+> [!TIP]
+> Check out [the docs](https://changesets.dev/guide/automating#how-do-i-run-the-version-and-publish-commands) to learn how to set up the version and publish workflow.
+
+## API
+
+<!-- api-start -->
+
+| Inputs | Description                                                                             |
+| ------ | --------------------------------------------------------------------------------------- |
+| `cwd`  | The working directory to execute Changesets in. Defaults to the root of the repository. |
+
+| Outputs                    | Description                                                                  |
+| -------------------------- | ---------------------------------------------------------------------------- |
+| `mode`                     | The mode to use for the current repo state: 'version', 'publish', or 'none'. |
+| `publish-plan-artifact-id` | Artifact id for the generated publish plan when mode is `publish`            |
+
+<!-- api-end -->
+
+[job-permissions]: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idpermissions
+[workflow-triggers]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
@@ -3,7 +3,10 @@ description: Whether to version or publish in the current repo state
 runs:
  using: node24
  main: ../dist/select-mode.js
-inputs: {}
+inputs:
+  cwd:
+    description: "The working directory to execute Changesets in. Defaults to the root of the repository."
+    required: false
 outputs:
  mode:
    description: "The mode to use for the current repo state: 'version', 'publish', or 'none'."
@@ -1,129 +0,0 @@
-import * as core from "@actions/core";
-import { exec, getExecOutput } from "@actions/exec";
-import * as github from "@actions/github";
-import { commitChangesFromRepo } from "@changesets/ghcommit/git";
-import type { Octokit } from "./octokit.ts";
-
-type GitOptions = {
-  cwd: string;
-};
-
-const push = async (branch: string, options: GitOptions) => {
-  await exec("git", ["push", "origin", `HEAD:${branch}`, "--force"], options);
-};
-
-const switchToMaybeExistingBranch = async (
-  branch: string,
-  options: GitOptions,
-) => {
-  let { stderr } = await getExecOutput("git", ["checkout", branch], {
-    ignoreReturnCode: true,
-    ...options,
-  });
-  let isCreatingBranch = !stderr
-    .toString()
-    .includes(`Switched to a new branch '${branch}'`);
-  if (isCreatingBranch) {
-    await exec("git", ["checkout", "-b", branch], options);
-  }
-};
-
-const reset = async (pathSpec: string, options: GitOptions) => {
-  await exec("git", ["reset", `--hard`, pathSpec], options);
-};
-
-const commitAll = async (message: string, options: GitOptions) => {
-  await exec("git", ["add", "."], options);
-  await exec("git", ["commit", "-m", message], options);
-};
-
-const checkIfClean = async (options: GitOptions): Promise<boolean> => {
-  const { stdout } = await getExecOutput(
-    "git",
-    ["status", "--porcelain"],
-    options,
-  );
-  return !stdout.length;
-};
-
-export class Git {
-  readonly octokit: Octokit | null;
-  readonly cwd: string;
-
-  constructor(args: { octokit?: Octokit; cwd: string }) {
-    this.octokit = args.octokit ?? null;
-    this.cwd = args.cwd;
-  }
-
-  async setupUser() {
-    if (this.octokit) {
-      return;
-    }
-    await exec("git", ["config", "user.name", `"github-actions[bot]"`], {
-      cwd: this.cwd,
-    });
-    await exec(
-      "git",
-      [
-        "config",
-        "user.email",
-        `"41898282+github-actions[bot]@users.noreply.github.com"`,
-      ],
-      {
-        cwd: this.cwd,
-      },
-    );
-  }
-
-  async pushTag(tag: string) {
-    if (this.octokit) {
-      return this.octokit.rest.git
-        .createRef({
-          ...github.context.repo,
-          ref: `refs/tags/${tag}`,
-          sha: github.context.sha,
-        })
-        .catch((err) => {
-          // Assuming tag was manually pushed in custom publish script
-          core.warning(`Failed to create tag ${tag}: ${err.message}`);
-        });
-    }
-    await exec("git", ["push", "origin", tag], { cwd: this.cwd });
-  }
-
-  async prepareBranch(branch: string) {
-    if (this.octokit) {
-      // Preparing a new local branch is not necessary when using the API
-      return;
-    }
-    await switchToMaybeExistingBranch(branch, { cwd: this.cwd });
-    await reset(github.context.sha, { cwd: this.cwd });
-  }
-
-  async pushChanges({ branch, message }: { branch: string; message: string }) {
-    if (this.octokit) {
-      /**
-       * Only add files form the current working directory
-       *
-       * This will emulate the behavior of `git add .`,
-       * used in {@link commitAll}.
-       */
-      const addFromDirectory = this.cwd;
-      return commitChangesFromRepo({
-        octokit: this.octokit,
-        ...github.context.repo,
-        branch,
-        message,
-        base: {
-          commit: github.context.sha,
-        },
-        cwd: this.cwd,
-        force: true,
-      });
-    }
-    if (!(await checkIfClean({ cwd: this.cwd }))) {
-      await commitAll(message, { cwd: this.cwd });
-    }
-    await push(branch, { cwd: this.cwd });
-  }
-}
@@ -0,0 +1,227 @@
+import { Buffer } from "node:buffer";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { exec } from "tinyexec";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { GitHub } from "./github.ts";
+import { createGitHttpRemote, shallowClone, testdir } from "./test-utils.ts";
+
+const githubContext = vi.hoisted(() => ({
+  repo: {
+    owner: "changesets",
+    repo: "action",
+  },
+  sha: "base-sha",
+}));
+
+vi.mock("@actions/github", () => ({
+  context: githubContext,
+  getOctokit: () => ({}),
+}));
+
+async function git(cwd: string, args: string[]) {
+  const result = await exec("git", args, {
+    nodeOptions: { cwd },
+    throwOnError: true,
+  });
+  return result.stdout.trim();
+}
+
+function getAuthorization(token: string) {
+  return `basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}`;
+}
+
+function createRemote() {
+  return createGitHttpRemote({ "file.txt": "initial\n" });
+}
+
+async function isolateGitConfig() {
+  const fixture = await testdir({ "global.gitconfig": "" });
+  vi.stubEnv("GIT_CONFIG_GLOBAL", path.join(fixture.path, "global.gitconfig"));
+  return fixture;
+}
+
+type GitHttpRemote = Awaited<ReturnType<typeof createGitHttpRemote>>;
+
+async function pushChangedFile(
+  repository: string,
+  serverUrl: string,
+  token: string,
+) {
+  await fs.writeFile(path.join(repository, "file.txt"), "changed\n");
+  const github = new GitHub({
+    cwd: repository,
+    githubToken: token,
+    pushWithGitCli: true,
+    serverUrl,
+  });
+  await github.pushChanges({
+    branch: "changeset-release/main",
+    message: "Version Packages",
+  });
+  return github;
+}
+
+async function expectReleaseBranch(remote: GitHttpRemote, repository: string) {
+  expect(
+    await git(remote.path, ["rev-parse", "refs/heads/changeset-release/main"]),
+  ).toBe(await git(repository, ["rev-parse", "HEAD"]));
+}
+
+function expectRequestsToUseToken(remote: GitHttpRemote, token: string) {
+  expect(remote.requests.length).toBeGreaterThan(0);
+  for (const request of remote.requests) {
+    expect(request.headers.authorization).toEqual([getAuthorization(token)]);
+  }
+}
+
+beforeEach(() => {
+  vi.stubEnv("GIT_AUTHOR_DATE", "2000-01-01T00:00:00Z");
+  vi.stubEnv("GIT_COMMITTER_DATE", "2000-01-01T00:00:00Z");
+  vi.stubEnv("GIT_CONFIG_COUNT", "0");
+  vi.stubEnv("GIT_CONFIG_NOSYSTEM", "1");
+  vi.stubEnv("GIT_TERMINAL_PROMPT", "0");
+});
+
+afterEach(() => {
+  vi.unstubAllEnvs();
+});
+
+describe("GitHub", () => {
+  it("defaults to GitHub API mode", () => {
+    const github = new GitHub({
+      cwd: "/repo",
+      githubToken: "token",
+    });
+
+    expect(github.pushWithGitCli).toBe(false);
+  });
+
+  it("uses github-token instead of checkout's persisted header for branch and tag pushes", async () => {
+    await using _gitConfig = await isolateGitConfig();
+    const actionToken = "action-token";
+    const checkoutToken = "checkout-token";
+    await using remote = await createRemote();
+    await using repositoryFixture = await shallowClone(remote.path);
+    const repository = repositoryFixture.path;
+    const serverUrl = new URL(remote.url).origin;
+
+    await git(repository, ["remote", "set-url", "origin", remote.url]);
+    await git(repository, [
+      "config",
+      `http.${serverUrl}/.extraheader`,
+      `AUTHORIZATION: ${getAuthorization(checkoutToken)}`,
+    ]);
+
+    const github = await pushChangedFile(repository, serverUrl, actionToken);
+    await git(repository, ["tag", "v1.0.0"]);
+    await github.pushTag("v1.0.0");
+
+    await expectReleaseBranch(remote, repository);
+    expect(await git(remote.path, ["rev-parse", "refs/tags/v1.0.0"])).toBe(
+      await git(repository, ["rev-parse", "v1.0.0"]),
+    );
+    expectRequestsToUseToken(remote, actionToken);
+  }, 15_000);
+
+  it("uses github-token instead of credentials embedded in the push URL", async () => {
+    await using _gitConfig = await isolateGitConfig();
+    const actionToken = "action-token";
+    await using remote = await createRemote();
+    await using repositoryFixture = await shallowClone(remote.path);
+    const repository = repositoryFixture.path;
+
+    const remoteUrl = new URL(remote.url);
+    remoteUrl.username = "x-access-token";
+    remoteUrl.password = "checkout-token";
+    await git(repository, ["remote", "set-url", "origin", remoteUrl.href]);
+
+    const persistedCredentialUrl = new URL(remoteUrl);
+    persistedCredentialUrl.password = "";
+    await git(repository, [
+      "config",
+      `http.${persistedCredentialUrl.href}.extraheader`,
+      `AUTHORIZATION: ${getAuthorization("checkout-token")}`,
+    ]);
+
+    await pushChangedFile(repository, remoteUrl.origin, actionToken);
+
+    await expectReleaseBranch(remote, repository);
+    expectRequestsToUseToken(remote, actionToken);
+  }, 15_000);
+
+  it("uses the push URL when it differs from the fetch URL", async () => {
+    await using _gitConfig = await isolateGitConfig();
+    const actionToken = "action-token";
+    await using fetchRemote = await createRemote();
+    await using pushRemote = await createRemote();
+    await using repositoryFixture = await shallowClone(fetchRemote.path);
+    const repository = repositoryFixture.path;
+
+    await git(repository, ["remote", "set-url", "origin", fetchRemote.url]);
+    await git(repository, ["config", "remote.origin.pushurl", pushRemote.url]);
+
+    await pushChangedFile(
+      repository,
+      new URL(fetchRemote.url).origin,
+      actionToken,
+    );
+
+    expect(fetchRemote.requests).toEqual([]);
+    await expectReleaseBranch(pushRemote, repository);
+    expectRequestsToUseToken(pushRemote, actionToken);
+  }, 15_000);
+
+  it("uses github-token for every push URL", async () => {
+    await using _gitConfig = await isolateGitConfig();
+    const actionToken = "action-token";
+    await using firstRemote = await createRemote();
+    await using secondRemote = await createRemote();
+    await using repositoryFixture = await shallowClone(firstRemote.path);
+    const repository = repositoryFixture.path;
+
+    for (const remote of [firstRemote, secondRemote]) {
+      await git(repository, [
+        "config",
+        "--add",
+        "remote.origin.pushurl",
+        remote.url,
+      ]);
+    }
+
+    await pushChangedFile(
+      repository,
+      new URL(firstRemote.url).origin,
+      actionToken,
+    );
+
+    for (const remote of [firstRemote, secondRemote]) {
+      await expectReleaseBranch(remote, repository);
+      expectRequestsToUseToken(remote, actionToken);
+    }
+  }, 15_000);
+
+  it("preserves existing command-scoped Git config entries", async () => {
+    await using _gitConfig = await isolateGitConfig();
+    const actionToken = "action-token";
+    await using fetchRemote = await createRemote();
+    await using pushRemote = await createRemote();
+    await using repositoryFixture = await shallowClone(fetchRemote.path);
+    const repository = repositoryFixture.path;
+
+    await git(repository, ["remote", "set-url", "origin", fetchRemote.url]);
+    vi.stubEnv("GIT_CONFIG_COUNT", "1");
+    vi.stubEnv("GIT_CONFIG_KEY_0", "remote.origin.pushurl");
+    vi.stubEnv("GIT_CONFIG_VALUE_0", pushRemote.url);
+
+    await pushChangedFile(
+      repository,
+      new URL(fetchRemote.url).origin,
+      actionToken,
+    );
+
+    expect(fetchRemote.requests).toEqual([]);
+    await expectReleaseBranch(pushRemote, repository);
+    expectRequestsToUseToken(pushRemote, actionToken);
+  }, 15_000);
+});
@@ -0,0 +1,271 @@
+import { Buffer } from "node:buffer";
+import * as core from "@actions/core";
+import { exec, getExecOutput } from "@actions/exec";
+import { context } from "@actions/github";
+import { commitChangesSinceBase } from "@changesets/ghcommit";
+import { setupOctokit, type Octokit } from "./octokit.ts";
+
+type GitOptions = {
+  cwd: string;
+  env?: Record<string, string>;
+};
+
+const push = async (branch: string, options: GitOptions) => {
+  await exec("git", ["push", "origin", `HEAD:${branch}`, "--force"], options);
+};
+
+const switchToMaybeExistingBranch = async (
+  branch: string,
+  options: GitOptions,
+) => {
+  let { stderr } = await getExecOutput("git", ["checkout", branch], {
+    ignoreReturnCode: true,
+    ...options,
+  });
+  let isCreatingBranch = !stderr
+    .toString()
+    .includes(`Switched to a new branch '${branch}'`);
+  if (isCreatingBranch) {
+    await exec("git", ["checkout", "-b", branch], options);
+  }
+};
+
+const reset = async (pathSpec: string, options: GitOptions) => {
+  await exec("git", ["reset", `--hard`, pathSpec], options);
+};
+
+const commitAll = async (message: string, options: GitOptions) => {
+  await exec("git", ["add", "."], options);
+  await exec("git", ["commit", "-m", message], options);
+};
+
+const checkIfClean = async (options: GitOptions): Promise<boolean> => {
+  const { stdout } = await getExecOutput(
+    "git",
+    ["status", "--porcelain"],
+    options,
+  );
+  return !stdout.length;
+};
+
+function getHttpUrl(remoteUrl: string): string | undefined {
+  try {
+    const url = new URL(remoteUrl);
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+      return;
+    }
+
+    // Git includes the username when deciding which URL-specific config is
+    // most specific, so retain it. Password, query, and fragment do not
+    // participate in matching; strip them before copying the URL into the env.
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    return url.href;
+  } catch {
+    return;
+  }
+}
+
+export class GitHub {
+  readonly #githubToken: string;
+  readonly octokit: Octokit;
+  readonly cwd: string;
+  readonly pushWithGitCli: boolean;
+  readonly serverUrl: string;
+
+  constructor(options: {
+    githubToken: string;
+    cwd: string;
+    pushWithGitCli?: boolean;
+    serverUrl?: string;
+  }) {
+    this.#githubToken = options.githubToken;
+    this.cwd = options.cwd;
+    this.pushWithGitCli = options.pushWithGitCli ?? false;
+    this.serverUrl = (
+      options.serverUrl ??
+      context.serverUrl ??
+      process.env.GITHUB_SERVER_URL ??
+      "https://github.com"
+    ).replace(/\/+$/, "");
+    this.octokit = setupOctokit(options.githubToken);
+  }
+
+  getToken() {
+    return this.#githubToken;
+  }
+
+  async #getCliAuthEnv(): Promise<Record<string, string>> {
+    // Make `github-token` authoritative for CLI pushes without changing the
+    // repository config. Git may otherwise use checkout's persisted header or
+    // credentials embedded in a remote URL, so we need to install command-scoped
+    // `http.extraHeader` overrides for every push destination.
+    //
+    // Historical context: v1 put `github-token` in ~/.netrc, where checkout's
+    // extraheader took precedence. This setup with reset + authHeader
+    // deliberately makes `github-token` win for pushes.
+    const basic = Buffer.from(`x-access-token:${this.#githubToken}`).toString(
+      "base64",
+    );
+
+    // The environment may already contain command-scoped Git config. Append
+    // our KEY_n/VALUE_n entries so those existing settings stay active.
+    const gitConfigCount = Number(process.env.GIT_CONFIG_COUNT ?? 0);
+    if (!Number.isInteger(gitConfigCount) || gitConfigCount < 0) {
+      throw new Error(
+        `Invalid GIT_CONFIG_COUNT value: ${process.env.GIT_CONFIG_COUNT}`,
+      );
+    }
+
+    // `git push origin` prefers remote.origin.pushurl over the fetch URL and
+    // supports more than one push URL, so inspect every effective destination.
+    const { stdout } = await getExecOutput(
+      "git",
+      ["remote", "get-url", "--push", "--all", "origin"],
+      {
+        cwd: this.cwd,
+        ignoreReturnCode: true,
+        // A user-configured remote can contain credentials.
+        silent: true,
+      },
+    );
+
+    // Git reads `http.extraHeader` from the most specific matching URL section.
+    // The host key replaces checkout's usual persisted header; an exact key for
+    // each destination outranks path- or username-specific inherited config.
+    // Git selects only one URL section, so these keys do not duplicate headers.
+    const extraHeaderKeys = new Set([`http.${this.serverUrl}/.extraheader`]);
+    for (const remoteUrl of stdout.split(/\r?\n/)) {
+      const httpUrl = getHttpUrl(remoteUrl);
+      if (httpUrl !== undefined) {
+        extraHeaderKeys.add(`http.${httpUrl}.extraheader`);
+      }
+    }
+    const authHeader = `AUTHORIZATION: basic ${basic}`;
+
+    // Each URL key needs two new command-scoped config entries: one to reset
+    // the inherited header list and one to install our Authorization header.
+    const env: Record<string, string> = {
+      GIT_CONFIG_COUNT: String(gitConfigCount + extraHeaderKeys.size * 2),
+    };
+
+    // `http.extraHeader` is multi-valued, so merely appending our header could
+    // make Git send both tokens. An empty value resets inherited values; the
+    // following value adds only ours.
+    let index = 0;
+    for (const extraHeaderKey of extraHeaderKeys) {
+      const resetIndex = gitConfigCount + index * 2;
+      const authIndex = resetIndex + 1;
+      env[`GIT_CONFIG_KEY_${resetIndex}`] = extraHeaderKey;
+      env[`GIT_CONFIG_VALUE_${resetIndex}`] = "";
+      env[`GIT_CONFIG_KEY_${authIndex}`] = extraHeaderKey;
+      env[`GIT_CONFIG_VALUE_${authIndex}`] = authHeader;
+      index++;
+    }
+
+    return env;
+  }
+
+  async ensureGitUser() {
+    // Check the exact identities that Git would use for commits without
+    // allowing Git to fall back to auto-detected values like user@hostname.
+    // This covers explicit GIT_AUTHOR_* / GIT_COMMITTER_* env vars, local
+    // config, and global config. A partial identity, with only a name or only
+    // an email, does not pass this check. If either identity is missing,
+    // configure our default bot user as a fallback.
+    const authorIdentity = await getExecOutput(
+      "git",
+      ["-c", "user.useConfigOnly=true", "var", "GIT_AUTHOR_IDENT"],
+      {
+        cwd: this.cwd,
+        ignoreReturnCode: true,
+        silent: true,
+      },
+    );
+    const committerIdentity = await getExecOutput(
+      "git",
+      ["-c", "user.useConfigOnly=true", "var", "GIT_COMMITTER_IDENT"],
+      {
+        cwd: this.cwd,
+        ignoreReturnCode: true,
+        silent: true,
+      },
+    );
+    if (authorIdentity.exitCode === 0 && committerIdentity.exitCode === 0) {
+      return;
+    }
+    core.info("Setting git user to github-actions[bot]");
+    await exec("git", ["config", "user.name", `"github-actions[bot]"`], {
+      cwd: this.cwd,
+    });
+    await exec(
+      "git",
+      [
+        "config",
+        "user.email",
+        `"41898282+github-actions[bot]@users.noreply.github.com"`,
+      ],
+      {
+        cwd: this.cwd,
+      },
+    );
+  }
+
+  async pushTag(tag: string) {
+    try {
+      if (!this.pushWithGitCli) {
+        await this.octokit.rest.git.createRef({
+          ...context.repo,
+          ref: `refs/tags/${tag}`,
+          sha: context.sha,
+        });
+      } else {
+        await exec("git", ["push", "origin", tag], {
+          cwd: this.cwd,
+          env: {
+            ...process.env,
+            ...(await this.#getCliAuthEnv()),
+          } as Record<string, string>,
+        });
+      }
+    } catch (err) {
+      core.warning(
+        `Failed to create git tag "${tag}". Assuming it was manually pushed by the publish script: ${(err as Error).message}`,
+      );
+    }
+  }
+
+  async prepareBranch(branch: string) {
+    await switchToMaybeExistingBranch(branch, { cwd: this.cwd });
+    await reset(context.sha, { cwd: this.cwd });
+  }
+
+  async pushChanges({ branch, message }: { branch: string; message: string }) {
+    if (!this.pushWithGitCli) {
+      await commitChangesSinceBase({
+        octokit: this.octokit,
+        ...context.repo,
+        branch,
+        message,
+        base: {
+          commit: context.sha,
+        },
+        force: true,
+        cwd: this.cwd,
+      });
+      return;
+    }
+    if (!(await checkIfClean({ cwd: this.cwd }))) {
+      await this.ensureGitUser();
+      await commitAll(message, { cwd: this.cwd });
+    }
+    await push(branch, {
+      cwd: this.cwd,
+      env: {
+        ...process.env,
+        ...(await this.#getCliAuthEnv()),
+      } as Record<string, string>,
+    });
+  }
+}
@@ -1,59 +1,60 @@
-import fs from "node:fs/promises";
-import path from "node:path";
 import * as core from "@actions/core";
-import { Git } from "./git.ts";
-import { setupOctokit } from "./octokit.ts";
+import { GitHub } from "./github.ts";
 import readChangesetState from "./readChangesetState.ts";
 import { runPublish, runVersion } from "./run.ts";
-import { fileExists } from "./utils.ts";
+import {
+  getOptionalInput,
+  getRequiredInput,
+  throwOnRemovedCommitModeInput,
+  throwOnRenamedInputs,
+  validateChangesetsCliVersion,
+} from "./utils.ts";

