stable commits

.changeset/all-cars-grin.md

@@ -0,0 +1,5 @@
+---
+"@changesets/action": patch
+---
+
+Fix the computed publish plan path passed internally to `changeset pack` by the `/pack` subaction.

.changeset/brave-pandas-commit.md

@@ -0,0 +1,9 @@
+---
+"@changesets/action": major
+---
+
+Release commits and tags are now pushed using the GitHub API by default.
+
+Replace the `commit-mode` input with the boolean `push-with-git-cli` input. Set `push-with-git-cli: true` to continue using the Git CLI.
+
+Regardless of the push mode, custom GitHub tokens must be passed explicitly through the `github-token` input. The `GITHUB_TOKEN` environment variable and credentials configured by `actions/checkout` or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, `github-token` takes precedence over those repository credentials.

.changeset/bright-lions-check.md

@@ -0,0 +1,5 @@
+---
+"@changesets/action": patch
+---
+
+Validate that projects use Changesets CLI v3 and direct Changesets CLI v2 users to `changesets/action@v1`.

.changeset/calm-files-warn.md

@@ -0,0 +1,5 @@
+---
+"@changesets/action": patch
+---
+
+Allow custom publish scripts to complete without a Changesets output file, warning that GitHub releases and git tags cannot be created when that file is missing.

.changeset/chubby-geese-sink.md

@@ -0,0 +1,7 @@
+---
+"@changesets/action": major
+---
+
+Add a new `push-git-tags` option that complements `create-github-releases` to control specifically if git tags should be created but not GitHub releases.
+
+If `create-github-releases` was previously set to `false`, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set `push-git-tags` to `false` explicitly.

.changeset/eight-clocks-pull.md

@@ -0,0 +1,5 @@
+---
+"@changesets/action": minor
+---
+
+Add new `/select-mode`, `/version`, and `/publish` sub-actions to better control version and publish steps

.changeset/eighty-doors-swim.md

@@ -0,0 +1,5 @@
+---
+"@changesets/action": major
+---
+
+Removed compatibility support for old Changesets v1.

.changeset/eighty-parks-tickle.md

@@ -0,0 +1,17 @@
+---
+"@changesets/action": major
+---
+
+Rename the root action inputs and outputs to better match the sub-actions' conventions.
+
+Inputs:
+
+- `version` -> `version-script`
+- `publish` -> `publish-script`
+- `commit` -> `commit-message`
+- `title` -> `pr-title`
+- `branch` -> `pr-base-branch`
+
+Outputs:
+
+- `pull-request-number` -> `pr-number`

.changeset/fiery-toes-vanish.md

@@ -0,0 +1,5 @@
+---
+"@changesets/action": major
+---
+
+Remove support for passing custom GitHub token through the GITHUB_TOKEN environment variable. It should be passed to the `github-token` input instead.

.changeset/git-cli-auth-header.md

@@ -0,0 +1,5 @@
+---
+"@changesets/action": patch
+---
+
+Authenticate git CLI pushes with the configured GitHub token using Git extra headers instead of writing to a global `.netrc` file.

.changeset/git-cli-server-url.md

@@ -0,0 +1,5 @@
+---
+"@changesets/action": patch
+---
+
+Derive the Git server URL from the GitHub Actions context when configuring git CLI authentication to support GitHub Enterprise Server setups.

.changeset/green-birds-push.md

@@ -0,0 +1,5 @@
+---
+"@changesets/action": patch
+---
+
+Fixed a regression making it impossible to sync new versions of versioning pull requests with base branch updates when using GitHub API pushes.

.changeset/lemon-turtles-itch.md

@@ -0,0 +1,5 @@
+---
+"@changesets/action": major
+---
+
+Remove `cwd` option for `changesets/action`. Use the step `working-directory` option instead to change the directory.

.changeset/pre.json

@@ -0,0 +1,26 @@
+{
+  "mode": "pre",
+  "tag": "next",
+  "changesets": [
+    "all-cars-grin",
+    "brave-pandas-commit",
+    "bright-lions-check",
+    "calm-files-warn",
+    "chubby-geese-sink",
+    "eight-clocks-pull",
+    "eighty-doors-swim",
+    "eighty-parks-tickle",
+    "fiery-toes-vanish",
+    "git-cli-auth-header",
+    "git-cli-server-url",
+    "green-birds-push",
+    "lemon-turtles-itch",
+    "ready-mangos-boil",
+    "shaky-rings-type",
+    "shy-months-crash",
+    "silent-tips-dance",
+    "strict-hotels-laugh",
+    "tidy-bots-smile",
+    "yellow-roses-fix"
+  ]
+}

.changeset/ready-mangos-boil.md

@@ -0,0 +1,5 @@
+---
+"@changesets/action": patch
+---
+
+Fixed usage of `--from-publish-plan` flag used by the `/pack` subaction

.changeset/shaky-rings-type.md

@@ -0,0 +1,5 @@
+---
+"@changesets/action": major
+---
+
+Update to Changesets v3 packages

.changeset/shy-months-crash.md

@@ -0,0 +1,5 @@
+---
+"@changesets/action": minor
+---
+
+Published packages detection done through stdout parsing was replaced with one based on the shared output file using `CHANGESETS_OUTPUT` environment variable. When using custom scripts this environment variable should always be passed down to the Changesets CLI invocations.