-const getOptionalInput = (name: string) => core.getInput(name) || undefined;
+try {
+  await main();
+} catch (err) {
+  core.setFailed((err as Error).message);
+}

-(async () => {
-  // to maintain compatibility with workflows created before github-token input was introduced
-  // it's important to prefer the explicitly set GITHUB_TOKEN over the default token coming from github.token
-  let githubToken = process.env.GITHUB_TOKEN || core.getInput("github-token");
+async function main() {
+  const cwd = getOptionalInput("cwd") || process.cwd();
+  await validateChangesetsCliVersion(cwd);

-  if (!githubToken) {
-    core.setFailed("Please add the GITHUB_TOKEN to the changesets action");
-    return;
-  }
-
-  // If the user needs to change the cwd, set `working-directory` in the step instead
-  const cwd = process.cwd();
-
-  const octokit = setupOctokit(githubToken);
-  const commitMode = getOptionalInput("commitMode") ?? "git-cli";
-  const prDraft = getOptionalInput("prDraft");
-  if (commitMode !== "git-cli" && commitMode !== "github-api") {
-    core.setFailed(`Invalid commit mode: ${commitMode}`);
-    return;
-  }
-  if (prDraft !== undefined && prDraft !== "always" && prDraft !== "create") {
-    core.setFailed(`Invalid prDraft: ${prDraft}`);
-    return;
-  }
-  const git = new Git({
-    octokit: commitMode === "github-api" ? octokit : undefined,
-    cwd,
+  throwOnRenamedInputs({
+    publish: "publish-script",
+    version: "version-script",
+    commit: "commit-message",
+    title: "pr-title",
+    branch: "pr-base-branch",
+    prDraft: "pr-draft",
+    createGithubReleases: "create-github-releases",
  });
+  throwOnRemovedCommitModeInput();

-  let setupGitUser = core.getBooleanInput("setupGitUser");
-
-  if (setupGitUser) {
-    core.info("setting git user");
-    await git.setupUser();
+  const githubToken = getRequiredInput("github-token");
+  if (process.env.GITHUB_TOKEN && process.env.GITHUB_TOKEN !== githubToken) {
+    throw new Error(
+      'The GITHUB_TOKEN environment variable is set and does not match the "github-token" input. ' +
+        'Please pass the custom GitHub token to the "github-token" input and ' +
+        "remove the GITHUB_TOKEN environment variable to avoid conflicts.",
+    );
  }

-  core.info("setting GitHub credentials");
-  await fs.writeFile(
-    `${process.env.HOME}/.netrc`,
-    `machine github.com\nlogin github-actions[bot]\npassword ${githubToken}`,
-  );
+  const pushWithGitCli = core.getBooleanInput("push-with-git-cli");
+  const prDraft = getOptionalInput("pr-draft");
+  if (prDraft !== undefined && prDraft !== "always" && prDraft !== "create") {
+    core.setFailed(`Invalid pr-draft: ${prDraft}`);
+    return;
+  }
+  const github = new GitHub({
+    cwd,
+    githubToken,
+    pushWithGitCli,
+  });

  let { changesets } = await readChangesetState(cwd);

-  let publishScript = core.getInput("publish");
+  let publishScript = core.getInput("publish-script");
  let hasChangesets = changesets.length !== 0;
  const hasNonEmptyChangesets = changesets.some(
    (changeset) => changeset.releases.length > 0,
@@ -61,13 +62,13 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
  let hasPublishScript = !!publishScript;

  core.setOutput("published", "false");
-  core.setOutput("publishedPackages", "[]");
-  core.setOutput("hasChangesets", String(hasChangesets));
+  core.setOutput("published-packages", "[]");
+  core.setOutput("has-changesets", String(hasChangesets));

  switch (true) {
    case !hasChangesets && !hasPublishScript:
      core.info(
-        "No changesets present or were removed by merging release PR. Not publishing because no publish script found.",
+        "No changesets present or were removed by merging version PR. Not publishing because publish-script is not set.",
      );
      return;
    case !hasChangesets && hasPublishScript: {
@@ -75,70 +76,35 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
        "No changesets found. Attempting to publish any unpublished packages to npm",
      );

-      if (process.env.NPM_TOKEN) {
-        const userNpmrcPath = `${process.env.HOME}/.npmrc`;
-
-        if (await fileExists(userNpmrcPath)) {
-          core.info("Found existing user .npmrc file");
-          const userNpmrcContent = await fs.readFile(userNpmrcPath, "utf8");
-          const authLine = userNpmrcContent.split("\n").find((line) => {
-            // check based on https://github.com/npm/cli/blob/8f8f71e4dd5ee66b3b17888faad5a7bf6c657eed/test/lib/adduser.js#L103-L105
-            return /^\s*\/\/registry\.npmjs\.org\/:[_-]authToken=/i.test(line);
-          });
-          if (authLine) {
-            core.info(
-              "Found existing auth token for the npm registry in the user .npmrc file",
-            );
-          } else {
-            core.info(
-              "Didn't find existing auth token for the npm registry in the user .npmrc file, creating one",
-            );
-            await fs.appendFile(
-              userNpmrcPath,
-              `\n//registry.npmjs.org/:_authToken=${process.env.NPM_TOKEN}\n`,
-            );
-          }
-        } else {
-          core.info(
-            "No user .npmrc file found, creating one with NPM_TOKEN used as auth token",
-          );
-          await fs.writeFile(
-            userNpmrcPath,
-            `//registry.npmjs.org/:_authToken=${process.env.NPM_TOKEN}\n`,
-          );
-        }
-      } else if (
-        process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN &&
-        process.env.ACTIONS_ID_TOKEN_REQUEST_URL
-      ) {
-        core.info(
-          "No NPM_TOKEN found, but OIDC is available - using npm trusted publishing",
-        );
-      } else {
-        core.info(
-          "No NPM_TOKEN or OIDC available - assuming npm is already authenticated",
+      const createGithubReleases = core.getBooleanInput(
+        "create-github-releases",
+      );
+      const pushGitTags = core.getBooleanInput("push-git-tags");
+      if (createGithubReleases && !pushGitTags) {
+        throw new Error(
+          "The input 'create-github-releases' is set to true, but 'push-git-tags' is set to false. " +
+            "Creating GitHub releases requires pushing git tags. Please set 'push-git-tags' to true " +
+            "or set 'create-github-releases' to false.",
        );
      }
-
      const result = await runPublish({
        script: publishScript,
-        githubToken,
-        git,
-        octokit,
-        createGithubReleases: core.getBooleanInput("createGithubReleases"),
+        github,
+        createGithubReleases,
+        pushGitTags,
        cwd,
      });

      if (result.published) {
        core.setOutput("published", "true");
        core.setOutput(
-          "publishedPackages",
+          "published-packages",
          JSON.stringify(result.publishedPackages),
        );
      }

      if (result.exitCode !== 0) {
-        core.error(
+        throw new Error(
          `Publish command exited with code ${result.exitCode}${
            result.published
              ? `, but some packages were published: ${result.publishedPackages
@@ -147,34 +113,27 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
              : ""
          }`,
        );
-        process.exit(result.exitCode);
      }
      return;
    }
    case hasChangesets && !hasNonEmptyChangesets:
-      core.info("All changesets are empty; not creating PR");
+      core.info("All changesets are empty. Not creating PR");
      return;
    case hasChangesets: {
-      const octokit = setupOctokit(githubToken);
      const { pullRequestNumber } = await runVersion({
-        script: getOptionalInput("version"),
-        githubToken,
-        git,
-        octokit,
+        script: getOptionalInput("version-script"),
+        github,
        cwd,
-        prTitle: getOptionalInput("title"),
-        commitMessage: getOptionalInput("commit"),
+        prTitle: getOptionalInput("pr-title"),
+        commitMessage: getOptionalInput("commit-message"),
        hasPublishScript,
        prDraft,
-        branch: getOptionalInput("branch"),
+        branch: getOptionalInput("pr-base-branch"),
      });

-      core.setOutput("pullRequestNumber", String(pullRequestNumber));
+      core.setOutput("pr-number", String(pullRequestNumber));

      return;
    }
  }
-})().catch((err) => {
-  core.error(err);
-  core.setFailed(err.message);
-});
+}
@@ -3,7 +3,12 @@ import os from "node:os";
 import path from "node:path";
 import artifact from "@actions/artifact";
 import * as core from "@actions/core";
-import { downloadArtifact, execChangesetsCli } from "../utils.ts";
+import {
+  downloadArtifact,
+  execChangesetsCli,
+  getOptionalInput,
+  validateChangesetsCliVersion,
+} from "../utils.ts";

 try {
  await main();
@@ -12,10 +17,11 @@ try {
 }

 async function main() {
-  const publishPlanArtifactId = core.getInput("publish-plan-artifact-id");
+  const cwd = getOptionalInput("cwd") || process.cwd();
+  await validateChangesetsCliVersion(cwd);
+
+  const publishPlanArtifactId = getOptionalInput("publish-plan-artifact-id");

-  // If the user needs to change the cwd, set `working-directory` in the step instead
-  const cwd = process.cwd();
  const tmpDir = process.env.RUNNER_TEMP ?? (await fs.realpath(os.tmpdir()));
  const outDir = path.join(tmpDir, `changeset-pack-${Date.now()}`);

@@ -49,7 +55,7 @@ async function pack(
 ) {
  const cliArgs = ["pack", "--out-dir", args.outDir];
  if (args.publishPlanPath) {
-    cliArgs.push("--from-plan", args.publishPlanPath);
+    cliArgs.push("--from-publish-plan", args.publishPlanPath);
  }

  await execChangesetsCli(cliArgs, {
@@ -1,5 +1,6 @@
 import * as core from "@actions/core";
 import * as github from "@actions/github";
+import { getOptionalInput, getRequiredInput } from "../utils.ts";

 type Octokit = ReturnType<typeof github.getOctokit>;
 type CreateCommentParams = NonNullable<
@@ -23,9 +24,9 @@ async function main() {
    );
  }

-  const githubToken = core.getInput("github-token", { required: true });
-  const body = core.getInput("body", { required: true });
-  const updateId = core.getInput("update-id");
+  const githubToken = getRequiredInput("github-token");
+  const body = getRequiredInput("body");
+  const updateId = getOptionalInput("update-id");

  const commentMarker = updateId ? getCommentMarker(updateId) : null;
  const commentBody = commentMarker ? `${commentMarker}\n\n${body}` : body;
@@ -1,5 +1,5 @@
 import * as github from "@actions/github";
-import getReleasePlan from "@changesets/get-release-plan";
+import { getReleasePlan } from "@changesets/get-release-plan";
 import type {
  ComprehensiveRelease,
  ReleasePlan,
@@ -53,7 +53,7 @@ Latest commit: ${commitSha}

 ${getReleasePlanMessage(releasePlan)}

-Not sure what this means? [Click here to learn what changesets are](https://github.com/changesets/changesets/blob/main/docs/adding-a-changeset.md).
+Not sure what this means? [Click here to learn what changesets are](https://changesets.dev/faq).

 [Click here if you're a maintainer who wants to add another changeset to this PR](${newChangesetUrl})`;
 }
@@ -72,7 +72,7 @@ Merging this PR will not cause a version bump for any packages. If these changes

 ${getReleasePlanMessage(releasePlan)}

-[Click here to learn what changesets are, and how to add one](https://github.com/changesets/changesets/blob/main/docs/adding-a-changeset.md).
+[Click here to learn what changesets are, and how to add one](https://changesets.dev/faq).

 [Click here if you're a maintainer who wants to add a changeset to this PR](${newChangesetUrl})`;
 }
@@ -1,9 +1,9 @@
 import { pathToFileURL } from "node:url";
 import type * as github from "@actions/github";
-import getReleasePlan from "@changesets/get-release-plan";
-import { createFixture } from "fs-fixture";
+import { getReleasePlan } from "@changesets/get-release-plan";
 import { exec } from "tinyexec";
 import { describe, expect, it } from "vitest";
+import { gitdir, shallowClone, testdir } from "../test-utils.ts";
 import { getPullRequestWorktree } from "./worktree.ts";

 type PullRequestContext = NonNullable<
@@ -21,59 +21,47 @@ async function git(cwd: string, args: string[]) {
 describe("getPullRequestWorktree", () => {
  it("fetches a PR branch into a detached worktree and keeps the main checkout untouched", async () => {
    // Local source repo
-    await using sourceRepoFixture = await createFixture({
+    await using sourceRepoFixture = await gitdir({
      ".changeset/config.json": JSON.stringify({}),
      "package.json": JSON.stringify({
        name: "repo",
        private: true,
        workspaces: ["packages/*"],
      }),
+      "package-lock.json": "",
      "packages/pkg-a/package.json": JSON.stringify({
        name: "pkg-a",
        version: "1.0.0",
      }),
    });
    const sourceRepo = sourceRepoFixture.path;
-    await git(sourceRepo, ["init", "-b", "main"]);
-    await git(sourceRepo, ["config", "user.name", "Test User"]);
-    await git(sourceRepo, ["config", "user.email", "test@example.com"]);
-    await git(sourceRepo, ["add", "."]);
-    await git(sourceRepo, ["commit", "-m", "base"]);

    // Simulate remote bare git server
-    await using originBareFixture = await createFixture();
+    await using originBareFixture = await testdir();
    const originBare = originBareFixture.path;
-    await git(originBare, ["clone", "--bare", sourceRepo, originBare]);
+    await git(originBare, [
+      "clone",
+      "--bare",
+      pathToFileURL(sourceRepo).toString(),
+      ".",
+    ]);

    // Simulate checkout PR in github action
-    await using checkoutRepoFixture = await createFixture();
+    await using checkoutRepoFixture = await shallowClone(originBare);
    const checkoutRepo = checkoutRepoFixture.path;
-    await git(checkoutRepo, [
-      "clone",
-      "--depth",
-      "1",
-      "--branch",
-      "main",
-      pathToFileURL(originBare).toString(),
-      checkoutRepo,
-    ]);

    // Simulate remote fork bare git server
-    await using forkBareFixture = await createFixture();
+    await using forkBareFixture = await testdir();
    const forkBare = forkBareFixture.path;
-    await git(forkBare, ["clone", "--bare", originBare, forkBare]);
-
-    await using forkRepoFixture = await createFixture();
-    const forkRepo = forkRepoFixture.path;
-    await git(forkRepo, [
+    await git(forkBare, [
      "clone",
-      "--depth",
-      "1",
-      "--branch",
-      "main",
-      pathToFileURL(forkBare).toString(),
-      forkRepo,
+      "--bare",
+      pathToFileURL(originBare).toString(),
+      ".",
    ]);
+
+    await using forkRepoFixture = await shallowClone(forkBare);
+    const forkRepo = forkRepoFixture.path;
    await git(forkRepo, ["config", "user.name", "Test User"]);
    await git(forkRepo, ["config", "user.email", "test@example.com"]);
    await git(forkRepo, ["checkout", "-b", "feature"]);
@@ -5,6 +5,7 @@ import path from "node:path";
 import type * as github from "@actions/github";
 import { isRepoShallow } from "@changesets/git";
 import { exec } from "tinyexec";
+import { moveDisposable, type WithAsyncDispose } from "../utils.ts";

 type PullRequestContext = NonNullable<
  typeof github.context.payload.pull_request
@@ -122,22 +123,6 @@ async function tempWorktree(cwd: string, dir: string, ref: Ref) {
  };
 }

-type WithAsyncDispose<T> = T & {
-  [Symbol.asyncDispose](): Promise<void>;
-};
-
-function moveDisposable<T extends object>(
-  stack: AsyncDisposableStack,
-  value: T,
-): WithAsyncDispose<T> {
-  const moved = stack.move();
-  return Object.assign(value, {
-    async [Symbol.asyncDispose]() {
-      await moved.disposeAsync();
-    },
-  });
-}
-
 export async function getPullRequestWorktree(
  context: PullRequestContext,
  cwd: string = process.cwd(),
@@ -1,10 +1,14 @@
 import fs from "node:fs/promises";
 import os from "node:os";
 import * as core from "@actions/core";
-import { Git } from "../git.ts";
-import { setupOctokit } from "../octokit.ts";
+import { GitHub } from "../github.ts";
 import { runPublish } from "../run.ts";
-import { downloadArtifact } from "../utils.ts";
+import {
+  downloadArtifact,
+  getOptionalInput,
+  getRequiredInput,
+  validateChangesetsCliVersion,
+} from "../utils.ts";

 try {
  await main();
@@ -13,17 +17,25 @@ try {
 }

 async function main() {
-  const githubToken = core.getInput("github-token", { required: true });
-  const script = core.getInput("script");
-  const packDirArtifactId = core.getInput("pack-dir-artifact-id");
+  const cwd = getOptionalInput("cwd") || process.cwd();
+  await validateChangesetsCliVersion(cwd);
+
+  const githubToken = getRequiredInput("github-token");
+  const script = getOptionalInput("script");
+  const packDirArtifactId = getOptionalInput("pack-dir-artifact-id");
  const createGithubReleases = core.getBooleanInput("create-github-releases");
+  const pushGitTags = core.getBooleanInput("push-git-tags");

-  // If the user needs to change the cwd, set `working-directory` in the step instead
-  const cwd = process.cwd();
+  if (createGithubReleases && !pushGitTags) {
+    throw new Error(
+      "The input 'create-github-releases' is set to true, but 'push-git-tags' is set to false. " +
+        "Creating GitHub releases requires pushing git tags. Please set 'push-git-tags' to true " +
+        "or set 'create-github-releases' to false.",
+    );
+  }