.changeset/silent-tips-dance.md

@@ -0,0 +1,5 @@
+---
+"@changesets/action": patch
+---
+
+Fix the `/version` subaction to not crash on missing `pr-base-branch` input. This input is meant to be optional.

.changeset/strict-hotels-laugh.md

@@ -0,0 +1,7 @@
+---
+"@changesets/action": major
+---
+
+Removed `.npmrc` handling when the `NPM_TOKEN` environment variable is set.
+
+Authentication should be handled via Trusted Publishing instead. If a token is still needed, use `actions/setup-node` to set it up instead via the `registry-url` option. Check out the updated action README for more information of setting up npm authentication in GitHub Actions.

.changeset/tidy-bots-smile.md

@@ -0,0 +1,5 @@
+---
+"@changesets/action": patch
+---
+
+Remove the `setup-git-user` input. Complete custom Git identities are now preserved automatically, while `github-actions[bot]` is configured as a fallback before creating local release commits or tags.

.changeset/yellow-roses-fix.md

@@ -0,0 +1,5 @@
+---
+"@changesets/action": major
+---
+
+Rename the input and output names to kebab-case instead of camelCase to match the official GitHub actions pattern

.github/actions/ci-setup/action.yml

@@ -10,11 +10,6 @@ inputs:
 runs:
   using: composite
   steps:
-    - name: Check out repo
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      with:
-        persist-credentials: false
-
     - name: Set up pnpm
       uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6.0.5
 

.github/workflows/ci.yml

@@ -32,7 +32,7 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
         with:
           persona: pedantic
           annotations: true
@@ -43,7 +43,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: $/.github/actions/ci-setup
+      - name: Check out repo
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/ci-setup
 
       - name: Test
         run: pnpm test
@@ -53,7 +58,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: $/.github/actions/ci-setup
+      - name: Check out repo
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/ci-setup
 
       - name: Typecheck
         run: pnpm typecheck
@@ -63,7 +73,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: $/.github/actions/ci-setup
+      - name: Check out repo
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/ci-setup
 
       - name: Format
         run: pnpm format

.github/workflows/publish.yml

@@ -24,7 +24,12 @@ jobs:
     permissions:
       contents: read # to check out repo (actions/checkout)
     steps:
-      - uses: $/.github/actions/ci-setup
+      - name: Check out repo
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/ci-setup
         with:
           skip-cache: true # avoid cache poisoning attacks
 
@@ -45,14 +50,19 @@ jobs:
     permissions:
       contents: read # to check out repo (actions/checkout)
     steps:
-      - uses: $/.github/actions/ci-setup
+      - name: Check out repo
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/ci-setup
         with:
           skip-cache: true # avoid cache poisoning attacks
 
       - name: Build
         run: pnpm build
 
-      - uses: $/.github/actions/setup-bot-auth
+      - uses: ./.github/actions/setup-bot-auth
         id: bot-auth
         with:
           client-id: ${{ vars.APP_CLIENT_ID }}
@@ -77,14 +87,19 @@ jobs:
     permissions:
       contents: write # to create release and have it authored by github-actions (changesets/action)
     steps:
-      - uses: $/.github/actions/ci-setup
+      - name: Check out repo
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/ci-setup
         with:
           skip-cache: true # avoid cache poisoning attacks
 
       - name: Build
         run: pnpm build
 
-      - uses: $/.github/actions/setup-bot-auth
+      - uses: ./.github/actions/setup-bot-auth
         id: bot-auth
         with:
           client-id: ${{ vars.APP_CLIENT_ID }}

.github/workflows/release-pr.yml

@@ -122,7 +122,12 @@ jobs:
       pull-requests: write # to comment on the pull request with the release result (changesets/action)
 
     steps:
-      - uses: $/.github/actions/ci-setup
+      - name: Check out repo
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/ci-setup
         with:
           skip-cache: true # avoid cache poisoning attacks
 
@@ -161,7 +166,7 @@ jobs:
       - name: Build
         run: pnpm build
 
-      - uses: $/.github/actions/setup-bot-auth
+      - uses: ./.github/actions/setup-bot-auth
         id: bot-auth
         with:
           client-id: ${{ vars.APP_CLIENT_ID }}