-  const octokit = setupOctokit(githubToken);
-  // NOTE: Always pass octokit here as publish does not need a commit-mode
-  const git = new Git({ octokit, cwd });
+  // The publish sub-action always uses the GitHub API for tag pushes.
+  const github = new GitHub({ cwd, githubToken });

  const fromPackDir = packDirArtifactId
    ? await downloadArtifact(
@@ -35,10 +47,9 @@ async function main() {

  const result = await runPublish({
    script,
-    githubToken,
-    git,
-    octokit,
+    github,
    createGithubReleases,
+    pushGitTags,
    cwd,
    fromPackDir,
  });
@@ -0,0 +1,40 @@
+import { createFixture } from "fs-fixture";
+import { describe, expect, it } from "vitest";
+import readChangesetState from "./readChangesetState.ts";
+
+const changeset = `---
+"pkg-a": patch
+---
+
+Fix a bug.
+`;
+
+describe("readChangesetState", () => {
+  it("filters versioned changesets in prerelease mode", async () => {
+    await using fixture = await createFixture({
+      ".changeset/pre.json": JSON.stringify({ mode: "pre", tag: "next" }),
+      ".changeset/pre/versioned.md": changeset,
+      ".changeset/pending.md": changeset,
+    });
+
+    const state = await readChangesetState(fixture.path);
+
+    expect(state.changesets.map((changeset) => changeset.id)).toEqual([
+      "pending",
+    ]);
+  });
+
+  it("includes versioned changesets when exiting prerelease mode", async () => {
+    await using fixture = await createFixture({
+      ".changeset/pre.json": JSON.stringify({ mode: "exit", tag: "next" }),
+      ".changeset/pre/versioned.md": changeset,
+    });
+
+    const state = await readChangesetState(fixture.path);
+
+    expect(state.preState).toBeUndefined();
+    expect(state.changesets.map((changeset) => changeset.id)).toEqual([
+      "pre/versioned",
+    ]);
+  });
+});
@@ -1,5 +1,5 @@
 import { readPreState } from "@changesets/pre";
-import readChangesets from "@changesets/read";
+import { readChangesets } from "@changesets/read";
 import type { PreState, NewChangeset } from "@changesets/types";

 export type ChangesetState = {
@@ -14,11 +14,11 @@ export default async function readChangesetState(
  let changesets = await readChangesets(cwd);

  if (preState !== undefined && preState.mode === "pre") {
-    let changesetsToFilter = new Set(preState.changesets);
-
    return {
      preState,
-      changesets: changesets.filter((x) => !changesetsToFilter.has(x.id)),
+      changesets: changesets.filter(
+        (changeset) => !changeset.id.startsWith("pre/"),
+      ),
    };
  }

@@ -1,11 +1,13 @@
 import path from "node:path";
+import * as core from "@actions/core";
+import * as github from "@actions/github";
 import type { Changeset } from "@changesets/types";
-import writeChangeset from "@changesets/write";
-import { createFixture } from "fs-fixture";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-import { Git } from "./git.ts";
-import { setupOctokit } from "./octokit.ts";
-import { runVersion } from "./run.ts";
+import { writeChangeset } from "@changesets/write";
+import { exec } from "tinyexec";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { GitHub } from "./github.ts";
+import { runPublish, runVersion } from "./run.ts";
+import { gitdir } from "./test-utils.ts";

 vi.mock("@actions/github", () => ({
  context: {
@@ -21,8 +23,13 @@ vi.mock("@actions/github", () => ({
    graphql: mockedGraphql,
  }),
 }));
-vi.mock("./git.ts");
-vi.mock("@changesets/ghcommit/git");
+vi.mock("@actions/core", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@actions/core")>()),
+  error: vi.fn(),
+  notice: vi.fn(),
+  warning: vi.fn(),
+}));
+vi.mock("@changesets/ghcommit");

 let mockedGithubMethods = {
  pulls: {
@@ -38,7 +45,7 @@ let mockedGraphql = vi.fn();
 const nodeModulesDir = path.join(import.meta.dirname, "..", "node_modules");

 function createSimpleProjectFixture() {
-  return createFixture({
+  return gitdir({
    node_modules: (api) => api.symlink(nodeModulesDir),
    ".changeset/config.json": JSON.stringify({}),
    "packages/pkg-a/package.json": JSON.stringify({
@@ -58,11 +65,12 @@ function createSimpleProjectFixture() {
      private: true,
      workspaces: ["packages/*"],
    }),
+    "package-lock.json": "",
  });
 }

 function createIgnoredPackageFixture() {
-  return createFixture({
+  return gitdir({
    node_modules: (api) => api.symlink(nodeModulesDir),
    ".changeset/config.json": JSON.stringify({
      ignore: ["changesets-dev-ignored-package-pkg-a"],
@@ -84,6 +92,7 @@ function createIgnoredPackageFixture() {
      private: true,
      workspaces: ["packages/*"],
    }),
+    "package-lock.json": "",
  });
 }

@@ -91,14 +100,89 @@ const writeChangesets = (changesets: Changeset[], cwd: string) => {
  return Promise.all(changesets.map((commit) => writeChangeset(commit, cwd)));
 };

+const createGithub = (cwd: string) =>
+  new GitHub({
+    cwd,
+    githubToken: "@@GITHUB_TOKEN",
+    pushWithGitCli: false,
+  });
+
+async function updateGithubContext(cwd: string) {
+  const head = await exec("git", ["rev-parse", "HEAD"], {
+    nodeOptions: { cwd },
+  });
+  github.context.sha = head.stdout.trim();
+}
+
+function resetGithubContext() {
+  github.context.sha = "xeac7";
+}
+
 beforeEach(() => {
  vi.clearAllMocks();
+  resetGithubContext();
+});
+
+afterEach(() => {
+  vi.unstubAllEnvs();
+});
+
+describe("publish", () => {
+  it("warns when a custom publish script does not create the output file", async () => {
+    await using fixture = await createSimpleProjectFixture();
+    const cwd = fixture.path;
+    await updateGithubContext(cwd);
+    vi.stubEnv("RUNNER_TEMP", cwd);
+
+    const result = await runPublish({
+      script: 'node -e "void 0"',
+      github: createGithub(cwd),
+      createGithubReleases: true,
+      pushGitTags: true,
+      cwd,
+    });
+
+    expect(result).toEqual({ published: false, exitCode: 0 });
+    expect(core.warning).toHaveBeenCalledWith(
+      expect.stringContaining(
+        "GitHub releases and git tags cannot be created without this output",
+      ),
+    );
+  });
+
+  it("throws when the built-in publish command does not create the output file", async () => {
+    await using fixture = await gitdir({
+      "node_modules/@changesets/cli/package.json": JSON.stringify({
+        name: "@changesets/cli",
+        type: "module",
+      }),
+      "node_modules/@changesets/cli/bin.js": "",
+      "package.json": JSON.stringify({
+        name: "simple-project",
+        version: "1.0.0",
+      }),
+      "package-lock.json": "",
+    });
+    const cwd = fixture.path;
+    await updateGithubContext(cwd);
+    vi.stubEnv("RUNNER_TEMP", cwd);
+
+    await expect(
+      runPublish({
+        github: createGithub(cwd),
+        createGithubReleases: true,
+        pushGitTags: true,
+        cwd,
+      }),
+    ).rejects.toThrow("Failed to read changesets output at");
+  });
 });

 describe("version", () => {
  it("creates simple PR", async () => {
    await using fixture = await createSimpleProjectFixture();
    const cwd = fixture.path;
+    await updateGithubContext(cwd);

    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({ data: [] }));

@@ -126,9 +210,7 @@ describe("version", () => {
    );

    await runVersion({
-      octokit: setupOctokit("@@GITHUB_TOKEN"),
-      githubToken: "@@GITHUB_TOKEN",
-      git: new Git({ cwd }),
+      github: createGithub(cwd),
      cwd,
    });

@@ -138,6 +220,7 @@ describe("version", () => {
  it('creates a draft PR when prDraft is "create"', async () => {
    await using fixture = await createSimpleProjectFixture();
    const cwd = fixture.path;
+    await updateGithubContext(cwd);

    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({ data: [] }));

@@ -161,9 +244,7 @@ describe("version", () => {
    );

    await runVersion({
-      octokit: setupOctokit("@@GITHUB_TOKEN"),
-      githubToken: "@@GITHUB_TOKEN",
-      git: new Git({ cwd }),
+      github: createGithub(cwd),
      cwd,
      prDraft: "create",
    });
@@ -174,6 +255,7 @@ describe("version", () => {
  it("only includes bumped packages in the PR body", async () => {
    await using fixture = await createSimpleProjectFixture();
    const cwd = fixture.path;
+    await updateGithubContext(cwd);

    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({ data: [] }));

@@ -197,9 +279,7 @@ describe("version", () => {
    );

    await runVersion({
-      octokit: setupOctokit("@@GITHUB_TOKEN"),
-      githubToken: "@@GITHUB_TOKEN",
-      git: new Git({ cwd }),
+      github: createGithub(cwd),
      cwd,
    });

@@ -209,6 +289,7 @@ describe("version", () => {
  it("doesn't include ignored package that got a dependency update in the PR body", async () => {
    await using fixture = await createIgnoredPackageFixture();
    const cwd = fixture.path;
+    await updateGithubContext(cwd);

    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({ data: [] }));

@@ -232,9 +313,7 @@ describe("version", () => {
    );

    await runVersion({
-      octokit: setupOctokit("@@GITHUB_TOKEN"),
-      githubToken: "@@GITHUB_TOKEN",
-      git: new Git({ cwd }),
+      github: createGithub(cwd),
      cwd,
    });

@@ -244,6 +323,7 @@ describe("version", () => {
  it("does not include changelog entries if full message exceeds size limit", async () => {
    await using fixture = await createSimpleProjectFixture();
    const cwd = fixture.path;
+    await updateGithubContext(cwd);

    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({ data: [] }));

@@ -287,9 +367,7 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
    );

    await runVersion({
-      octokit: setupOctokit("@@GITHUB_TOKEN"),
-      githubToken: "@@GITHUB_TOKEN",
-      git: new Git({ cwd }),
+      github: createGithub(cwd),
      cwd,
      prBodyMaxCharacters: 1000,
    });
@@ -303,6 +381,7 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
  it("does not include any release information if a message with simplified release info exceeds size limit", async () => {
    await using fixture = await createSimpleProjectFixture();
    const cwd = fixture.path;
+    await updateGithubContext(cwd);

    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({ data: [] }));

@@ -346,9 +425,7 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
    );

    await runVersion({
-      octokit: setupOctokit("@@GITHUB_TOKEN"),
-      githubToken: "@@GITHUB_TOKEN",
-      git: new Git({ cwd }),
+      github: createGithub(cwd),
      cwd,
      prBodyMaxCharacters: 500,
    });
@@ -362,6 +439,7 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
  it('updates an existing PR via GraphQL without converting it to draft when prDraft is "create"', async () => {
    await using fixture = await createSimpleProjectFixture();
    const cwd = fixture.path;
+    await updateGithubContext(cwd);

    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({
      data: [{ number: 123, node_id: "PR_kwDOA" }],
@@ -383,9 +461,7 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
    );

    await runVersion({
-      octokit: setupOctokit("@@GITHUB_TOKEN"),
-      githubToken: "@@GITHUB_TOKEN",
-      git: new Git({ cwd }),
+      github: createGithub(cwd),
      cwd,
      prDraft: "create",
    });
@@ -396,6 +472,7 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
  it('updates an existing PR via GraphQL and converts it to draft when prDraft is "always"', async () => {
    await using fixture = await createSimpleProjectFixture();
    const cwd = fixture.path;
+    await updateGithubContext(cwd);

    mockedGithubMethods.pulls.list.mockImplementationOnce(() => ({
      data: [{ number: 123, node_id: "PR_kwDOA" }],
@@ -417,9 +494,7 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
    );

    await runVersion({
-      octokit: setupOctokit("@@GITHUB_TOKEN"),
-      githubToken: "@@GITHUB_TOKEN",
-      git: new Git({ cwd }),
+      github: createGithub(cwd),
      cwd,
      prDraft: "always",
    });
@@ -1,4 +1,6 @@
+import { randomUUID } from "node:crypto";
 import fs from "node:fs/promises";
+import os from "node:os";
 import path from "node:path";
 import * as core from "@actions/core";
 import {
@@ -7,10 +9,10 @@ import {
  type ExecOptions,
  type ExecOutput,
 } from "@actions/exec";
-import * as github from "@actions/github";
+import { context } from "@actions/github";
 import type { PreState } from "@changesets/types";
 import { type Package, getPackages } from "@manypkg/get-packages";
-import { Git } from "./git.ts";
+import type { GitHub } from "./github.ts";
 import type { Octokit } from "./octokit.ts";
 import readChangesetState from "./readChangesetState.ts";
 import {
@@ -57,21 +59,27 @@ const createRelease = async (
    tag_name: tagName,
    body: changelogEntry.content,
    prerelease: pkg.packageJson.version.includes("-"),
-    ...github.context.repo,
+    ...context.repo,
  });
 };

 type PublishOptions = {
  script?: string;
  fromPackDir?: string;
-  githubToken: string;
-  octokit: Octokit;
  createGithubReleases: boolean;
-  git: Git;
+  pushGitTags: boolean;
+  github: GitHub;
  cwd: string;
 };

 type PublishedPackage = { name: string; version: string };
+type ChangesetsOutputEvent = {
+  type: "git-tag";
+  tag: string;
+  packageName: string;
+};
+
+class ChangesetsOutputReadError extends Error {}

 type PublishResult =
  | {
@@ -84,20 +92,95 @@ type PublishResult =
      exitCode: number;
    };

+function isObject(value: unknown) {
+  return typeof value === "object" && value !== null;
+}
+
+function isChangesetsOutputEvent(
+  value: unknown,
+): value is ChangesetsOutputEvent {
+  return (
+    isObject(value) &&
+    "type" in value &&
+    value.type === "git-tag" &&
+    "tag" in value &&
+    typeof value.tag === "string" &&
+    "packageName" in value &&
+    typeof value.packageName === "string"
+  );
+}
+
+async function readChangesetsOutput(outputPath: string) {
+  let rawOutput: string;
+  try {
+    rawOutput = await fs.readFile(outputPath, "utf8");
+  } catch (err) {
+    throw new ChangesetsOutputReadError(
+      `Failed to read changesets output at ${outputPath}`,
+      { cause: err },
+    );
+  }
+
+  const events: ChangesetsOutputEvent[] = [];
+
+  let lineStart = 0;
+  while (lineStart <= rawOutput.length) {
+    let lineEnd = rawOutput.indexOf("\n", lineStart);
+    if (lineEnd === -1) {
+      lineEnd = rawOutput.length;
+    }
+    const line = rawOutput.slice(lineStart, lineEnd);
+    lineStart = lineEnd + 1;
+
+    if (/^\s*$/.test(line)) {
+      continue;
+    }
+
+    let event: unknown;
+    try {
+      event = JSON.parse(line);
+    } catch (err) {
+      throw new Error(`Failed to parse changesets output event: ${line}`, {
+        cause: err,
+      });
+    }
+
+    if (!isChangesetsOutputEvent(event)) {
+      continue;
+    }
+
+    events.push(event);
+  }
+
+  return events;
+}
+
 export async function runPublish({
  script,
  fromPackDir,
-  githubToken,
-  git,
-  octokit,
+  github,
  createGithubReleases,
+  pushGitTags,
  cwd,
 }: PublishOptions): Promise<PublishResult> {
+  const { octokit } = github;
+  // Changesets creates annotated tags locally, including when the action pushes those tags through the GitHub API.
+  // It might also be important for custom publish scripts to have a valid git user configured.
+  await github.ensureGitUser();
+
  let changesetPublishOutput: ExecOutput;
+  const outputFile = path.join(
+    process.env.RUNNER_TEMP ?? (await fs.realpath(os.tmpdir())),
+    `changesets-output-${randomUUID()}.ndjson`,
+  );
  const execOptions: ExecOptions = {
    cwd,
    ignoreReturnCode: true,
-    env: { ...process.env, GITHUB_TOKEN: githubToken },
+    env: {
+      ...process.env,
+      GITHUB_TOKEN: github.getToken(),
+      CHANGESETS_OUTPUT: outputFile,
+    },
  };

  if (script) {
@@ -118,66 +201,54 @@ export async function runPublish({
  }

  let { packages, tool } = await getPackages(cwd);
-  let releasedPackages: Package[] = [];
-
-  if (tool !== "root") {
-    let newTagRegex = /New tag:\s+(@[^/]+\/[^@]+|[^/]+)@([^\s]+)/;
-    let packagesByName = new Map(packages.map((x) => [x.packageJson.name, x]));
-
-    for (let line of changesetPublishOutput.stdout.split("\n")) {
-      let match = line.match(newTagRegex);
-      if (match === null) {
-        continue;
-      }
-      let pkgName = match[1];
-      let pkg = packagesByName.get(pkgName);
-      if (pkg === undefined) {
-        throw new Error(
-          `Package "${pkgName}" not found.` +
-            "This is probably a bug in the action, please open an issue",
-        );
-      }
-      releasedPackages.push(pkg);
+  let packagesByName = new Map(packages.map((x) => [x.packageJson.name, x]));
+  let output: ChangesetsOutputEvent[];
+  try {
+    output = await readChangesetsOutput(outputFile);
+  } catch (err) {
+    if (!script || !(err instanceof ChangesetsOutputReadError)) {
+      throw err;
    }
-
-    if (createGithubReleases) {
-      await Promise.all(
-        releasedPackages.map(async (pkg) => {
-          const tagName = `${pkg.packageJson.name}@${pkg.packageJson.version}`;
-          await git.pushTag(tagName);
-          await createRelease(octokit, { pkg, tagName });
-        }),
-      );
-    }
-  } else {
-    if (packages.length === 0) {
+    core.warning(
+      `${err.message}. GitHub releases and git tags cannot be created without this output. Ensure the custom publish script passes CHANGESETS_OUTPUT to the Changesets CLI.`,
+    );
+    output = [];
+  }
+  let releases = output.map((event) => {
+    let pkg = packagesByName.get(event.packageName);
+    if (pkg === undefined) {
      throw new Error(
-        `No package found.` +
+        `Package "${event.packageName}" not found.` +
          "This is probably a bug in the action, please open an issue",
      );
    }
-    let pkg = packages[0];
-    let newTagRegex = /New tag:/;
+    return { pkg, tag: event.tag };
+  });

-    for (let line of changesetPublishOutput.stdout.split("\n")) {
-      let match = line.match(newTagRegex);
-
-      if (match) {
-        releasedPackages.push(pkg);
-        if (createGithubReleases) {
-          const tagName = `v${pkg.packageJson.version}`;
-          await git.pushTag(tagName);
-          await createRelease(octokit, { pkg, tagName });
-        }
-        break;
-      }
-    }
+  if (tool.type === "root" && packages.length === 0) {
+    throw new Error(
+      `No package found.` +
+        "This is probably a bug in the action, please open an issue",
+    );
  }

-  if (releasedPackages.length) {
+  if (createGithubReleases || pushGitTags) {
+    await Promise.all(
+      releases.map(async ({ pkg, tag }) => {
+        if (pushGitTags) {
+          await github.pushTag(tag);
+        }
+        if (createGithubReleases) {
+          await createRelease(octokit, { pkg, tagName: tag });
+        }
+      }),
+    );
+  }
+
+  if (releases.length) {
    return {
      published: true,
-      publishedPackages: releasedPackages.map((pkg) => ({
+      publishedPackages: releases.map(({ pkg }) => ({
        name: pkg.packageJson.name,
        version: pkg.packageJson.version,
      })),
@@ -259,9 +330,7 @@ export async function getVersionPrBody({

 type VersionOptions = {
  script?: string;
-  githubToken: string;
-  git: Git;
-  octokit: Octokit;
+  github: GitHub;
  cwd?: string;
  prTitle?: string;
  commitMessage?: string;
@@ -277,26 +346,25 @@ type RunVersionResult = {

 export async function runVersion({
  script,
-  githubToken,
-  git,
-  octokit,
+  github,
  cwd = process.cwd(),
  prTitle = "Version Packages",
  commitMessage = "Version Packages",
  hasPublishScript = false,
  prBodyMaxCharacters = MAX_CHARACTERS_PER_MESSAGE,
-  branch = github.context.ref.replace("refs/heads/", ""),
+  branch = context.ref.replace("refs/heads/", ""),
  prDraft,
 }: VersionOptions): Promise<RunVersionResult> {
+  const { octokit } = github;
  let versionBranch = `changeset-release/${branch}`;

  let { preState } = await readChangesetState(cwd);

-  await git.prepareBranch(versionBranch);
+  await github.prepareBranch(versionBranch);

  let versionsByDirectory = await getVersionsByDirectory(cwd);

-  const env = { ...process.env, GITHUB_TOKEN: githubToken };
+  const env = { ...process.env, GITHUB_TOKEN: github.getToken() };

  if (script) {
    await exec(script, undefined, { cwd, env });
@@ -327,20 +395,13 @@ export async function runVersion({
    !!preState ? ` (${preState.tag})` : ""
  }`;

-  /**
-   * Fetch any existing pull requests that are open against the branch,
-   * before we push any changes that may inadvertently close the existing PRs.
-   *
-   * (`@changesets/ghcommit` has to reset the branch to the same commit as the base,
-   * which GitHub will then react to by closing the PRs)
-   */
  const existingPullRequests = await octokit.rest.pulls.list({
-    ...github.context.repo,
+    ...context.repo,
    state: "open",
-    head: `${github.context.repo.owner}:${versionBranch}`,
+    head: `${context.repo.owner}:${versionBranch}`,
    base: branch,
  });
-  core.info(
+  core.debug(
    `Existing pull requests: ${JSON.stringify(
      existingPullRequests.data,
      null,
@@ -348,7 +409,10 @@ export async function runVersion({
    )}`,
  );

-  await git.pushChanges({ branch: versionBranch, message: finalCommitMessage });
+  await github.pushChanges({
+    branch: versionBranch,
+    message: finalCommitMessage,
+  });

  const changedPackagesInfo = (await changedPackagesInfoPromises)
    .filter((x) => x)
@@ -363,14 +427,14 @@ export async function runVersion({
  });

  if (existingPullRequests.data.length === 0) {
-    core.info("creating pull request");
+    core.info("Creating pull request");
    const { data: newPullRequest } = await octokit.rest.pulls.create({
      base: branch,
      head: versionBranch,
      title: finalPrTitle,
      body: prBody,
      draft: prDraft !== undefined,
-      ...github.context.repo,
+      ...context.repo,
    });

    return {
@@ -379,7 +443,7 @@ export async function runVersion({
  } else {
    const [pullRequest] = existingPullRequests.data;

-    core.info(`updating found pull request #${pullRequest.number}`);
+    core.info(`Updating found pull request #${pullRequest.number}`);
    const convertPullRequestToDraftMutation =
      prDraft === "always"
        ? `
@@ -4,7 +4,11 @@ import path from "node:path";
 import artifact from "@actions/artifact";
 import * as core from "@actions/core";
 import readChangesetState from "../readChangesetState.ts";
-import { execChangesetsCli } from "../utils.ts";
+import {
+  execChangesetsCli,
+  getOptionalInput,
+  validateChangesetsCliVersion,
+} from "../utils.ts";

 type ModeResult =
  | {
@@ -27,7 +31,10 @@ try {
 }

 async function main() {
-  const result = await getMode();
+  const cwd = getOptionalInput("cwd") || process.cwd();
+  await validateChangesetsCliVersion(cwd);
+
+  const result = await getMode(cwd);
  core.setOutput("mode", result.mode);
  if (result.mode === "publish") {
    const publishPlanArtifact = await artifact.uploadArtifact(
@@ -48,8 +55,8 @@ async function main() {
  }
 }

-async function getMode(): Promise<ModeResult> {
-  const { changesets } = await readChangesetState();
+async function getMode(cwd: string): Promise<ModeResult> {
+  const { changesets } = await readChangesetState(cwd);

  if (changesets.length > 0) {
    const hasNonEmptyChangesets = changesets.some(
@@ -61,10 +68,11 @@ async function getMode(): Promise<ModeResult> {
    return { mode: "none" };
  }

-  const cwd = process.cwd();
  const publishPlanPath = path.join(
    process.env.RUNNER_TEMP ?? (await fs.realpath(os.tmpdir())),
-    `changeset-publish-plan-${Date.now()}.json`,
+    `changeset-publish-plan-${Date.now()}`,
+    // we need a stable filename here (in a unique dirname) so the artifact download can find this cleanly
+    "publish-plan.json",
  );
  await execChangesetsCli(["publish-plan", "--output", publishPlanPath], {
    cwd,
@@ -0,0 +1,293 @@
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import fsp from "node:fs/promises";
+import http, { type IncomingMessage, type ServerResponse } from "node:http";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { createFixture, type FileTree } from "fs-fixture";
+import { exec } from "tinyexec";
+import { moveDisposable } from "./utils.ts";
+
+export type Fixture = FileTree;
+
+export async function testdir(dir?: Fixture) {
+  return createFixture(dir, {
+    fs: {
+      ...fsp,
+      rm: (filePath, options) =>
+        fsp.rm(filePath, {
+          maxRetries: 3,
+          retryDelay: 100,
+          ...options,
+        }),
+    },
+  });
+}
+
+// Git maintenance can race with fixture cleanup by touching pack files.
+export async function disableGitBackgroundMaintenance(cwd: string) {
+  await exec("git", ["config", "gc.auto", "0"], {
+    nodeOptions: { cwd },
+    throwOnError: true,
+  });
+  await exec("git", ["config", "maintenance.auto", "false"], {
+    nodeOptions: { cwd },
+    throwOnError: true,
+  });
+}
+
+export async function gitdir(dir: Fixture) {
+  await using stack = new AsyncDisposableStack();
+  const fixture = stack.use(
+    await testdir({
+      ".gitattributes": "* text=auto eol=lf\n",
+      ...dir,
+    }),
+  );
+  const cwd = fixture.path;
+
+  await exec("git", ["init"], {
+    nodeOptions: { cwd },
+    throwOnError: true,
+  });
+  await disableGitBackgroundMaintenance(cwd);
+
+  const { stdout } = await exec("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+    nodeOptions: { cwd },
+  });
+  if (stdout.trim() !== "main") {
+    await exec("git", ["checkout", "-b", "main"], {
+      nodeOptions: { cwd },
+      throwOnError: true,
+    });
+  }
+
+  const gitConfig = `
+[user]
+    email = x@y.z
+    name = xyz
+[commit]
+    gpgSign = false
+[tag]
+    gpgSign = false
+    forceSignAnnotated = false
+  `.trim();
+  await fsp.appendFile(path.join(cwd, ".git/config"), gitConfig, "utf8");
+
+  await exec("git", ["add", "."], {
+    nodeOptions: { cwd },
+    throwOnError: true,
+  });
+  await exec("git", ["commit", "-m", "initial commit", "--allow-empty"], {
+    nodeOptions: { cwd },
+    throwOnError: true,
+  });
+
+  return moveDisposable(stack, fixture);
+}
+
+export async function shallowClone(cwd: string, depth = 1) {
+  await using stack = new AsyncDisposableStack();
+  const fixture = stack.use(await testdir());
+  await exec(
+    "git",
+    ["clone", "--depth", depth.toString(), pathToFileURL(cwd).toString(), "."],
+    {
+      nodeOptions: { cwd: fixture.path },
+      throwOnError: true,
+    },
+  );
+  await disableGitBackgroundMaintenance(fixture.path);
+  return moveDisposable(stack, fixture);
+}
+
+async function runGitHttpBackend(
+  cwd: string,
+  request: IncomingMessage,
+  response: ServerResponse,
+) {
+  // `git http-backend` speaks CGI: request metadata goes through environment
+  // variables, the request body through stdin, and the response through stdout.
+  const requestUrl = new URL(
+    request.url ?? "/",
+    `http://${request.headers.host ?? "localhost"}`,
+  );
+  const env: NodeJS.ProcessEnv = {
+    ...process.env,
+    CONTENT_LENGTH: request.headers["content-length"] ?? "0",
+    GATEWAY_INTERFACE: "CGI/1.1",
+    GIT_HTTP_EXPORT_ALL: "1",
+    GIT_PROJECT_ROOT: cwd,
+    PATH_INFO: decodeURIComponent(requestUrl.pathname),
+    QUERY_STRING: requestUrl.search.slice(1),
+    REMOTE_ADDR: request.socket.remoteAddress ?? "",
+    REQUEST_METHOD: request.method ?? "GET",
+    SERVER_PROTOCOL: `HTTP/${request.httpVersion}`,
+  };
+  if (request.headers["content-type"] !== undefined) {
+    env.CONTENT_TYPE = request.headers["content-type"];
+  }
+
+  const backend = spawn("git", ["http-backend"], {
+    env,
+    stdio: ["pipe", "pipe", "pipe"],
+  });
+  request.pipe(backend.stdin);
+
+  // Buffer stdout so the CGI headers can be separated from the response body.
+  // Keep stderr only to explain a backend failure.
+  const stdout: Buffer[] = [];
+  const stderr: Buffer[] = [];
+  backend.stdout.on("data", (chunk: Buffer) => stdout.push(chunk));
+  backend.stderr.on("data", (chunk: Buffer) => stderr.push(chunk));
+
+  const exitCode = await new Promise<number | null>((resolve, reject) => {
+    backend.on("error", reject);
+    backend.on("close", resolve);
+  });
+  if (exitCode !== 0) {
+    throw new Error(
+      `git http-backend exited with ${exitCode}: ${Buffer.concat(stderr).toString("utf8")}`,
+    );
+  }
+
+  const output = Buffer.concat(stdout);
+  // CGI ends its response headers with a blank line; accept CRLF and LF output.
+  let separator = Buffer.from("\r\n\r\n");
+  let headerEnd = output.indexOf(separator);
+  if (headerEnd === -1) {
+    separator = Buffer.from("\n\n");
+    headerEnd = output.indexOf(separator);
+  }
+  if (headerEnd === -1) {
+    throw new Error("git http-backend returned an invalid CGI response");
+  }
+
+  // Translate CGI status and headers, then forward the remaining bytes as body.
+  let status = 200;
+  const headers = output.subarray(0, headerEnd).toString("utf8").split(/\r?\n/);
+  for (const header of headers) {
+    const separatorIndex = header.indexOf(":");
+    if (separatorIndex === -1) continue;
+
+    const name = header.slice(0, separatorIndex);
+    const value = header.slice(separatorIndex + 1).trim();
+    if (name.toLowerCase() === "status") {
+      status = Number.parseInt(value, 10);
+    } else {
+      response.setHeader(name, value);
+    }
+  }
+
+  response.writeHead(status);
+  response.end(output.subarray(headerEnd + separator.length));
+}
+
+async function listen(server: http.Server) {
+  const waiter = Promise.withResolvers();
+
+  server.on("listening", waiter.resolve);
+  server.on("error", waiter.reject);
+
+  server.listen(0);
+
+  try {
+    await waiter.promise;
+    return server;
+  } finally {
+    server.off("listening", waiter.resolve);
+    server.off("error", waiter.reject);
+  }
+}
+
+type RecordedRequest = {
+  method: string;
+  url: string;
+  headers: NodeJS.Dict<string[]>;
+};
+
+function recordRequest(request: IncomingMessage): RecordedRequest {
+  return {
+    method: request.method ?? "GET",
+    url: request.url ?? "/",
+    headers: request.headersDistinct,
+  };
+}
+
+async function createGitHttpServer(cwd: string) {
+  const requests: RecordedRequest[] = [];
+  const server = http.createServer((request, response) => {
+    const recordedRequest = recordRequest(request);
+    requests.push(recordedRequest);
+
+    void runGitHttpBackend(cwd, request, response).catch((error: unknown) => {
+      response.destroy(
+        Error.isError(error)
+          ? error
+          : new Error("Server error", { cause: error }),
+      );
+    });
+  });
+
+  await listen(server);
+  const address = server.address();
+  assert(
+    !!address && typeof address !== "string",
+    "Failed to get server address",
+  );
+
+  return {
+    origin: `http://127.0.0.1:${address.port}`,
+    requests,
+    async [Symbol.asyncDispose]() {
+      await new Promise<void>((resolve, reject) => {
+        server.close((error) => {
+          if (error) {
+            reject(error);
+            return;
+          }
+          resolve();
+        });
+      });
+    },
+  };
+}
+
+async function createLocalRemote(dir: Fixture) {
+  await using stack = new AsyncDisposableStack();
+  const fixture = stack.use(await testdir());
+  const remote = fixture.path;
+  {
+    // Use a working repository to create the bare remote's initial history.
+    // Once cloned, the remote owns that history and the source can be disposed.
+    await using sourceFixture = await gitdir(dir);
+    await exec(
+      "git",
+      ["clone", "--bare", pathToFileURL(sourceFixture.path).toString(), "."],
+      {
+        nodeOptions: { cwd: remote },
+        throwOnError: true,
+      },
+    );
+  }
+  await disableGitBackgroundMaintenance(remote);
+  await exec("git", ["config", "http.receivepack", "true"], {
+    nodeOptions: { cwd: remote },
+    throwOnError: true,
+  });
+  return moveDisposable(stack, fixture);
+}
+
+export async function createGitHttpRemote(files: Fixture) {
+  await using stack = new AsyncDisposableStack();
+  const fixture = stack.use(await createLocalRemote(files));
+  const server = stack.use(
+    await createGitHttpServer(path.dirname(fixture.path)),
+  );
+
+  return moveDisposable(stack, {
+    path: fixture.path,
+    url: `${server.origin}/${path.basename(fixture.path)}`,
+    requests: server.requests,
+  });
+}
@@ -1,5 +1,12 @@
-import { expect, test } from "vitest";
-import { BumpLevels, getChangelogEntry, sortTheThings } from "./utils.ts";
+import { createFixture } from "fs-fixture";
+import { afterEach, expect, test, vi } from "vitest";
+import {
+  BumpLevels,
+  getChangelogEntry,
+  sortTheThings,
+  throwOnRemovedCommitModeInput,
+  validateChangesetsCliVersion,
+} from "./utils.ts";

 let changelog = `# @keystone-alpha/email

@@ -68,6 +75,10 @@ let changelog = `# @keystone-alpha/email
  - Update mjml-dependency
 `;

+afterEach(() => {
+  vi.unstubAllEnvs();
+});
+
 test("it works", () => {
  let entry = getChangelogEntry(changelog, "3.0.0");
  expect(entry.content).toMatchSnapshot();
@@ -100,3 +111,62 @@ test("it sorts the things right", () => {
  ];
  expect(things.sort(sortTheThings)).toMatchSnapshot();
 });
+
+test.each([
+  ["commit-mode", "git-cli", "push-with-git-cli: true"],
+  ["commit-mode", "github-api", "push-with-git-cli: false"],
+  ["commitMode", "git-cli", "push-with-git-cli: true"],
+  ["commitMode", "github-api", "push-with-git-cli: false"],
+])(
+  "explains how to migrate the removed %s input from %s",
+  (inputName, value, replacement) => {
+    vi.stubEnv(`INPUT_${inputName.toUpperCase()}`, value);
+    expect(() => throwOnRemovedCommitModeInput()).toThrow(replacement);
+  },
+);
+
+test("throws when the project declares Changesets CLI v2", async () => {
+  await using fixture = await createFixture({
+    "package.json": JSON.stringify({
+      name: "project",
+      devDependencies: { "@changesets/cli": "^2.29.7" },
+    }),
+    "package-lock.json": "",
+  });
+
+  await expect(validateChangesetsCliVersion(fixture.path)).rejects.toThrow(
+    "This version of the Changesets action is designed to work with Changesets CLI v3. Changesets CLI v2 is not supported; use Changesets action v1 instead, which is compatible with CLI v2.",
+  );
+});
+
+test("accepts a Changesets CLI v3 contract without an installed CLI", async () => {
+  await using fixture = await createFixture({
+    "package.json": JSON.stringify({
+      name: "project",
+      devDependencies: { "@changesets/cli": "^3.0.0" },
+    }),
+    "package-lock.json": "",
+  });
+
+  await expect(
+    validateChangesetsCliVersion(fixture.path),
+  ).resolves.toBeUndefined();
+});
+
+test("throws when the project has Changesets CLI v2 installed", async () => {
+  await using fixture = await createFixture({
+    "package.json": JSON.stringify({
+      name: "project",
+      devDependencies: { "@changesets/cli": "^3.0.0" },
+    }),
+    "package-lock.json": "",
+    "node_modules/@changesets/cli/package.json": JSON.stringify({
+      name: "@changesets/cli",
+      version: "2.29.7",
+    }),
+  });
+
+  await expect(validateChangesetsCliVersion(fixture.path)).rejects.toThrow(
+    "This version of the Changesets action is designed to work with Changesets CLI v3. Changesets CLI v2 is not supported; use Changesets action v1 instead, which is compatible with CLI v2.",
+  );
+});
@@ -2,6 +2,7 @@ import fs from "node:fs/promises";
 import { createRequire } from "node:module";
 import path from "node:path";
 import artifact from "@actions/artifact";
+import * as core from "@actions/core";
 import {
  exec,
  getExecOutput,
@@ -9,6 +10,8 @@ import {
  type ExecOutput,
 } from "@actions/exec";
 import { getPackages, type Package } from "@manypkg/get-packages";
+import major from "semver/functions/major.js";
+import subset from "semver/ranges/subset.js";

 const require = createRequire(import.meta.url);

@@ -116,11 +119,116 @@ export function isErrorWithCode(err: unknown, code: string) {
  );
 }

-export function fileExists(filePath: string) {
-  return fs.access(filePath, fs.constants.F_OK).then(
-    () => true,
-    () => false,
-  );
+export type WithAsyncDispose<T> = T & {
+  [Symbol.asyncDispose](): Promise<void>;
+};
+
+export function moveDisposable<T extends object>(
+  stack: AsyncDisposableStack,
+  value: T,
+): WithAsyncDispose<T> {
+  const moved = stack.move();
+  return Object.assign(value, {
+    async [Symbol.asyncDispose]() {
+      await moved.disposeAsync();
+    },
+  });
+}
+
+export function getOptionalInput(name: string) {
+  // normalize empty string default return value of `core.getInput` to undefined
+  return core.getInput(name) || undefined;
+}
+
+export function getRequiredInput(name: string) {
+  // it's just a small utility wrapper, mainly introduced for usage parity with our custom `getOptionalInput`
+  // note: `core.getBooleanInput` gets used directly as it already normalizes the return value nicely
+  return core.getInput(name, { required: true });
+}
+
+export function throwOnRemovedCommitModeInput() {
+  for (const inputName of ["commit-mode", "commitMode"]) {
+    const value = getOptionalInput(inputName);
+    if (value === undefined) continue;
+
+    const migration =
+      value === "git-cli"
+        ? 'Replace it with "push-with-git-cli: true".'
+        : value === "github-api"
+          ? 'Remove it or replace it with "push-with-git-cli: false"; GitHub API pushes are now the default.'
+          : 'Set "push-with-git-cli" to true for Git CLI pushes or false for GitHub API pushes.';
+    throw new Error(
+      `The "${inputName}" input has been replaced by the boolean "push-with-git-cli" input. ${migration}`,
+    );
+  }
+}
+
+export function throwOnRenamedInputs(renames: Record<string, string>) {
+  const references: Record<string, string> = {};
+
+  for (const [oldInput, newInput] of Object.entries(renames)) {
+    if (core.getInput(oldInput)) {
+      references[oldInput] = newInput;
+    }
+  }
+
+  if (Object.keys(references).length > 0) {
+    const list = Object.entries(references)
+      .map(([oldInput, newInput]) => `- "${oldInput}" -> "${newInput}"`)
+      .join("\n");
+    throw new Error(
+      `The following inputs have been renamed:\n${list}\nPlease update your workflow file.`,
+    );
+  }
+}
+
+const changesetsCliCompatibilityError =
+  "This version of the Changesets action is designed to work with Changesets CLI v3. " +
+  "Changesets CLI v2 is not supported; use Changesets action v1 instead, which is compatible with CLI v2.";
+
+export async function validateChangesetsCliVersion(cwd: string) {
+  const { rootPackage } = await getPackages(cwd);
+  const packageJson = rootPackage?.packageJson;
+  const declaredVersion =
+    packageJson?.devDependencies?.["@changesets/cli"] ??
+    packageJson?.dependencies?.["@changesets/cli"];
+
+  if (typeof declaredVersion === "string") {
+    const range = declaredVersion.startsWith("workspace:")
+      ? declaredVersion.slice("workspace:".length)
+      : declaredVersion;
+
+    let isV2 = false;
+
+    try {
+      isV2 = subset(range, ">=2.0.0-0 <3.0.0-0", {
+        includePrerelease: true,
+      });
+    } catch {
+      // it could be a non-semver protocol
+    }
+
+    if (isV2) {
+      throw new Error(changesetsCliCompatibilityError);
+    }
+  }
+
+  let cliPackageJson;
+
+  try {
+    cliPackageJson = require(
+      require.resolve("@changesets/cli/package.json", { paths: [cwd] }),
+    );
+  } catch {
+    return;
+  }
+
+  if (
+    typeof cliPackageJson.version === "string" &&
+    major(cliPackageJson.version) === 2
+  ) {
+    throw new Error(changesetsCliCompatibilityError);
+  }
 }

 function resolveChangesetsCli(cwd: string) {
@@ -1,7 +1,12 @@
 import * as core from "@actions/core";
-import { Git } from "../git.ts";
-import { setupOctokit } from "../octokit.ts";
+import { GitHub } from "../github.ts";
 import { runVersion } from "../run.ts";
+import {
+  getOptionalInput,
+  getRequiredInput,
+  throwOnRemovedCommitModeInput,
+  validateChangesetsCliVersion,
+} from "../utils.ts";

 try {
  await main();
@@ -10,39 +15,31 @@ try {
 }

 async function main() {
-  const githubToken = core.getInput("github-token", { required: true });
-  const script = core.getInput("script");
-  const commitMessage = core.getInput("commit-message", { required: true });
-  const prTitle = core.getInput("pr-title", { required: true });
-  const prDraft = core.getInput("pr-draft") || undefined;
-  const prBaseBranch = core.getInput("pr-base-branch");
-  const commitMode = core.getInput("commit-mode") || "git-cli";
-  const setupGitUser = core.getBooleanInput("setup-git-user");
+  const cwd = getOptionalInput("cwd") || process.cwd();
+  await validateChangesetsCliVersion(cwd);
+  throwOnRemovedCommitModeInput();
+
+  const githubToken = getRequiredInput("github-token");
+  const script = getOptionalInput("script");
+  const commitMessage = getRequiredInput("commit-message");
+  const prTitle = getRequiredInput("pr-title");
+  const prDraft = getOptionalInput("pr-draft");
+  const prBaseBranch = getOptionalInput("pr-base-branch");
+  const pushWithGitCli = core.getBooleanInput("push-with-git-cli");

  // Validations
  if (prDraft !== undefined && prDraft !== "always" && prDraft !== "create") {
    throw new Error(`Invalid pr-draft input: ${prDraft}`);
  }
-
-  // If the user needs to change the cwd, set `working-directory` in the step instead
-  const cwd = process.cwd();
-
-  const octokit = setupOctokit(githubToken);
-  const git = new Git({
-    octokit: commitMode === "github-api" ? octokit : undefined,
+  const github = new GitHub({
    cwd,
+    githubToken,
+    pushWithGitCli,
  });

-  if (setupGitUser) {
-    core.info("setting git user");
-    await git.setupUser();
-  }
-
  const { pullRequestNumber } = await runVersion({
    script,
-    githubToken,
-    git,
-    octokit,
+    github,
    cwd,
    prTitle,
    commitMessage,
@@ -1,3 +1,43 @@
 # changesets/action/version

-TODO
+This action versions packages and creates or updates a pull request with the changes.
+
+## Requirements
+
+- Needs repo checked out and `@changesets/cli` installed
+- [Job permissions][job-permissions]:
+  - `contents: write`: to commit version changes
+  - `pull-requests: write`: to create pull request
+- [Workflow triggers][workflow-triggers]: _any_
+
+> [!NOTE]
+> In your repository settings, in `Actions > General`, also ensure the `Allow GitHub Actions to create and approve pull requests` option is enabled
+
+## Usage
+
+> [!TIP]
+> Check out [the docs](https://changesets.dev/guide/automating#how-do-i-run-the-version-and-publish-commands) to learn how to set up the version and publish workflow.
+
+## API
+
+<!-- api-start -->
+
+| Inputs              | Description                                                                                                                                                                                                                             |
+| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `github-token`      | The GitHub token to use for authentication. Defaults to the GitHub-provided token. To use a custom token, pass it explicitly to this input.                                                                                             |
+| `script`            | The command to use to version packages                                                                                                                                                                                                  |
+| `commit-message`    | The commit message. Default to `Version Packages`                                                                                                                                                                                       |
+| `pr-title`          | The pull request title. Default to `Version Packages`                                                                                                                                                                                   |
+| `pr-draft`          | Controls draft PR behavior. Use 'create' to create new version PRs as draft, or 'always' to also convert existing version PRs back to draft when updating them.                                                                         |
+| `pr-base-branch`    | Sets the base branch of the PR. Defaults to `github.ref_name`.                                                                                                                                                                          |
+| `push-with-git-cli` | Whether to use the Git CLI instead of the GitHub API to push release commits. Defaults to `false`. When using the GitHub API, commits are signed using GitHub's GPG key and attributed to the user or app that owns the `github-token`. |
+| `cwd`               | The working directory to execute Changesets in. Defaults to the root of the repository.                                                                                                                                                 |
+
+| Outputs     | Description                                         |
+| ----------- | --------------------------------------------------- |
+| `pr-number` | The pull request number that was created or updated |
+
+<!-- api-end -->
+
+[job-permissions]: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idpermissions
+[workflow-triggers]: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
@@ -5,11 +5,13 @@ runs:
  main: ../dist/version.js
 inputs:
  github-token:
-    description: "The GitHub token to use for authentication. Defaults to the GitHub-provided token."
+    description: >
+      The GitHub token to use for authentication. Defaults to the GitHub-provided token.
+      To use a custom token, pass it explicitly to this input.
    required: false
    default: ${{ github.token }}
  script:
-    description: "The command to use to publish packages"
+    description: "The command to use to version packages"
    required: false
  commit-message:
    description: "The commit message. Default to `Version Packages`"
@@ -25,19 +27,19 @@ inputs:
  pr-base-branch:
    description: "Sets the base branch of the PR. Defaults to `github.ref_name`."
    required: false
-  commit-mode:
+  push-with-git-cli:
    description: >
-      An enum to specify the commit mode. Use "git-cli" to push changes using the Git CLI,
-      or "github-api" to push changes via the GitHub API. When using "github-api",
-      all commits and tags are signed using GitHub's GPG key and attributed to the user
-      or app who owns the GITHUB_TOKEN.
+      Whether to use the Git CLI instead of the GitHub API to push release commits.
+      Defaults to `false`. When using the GitHub API, commits are signed using GitHub's
+      GPG key and attributed to the user or app that owns the `github-token`.
    required: false
-    default: "git-cli"
-  setup-git-user:
-    description: Sets up the git user for commits as `"github-actions[bot]"`. Default to `true`
+    default: false
+  cwd:
+    description: "The working directory to execute Changesets in. Defaults to the root of the repository."
    required: false
-    default: true
-outputs: {}
+outputs:
+  pr-number:
+    description: The pull request number that was created or updated
 branding:
  icon: package
  color: blue
Author	SHA1	Message	Date
changeset-internal-publish-bot[bot]	ae32849d5b	v2.1.2	2026-09-07 11:58:07 +00:00
changesets-org-version-bot[bot]	0138f456ec	Version Packages (#726 ) Co-authored-by: changesets-org-version-bot[bot] <288406890+changesets-org-version-bot[bot]@users.noreply.github.com>	2026-09-07 11:50:58 +00:00
Bjorn Lu	88338839e3	Handle error when pushing git tags with the git CLI (#735 ) * Handle error when pushing git tags with the git CLI * Update message	2026-09-07 11:45:47 +00:00
Bjorn Lu	e08fde7435	Improve log messages (#730 )	2026-09-04 18:07:20 +00:00
dependabot[bot]	371fd77b45	Bump human-id in the production-dependencies group across 1 directory (#732 ) Bumps the production-dependencies group with 1 update in the / directory: [human-id](https://github.com/RienNeVaPlus/human-id). Updates `human-id` from 4.2.0 to 4.2.1 - [Commits](https://github.com/RienNeVaPlus/human-id/commits) --- updated-dependencies: - dependency-name: human-id dependency-version: 4.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-01 06:34:13 +00:00
dependabot[bot]	85efcafd80	Bump actions/checkout in the github-actions group across 1 directory (#734 ) Bumps the github-actions group with 1 update in the / directory: [actions/checkout](https://github.com/actions/checkout). Updates `actions/checkout` from 6.0.3 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-01 06:18:01 +00:00
dependabot[bot]	5bb9d5ccac	Bump the development-dependencies group across 1 directory with 7 updates (#733 ) Bumps the development-dependencies group with 7 updates in the / directory: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [@changesets/cli](https://github.com/changesets/changesets/tree/HEAD/packages/cli) \| `3.0.0` \| `3.0.1` \| \| [@changesets/write](https://github.com/changesets/changesets/tree/HEAD/packages/write) \| `1.0.0` \| `1.0.1` \| \| [@tsconfig/node24](https://github.com/tsconfig/bases/tree/HEAD/bases) \| `24.0.4` \| `24.0.5` \| \| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) \| `26.1.2` \| `26.3.0` \| \| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) \| `0.61.0` \| `0.65.0` \| \| [rolldown](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) \| `1.2.2` \| `1.2.5` \| \| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) \| `4.1.10` \| `4.1.11` \| Updates `@changesets/cli` from 3.0.0 to 3.0.1 - [Release notes](https://github.com/changesets/changesets/releases) - [Changelog](https://github.com/changesets/changesets/blob/main/packages/cli/CHANGELOG.md) - [Commits](https://github.com/changesets/changesets/commits/@changesets/cli@3.0.1/packages/cli) Updates `@changesets/write` from 1.0.0 to 1.0.1 - [Release notes](https://github.com/changesets/changesets/releases) - [Changelog](https://github.com/changesets/changesets/blob/main/packages/write/CHANGELOG.md) - [Commits](https://github.com/changesets/changesets/commits/@changesets/write@1.0.1/packages/write) Updates `@tsconfig/node24` from 24.0.4 to 24.0.5 - [Commits](https://github.com/tsconfig/bases/commits/HEAD/bases) Updates `@types/node` from 26.1.2 to 26.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `oxfmt` from 0.61.0 to 0.65.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.65.0/npm/oxfmt) Updates `rolldown` from 1.2.2 to 1.2.5 - [Release notes](https://github.com/rolldown/rolldown/releases) - [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md) - [Commits](https://github.com/rolldown/rolldown/commits/v1.2.5/packages/rolldown) Updates `vitest` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: "@changesets/cli" dependency-version: 3.0.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: "@changesets/write" dependency-version: 1.0.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: "@tsconfig/node24" dependency-version: 24.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: "@types/node" dependency-version: 26.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: oxfmt dependency-version: 0.65.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: rolldown dependency-version: 1.2.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-01 06:17:16 +00:00
Bjorn Lu	ca8589735a	Always prepare branch for version (#729 ) * Always prepare branch for version * Update test	2026-08-31 08:18:49 +00:00
Bjorn Lu	36f529f13a	Fix root action double error logs (#724 )	2026-08-22 10:32:21 +00:00
changesets-org-version-bot[bot]	d7669c894a	Version Packages (#722 ) Co-authored-by: changesets-org-version-bot[bot] <288406890+changesets-org-version-bot[bot]@users.noreply.github.com>	2026-08-19 05:29:59 +00:00
Szajkovics SándorandBjorn Lu	da1ea291ef	Fix typo in renamed inputs (#721 ) * fix: mesage typoo in renamed inputs * chore: add changeset * Apply suggestion from @bluwy --------- Co-authored-by: Bjorn Lu <bjornlu.dev@gmail.com>	2026-08-13 07:10:14 +00:00
changesets-org-version-bot[bot]	7545547fe4	Version Packages (#719 ) Co-authored-by: changesets-org-version-bot[bot] <288406890+changesets-org-version-bot[bot]@users.noreply.github.com>	2026-08-13 02:33:15 +00:00
Mateusz Burzyński	3043070b0d	Prevent test warning annotations (#720 )	2026-08-13 00:50:23 +00:00
Bjorn Lu	3b7c71c440	Add back cwd input (#718 )	2026-08-12 13:10:39 +00:00
Bjorn Lu	6f58ba3580	Update pr-status message links to new faq (#716 )	2026-08-12 10:34:14 +00:00
changesets-org-version-bot[bot]	e52ce9e59b	Version Packages (#715 ) Co-authored-by: changesets-org-version-bot[bot] <288406890+changesets-org-version-bot[bot]@users.noreply.github.com>	2026-08-11 12:39:31 +00:00
Mateusz Burzyński	78fdc6bb2e	Exit pre mode (#714 ) * Exit pre mode * Remove prerelease-only changesets	2026-08-11 12:35:44 +00:00
Bjorn LuandMateusz Burzyński	187a104ea0	Update deps for stable (#709 ) * Update dependencies and pre setup * Add changeset * Handle pre change * Update dependencies * Use stable Changesets v3 packages --------- Co-authored-by: Mateusz Burzyński <mateuszburzynski@gmail.com>	2026-08-11 12:17:46 +00:00
changesets-org-version-bot[bot]	d11394aa52	Version Packages (next) (#712 ) Co-authored-by: changesets-org-version-bot[bot] <288406890+changesets-org-version-bot[bot]@users.noreply.github.com>	2026-08-11 11:05:26 +00:00
Mateusz Burzyński	5fa67671df	Fix support for prerelease exits using the new `.changeset/pre` layout (#711 ) * Fix prerelease exit mode selection * Improve prerelease exit changeset wording	2026-08-11 11:00:37 +00:00
Mateusz Burzyński	cae6353519	Use new self-repository syntax for local GitHub actions (#706 )	2026-08-03 15:40:56 +00:00
changesets-org-version-bot[bot]	c1722b9aba	Version Packages (next) (#698 ) Co-authored-by: changesets-org-version-bot[bot] <288406890+changesets-org-version-bot[bot]@users.noreply.github.com>	2026-08-03 12:10:09 +00:00
Mateusz Burzyński	77be81bcb9	Fixed a regression making it impossible to sync new versions of versioning pull requests with base branch updates (#705 ) * Fixed a regression making it impossible to sync new versions of versioning pull requests with base branch updates when using GitHub API pushes * update ghcommit	2026-08-03 12:03:51 +00:00
Mateusz Burzyński	cb3f0110d7	Use GitHub API for pushes by default and require explicit `github-token` when using custom tokens (#692 ) * Ensure `github-token` wins for `git-cli` pushes * more shenanigans * Default to GitHub API commit mode * e2e auth tests * push missing utils * rename input * refactor * refactor * refactor * refactor * refactor * refactor * reuse helpers * refactor * refactor * simplify * add tests * refactor * improve comments * shift helper * add comments * extract test helpers * update docs and changesets * update one thing	2026-08-03 11:02:31 +00:00
Bjorn Lu	50de20a107	Add extra permission docs (#704 ) * Add extra permission docs * Update	2026-08-01 09:35:59 +00:00
Bjorn Lu	64b747d5f5	Update all the docs (#703 ) * Update all the docs * Fix heading	2026-07-31 14:33:09 +00:00
Mateusz Burzyński	219ea82e52	Remove `setup-git-user` in favor of setting fallback only when identity is missing (#688 ) * Experiment with skipping setup-git-user more often * drop setup-git-user * fix tests	2026-07-27 05:02:39 +00:00
Bjorn Lu	469993ce57	Remove npm auth handling in favor of docs (#695 ) * Add docs for npm auth setup * Show bash examples * Improve bash pattern * Update and reference docs * Remove setup auth code * Update * Update * Update	2026-07-24 15:24:09 +00:00
Bjorn Lu	8a9495e0ee	Gitignore .env file (#701 )	2026-07-24 12:20:48 +00:00
Mateusz Burzyński	5b307d3df2	Validate that projects use Changesets CLI v3 and direct Changesets CLI v2 users to `changesets/action@v1` (#699 ) * Validate that projects use Changesets CLI v3 and direct Changesets CLI v2 users to `changesets/action@v1` * better spy/mocking * fmt * shuffle	2026-07-23 09:34:32 +00:00
Mateusz Burzyński	84d78c68f9	Allow custom publish scripts to complete without a Changesets output file (#697 )	2026-07-22 06:31:15 +00:00
Tee Ming	c6cc0d84cb	Update README.md with input/output kebab-case naming convention (#691 ) * Update README.md * Apply suggestion from @teemingc	2026-07-05 17:43:21 +00:00
Mateusz Burzyński	e3e2663c0e	Add uncommitted `.github/actions/setup-bot-auth` (#687 ) * Add uncommitted `.github/actions/setup-bot-auth` * tweak codeowners	2026-07-01 13:52:58 +00:00
Mateusz Burzyński	e43c867727	Setup git user in the release script (#686 ) * Setup git user in the release script * refactor stuff	2026-07-01 13:29:33 +00:00
changesets-org-version-bot[bot]andgithub-actions[bot]	4b6e1f1099	Version Packages (next) (#677 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-07-01 12:28:07 +00:00
Mateusz Burzyński	cf45e93c21	Use split publishing workflow (#679 ) * fix release line timing * Use split publishing workflow * remove release check, handle through publish plan * remove unused script * remove unused publish plan output * fmt * update a thing * fmt * simplify * update pre * update changesets cli	2026-07-01 12:24:41 +00:00
Bjorn Lu	73591071e6	Rename root action inputs and outputs (#681 )	2026-07-01 12:08:50 +00:00
Mateusz Burzyński	f71ae043ed	Expect publish output to be shared through a file (#678 ) * Expect publish output to be shared through a file * throw at all times * match latest changes * fmt * rename things * update changesets * add changeset	2026-07-01 09:08:14 +00:00
Bjorn Lu	ca57073900	Split git tag and github release options (#680 ) * Split git tag and github release options * Rename to push-git-tags * Validate inputs	2026-07-01 07:30:13 +00:00
Bjorn Lu	0eae789230	Rename to kebab-case for root action inputs and outputs (#668 ) * Rename to kebab-case for root action inputs and outputs * Throw on renamed inputs	2026-06-30 08:24:21 +00:00
Bjorn Lu	164652bdd6	Remove GITHUB_TOKEN env var support (#674 )	2026-06-30 00:20:57 +00:00
Bjorn LuandMateusz Burzyński	a35a66bd1e	Update `@changesets/ghcommit` to v3 beta (#675 ) Co-authored-by: Mateusz Burzyński <mateuszburzynski@gmail.com>	2026-06-25 11:01:17 +00:00
Bjorn LuandMateusz Burzyński	823cf741ca	Update to changesets v3 packages (#673 ) * Update to changesets v3 packages * Dedupe * Fix test * Fix test 2 * update more --------- Co-authored-by: Mateusz Burzyński <mateuszburzynski@gmail.com>	2026-06-25 10:58:02 +00:00
changesets-org-version-bot[bot]andgithub-actions[bot]	b12c36a7bf	Version Packages (next) (#671 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-06-24 10:28:35 +00:00
Mateusz Burzyński	5a8b9b721b	Avoid putting the github token in the global `.netrc` file (#670 ) * Avoid putting the github token in the global `.netrc` file * fix wording	2026-06-24 10:07:11 +00:00
changesets-org-version-bot[bot]andgithub-actions[bot]	0490518932	Version Packages (next) (#664 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-06-23 11:29:25 +00:00
Mateusz Burzyński	dc29b738b5	Fix the `/version` subaction to not crash on missing `pr-base-branch` input (#666 ) * use `getOptionalInput` consistently * introduce `getRequiredInput` * add changeset	2026-06-23 11:26:43 +00:00
Mateusz Burzyński	ccb38113ea	Fix the computed publish plan path passed internally to `changeset pack` by the `/pack` subaction (#663 ) * Fix the computed publish plan path passed internally to `changeset pack` by the `/pack` subaction * fix it	2026-06-23 10:00:39 +00:00
Mateusz Burzyński	cf37561cd9	Fix description of the `/version`'s `script` input (#665 )	2026-06-23 09:55:13 +00:00
Mateusz Burzyński	5c88881fff	Fixed usage of `--from-publish-plan` flag used by the `/pack` subaction (#662 )	2026-06-23 09:25:48 +00:00
				`@@ -0,0 +1 @@`
				import{A as e,D as t,O as n,f as r,j as i,k as a,m as o,o as s,p as c,s as l}from"./utils-j_VOz275.js";import{n as u,r as d,t as f}from"./run-CIL9Fbt6.js";import{t as p}from"./readChangesetState-DLdyz-Wv.js";try{await m()}catch(t){e(t.message)}async function m(){let m=s(`cwd`)\|\|process.cwd();await o(m),c({publish:`publish-script`,version:`version-script`,commit:`commit-message`,title:`pr-title`,branch:`pr-base-branch`,prDraft:`pr-draft`,createGithubReleases:`create-github-releases`}),r();let h=l(`github-token`);if(process.env.GITHUB_TOKEN&&process.env.GITHUB_TOKEN!==h)throw Error(`The GITHUB_TOKEN environment variable is set and does not match the "github-token" input. Please pass the custom GitHub token to the "github-token" input and remove the GITHUB_TOKEN environment variable to avoid conflicts.`);let g=t(`push-with-git-cli`),_=s(`pr-draft`);if(_!==void 0&&_!==`always`&&_!==`create`){e(`Invalid pr-draft: ${_}`);return}let v=new d({cwd:m,githubToken:h,pushWithGitCli:g}),{changesets:y}=await p(m),b=n(`publish-script`),x=y.length!==0,S=y.some(e=>e.releases.length>0),C=!!b;switch(i(`published`,`false`),i(`published-packages`,`[]`),i(`has-changesets`,String(x)),!0){case!x&&!C:a(`No changesets present or were removed by merging version PR. Not publishing because publish-script is not set.`);return;case!x&&C:{a(`No changesets found. Attempting to publish any unpublished packages to npm`);let e=t(`create-github-releases`),n=t(`push-git-tags`);if(e&&!n)throw Error(`The input 'create-github-releases' is set to true, but 'push-git-tags' is set to false. Creating GitHub releases requires pushing git tags. Please set 'push-git-tags' to true or set 'create-github-releases' to false.`);let r=await f({script:b,github:v,createGithubReleases:e,pushGitTags:n,cwd:m});if(r.published&&(i(`published`,`true`),i(`published-packages`,JSON.stringify(r.publishedPackages))),r.exitCode!==0)throw Error(`Publish command exited with code ${r.exitCode}${r.published?`, but some packages were published: ${r.publishedPackages.map(e=>`${e.name}@${e.version}`).join(`, `)}`:``}`);return}case x&&!S:a(`All changesets are empty. Not creating PR`);return;case x:{let{pullRequestNumber:e}=await u({script:s(`version-script`),github:v,cwd:m,prTitle:s(`pr-title`),commitMessage:s(`commit-message`),hasPublishScript:C,prDraft:_,branch:s(`pr-base-branch`)});i(`pr-number`,String(e));return}}}export{};
				`@@ -0,0 +1 @@`
				import{A as e,j as t,m as n,n as r,o as i,t as a,y as o}from"./utils-j_VOz275.js";import s from"node:fs/promises";import c from"node:path";import l from"node:os";try{await u()}catch(t){e(t.message)}async function u(){let e=i(`cwd`)\|\|process.cwd();await n(e);let r=i(`publish-plan-artifact-id`),a=process.env.RUNNER_TEMP??await s.realpath(l.tmpdir()),u=c.join(a,`changeset-pack-${Date.now()}`);await d(e,{outDir:u,publishPlanPath:r?await f(a,Number(r)):void 0});let m=await o.uploadArtifact(`changeset-pack-${Date.now()}`,await p(u),u,{retentionDays:30});if(m.id===void 0)throw Error(`Packed artifact upload did not return an artifact id`);t(`pack-dir-artifact-id`,String(m.id))}async function d(e,t){let n=[`pack`,`--out-dir`,t.outDir];t.publishPlanPath&&n.push(`--from-publish-plan`,t.publishPlanPath),await r(n,{cwd:e,env:process.env})}async function f(e,t){let n=await a(e,t,`changeset-publish-plan`);return c.join(n,`publish-plan.json`)}async function p(e){let t=await s.readdir(e,{withFileTypes:!0});return(await Promise.all(t.map(async t=>{let n=c.join(e,t.name);return t.isDirectory()?p(n):[n]}))).flat()}export{};
				`@@ -0,0 +1 @@`
				import{A as e,T as t,j as n,k as r,o as i,s as a,w as o}from"./utils-j_VOz275.js";try{await s()}catch(t){e(t.message)}async function s(){let e=o.payload.pull_request;if(!e)throw Error("This action should only be run on `pull_request_target` or `pull_request` events");let s=a(`github-token`),l=a(`body`),u=i(`update-id`),d=u?c(u):null,f=d?`${d}\n\n${l}`:l,p={repo:e.base.repo.name,owner:e.base.repo.owner.login,issue_number:e.number,body:f},m=t(s),h;if(d&&(r(`Checking for existing comment...`),h=await m.rest.issues.listComments({repo:e.base.repo.name,owner:e.base.repo.owner.login,issue_number:e.number}).then(e=>e.data.find(e=>e.body?.includes(d))?.id)),h)r(`Updating existing comment (id: ${h})...`),await m.rest.issues.updateComment({...p,comment_id:h}),n(`comment-id`,h);else{r(`Creating new comment...`);let e=await m.rest.issues.createComment(p);n(`comment-id`,e.data.id)}r(`Done!`)}function c(e){let t=`changesets-action-pr-comment`;return t===e?`<!-- ${t} -->`:`<!-- ${t}:${e} -->`}export{};
				`@@ -0,0 +1 @@`
				import{A as e,D as t,j as n,m as r,o as i,s as a,t as o}from"./utils-j_VOz275.js";import{r as s,t as c}from"./run-CIL9Fbt6.js";import l from"node:fs/promises";import u from"node:os";try{await d()}catch(t){e(t.message)}async function d(){let e=i(`cwd`)\|\|process.cwd();await r(e);let d=a(`github-token`),f=i(`script`),p=i(`pack-dir-artifact-id`),m=t(`create-github-releases`),h=t(`push-git-tags`);if(m&&!h)throw Error(`The input 'create-github-releases' is set to true, but 'push-git-tags' is set to false. Creating GitHub releases requires pushing git tags. Please set 'push-git-tags' to true or set 'create-github-releases' to false.`);let g=new s({cwd:e,githubToken:d}),_=p?await o(process.env.RUNNER_TEMP??await l.realpath(u.tmpdir()),Number(p),`changeset-pack`):void 0,v=await c({script:f,github:g,createGithubReleases:m,pushGitTags:h,cwd:e,fromPackDir:_});if(v.published?(n(`published`,`true`),n(`published-packages`,JSON.stringify(v.publishedPackages))):n(`published`,`false`),v.exitCode!==0)throw Error(`Publish command exited with code ${v.exitCode}${v.published?`, but some packages were published: ${v.publishedPackages.map(e=>`${e.name}@${e.version}`).join(`, `)}`:``}`)}export{};
				`@@ -0,0 +1 @@`
				import{i as e,t}from"./dist-BjZhuI7Y.js";async function n(n=process.cwd()){let r=await e(n),i=await t(n);return r!==void 0&&r.mode===`pre`?{preState:r,changesets:i.filter(e=>!e.id.startsWith(`pre/`))}:{preState:void 0,changesets:i}}export{n as t};
				`@@ -0,0 +1 @@`
				import{A as e,D as t,f as n,j as r,m as i,o as a,s as o}from"./utils-j_VOz275.js";import{n as s,r as c}from"./run-CIL9Fbt6.js";try{await l()}catch(t){e(t.message)}async function l(){let e=a(`cwd`)\|\|process.cwd();await i(e),n();let l=o(`github-token`),u=a(`script`),d=o(`commit-message`),f=o(`pr-title`),p=a(`pr-draft`),m=a(`pr-base-branch`),h=t(`push-with-git-cli`);if(p!==void 0&&p!==`always`&&p!==`create`)throw Error(`Invalid pr-draft input: ${p}`);let g=new c({cwd:e,githubToken:l,pushWithGitCli:h}),{pullRequestNumber:_}=await s({script:u,github:g,cwd:e,prTitle:f,commitMessage:d,hasPublishScript:!0,prDraft:p,branch:m});r(`pr-number`,String(_))}export{};