CHANGELOG.md

@@ -1,71 +1,5 @@
 # @changesets/action
 
-## 2.0.0
-
-### Major Changes
-
-- [#692](https://github.com/changesets/action/pull/692) [`cb3f011`](https://github.com/changesets/action/commit/cb3f0110d7423cd340b1c5d63584c0ea6ee63959) Thanks [@Andarist](https://github.com/Andarist)! - Release commits and tags are now pushed using the GitHub API by default.
-
-  Replace the `commit-mode` input with the boolean `push-with-git-cli` input. Set `push-with-git-cli: true` to continue using the Git CLI.
-
-  Regardless of the push mode, custom GitHub tokens must be passed explicitly through the `github-token` input. The `GITHUB_TOKEN` environment variable and credentials configured by `actions/checkout` or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, `github-token` takes precedence over those repository credentials.
-
-- [#680](https://github.com/changesets/action/pull/680) [`ca57073`](https://github.com/changesets/action/commit/ca57073900dc678254406a052a03c0c8824e319d) Thanks [@bluwy](https://github.com/bluwy)! - Add a new `push-git-tags` option that complements `create-github-releases` to control specifically if git tags should be created but not GitHub releases.
-
-  If `create-github-releases` was previously set to `false`, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set `push-git-tags` to `false` explicitly.
-
-- [#657](https://github.com/changesets/action/pull/657) [`4f718b5`](https://github.com/changesets/action/commit/4f718b5921490b1efeb015a81abb6a4633892851) Thanks [@Andarist](https://github.com/Andarist)! - Removed compatibility support for old Changesets v1.
-
-- [#681](https://github.com/changesets/action/pull/681) [`7359107`](https://github.com/changesets/action/commit/73591071e61c7f61cf322dd7a6341dc29a8e1d4e) Thanks [@bluwy](https://github.com/bluwy)! - Rename the root action inputs and outputs to better match the sub-actions' conventions.
-
-  Inputs:
-
-  - `version` -> `version-script`
-  - `publish` -> `publish-script`
-  - `commit` -> `commit-message`
-  - `title` -> `pr-title`
-  - `branch` -> `pr-base-branch`
-
-  Outputs:
-
-  - `pull-request-number` -> `pr-number`
-
-- [#674](https://github.com/changesets/action/pull/674) [`164652b`](https://github.com/changesets/action/commit/164652bdd60525670d95291addb8c6f92833ac60) Thanks [@bluwy](https://github.com/bluwy)! - Remove support for passing custom GitHub token through the GITHUB_TOKEN environment variable. It should be passed to the `github-token` input instead.
-
-- [#659](https://github.com/changesets/action/pull/659) [`5649ff4`](https://github.com/changesets/action/commit/5649ff41b8eb1b7a281011e45df781c6d4628fd0) Thanks [@bluwy](https://github.com/bluwy)! - Remove `cwd` option for `changesets/action`. Use the step `working-directory` option instead to change the directory.
-
-- [#673](https://github.com/changesets/action/pull/673) [`823cf74`](https://github.com/changesets/action/commit/823cf741ca57c5e22652123d3a847dfafcd77ca0) Thanks [@bluwy](https://github.com/bluwy)! - Update to Changesets v3 packages
-
-- [#695](https://github.com/changesets/action/pull/695) [`469993c`](https://github.com/changesets/action/commit/469993ce5783c6a38e72541d4ba0d25588702b9a) Thanks [@bluwy](https://github.com/bluwy)! - Removed `.npmrc` handling when the `NPM_TOKEN` environment variable is set.
-
-  Authentication should be handled via Trusted Publishing instead. If a token is still needed, use `actions/setup-node` to set it up instead via the `registry-url` option. Check out the updated action README for more information of setting up npm authentication in GitHub Actions.
-
-- [#668](https://github.com/changesets/action/pull/668) [`0eae789`](https://github.com/changesets/action/commit/0eae789230defbc4ad287e9b476aba7e842e34e0) Thanks [@bluwy](https://github.com/bluwy)! - Rename the input and output names to kebab-case instead of camelCase to match the official GitHub actions pattern
-
-### Minor Changes
-
-- [#656](https://github.com/changesets/action/pull/656) [`a12d90d`](https://github.com/changesets/action/commit/a12d90de8394e63c952622b2fd3f98c8729c48b0) Thanks [@bluwy](https://github.com/bluwy)! - Add new `/select-mode`, `/version`, and `/publish` sub-actions to better control version and publish steps
-
-- [#678](https://github.com/changesets/action/pull/678) [`f71ae04`](https://github.com/changesets/action/commit/f71ae043ed5deb17952900091e009a60edef9507) Thanks [@Andarist](https://github.com/Andarist)! - Published packages detection done through stdout parsing was replaced with one based on the shared output file using `CHANGESETS_OUTPUT` environment variable. When using custom scripts this environment variable should always be passed down to the Changesets CLI invocations.
-
-### Patch Changes
-
-- [#699](https://github.com/changesets/action/pull/699) [`5b307d3`](https://github.com/changesets/action/commit/5b307d3df25daf51c41dff70d2f66df1579ae9fa) Thanks [@Andarist](https://github.com/Andarist)! - Validate that projects use Changesets CLI v3 and direct Changesets CLI v2 users to `changesets/action@v1`.
-
-- [#697](https://github.com/changesets/action/pull/697) [`84d78c6`](https://github.com/changesets/action/commit/84d78c68f98f20e24dfff22b22193e7b4f326ad9) Thanks [@Andarist](https://github.com/Andarist)! - Allow custom publish scripts to complete without a Changesets output file, warning that GitHub releases and git tags cannot be created when that file is missing.
-
-- [#670](https://github.com/changesets/action/pull/670) [`5a8b9b7`](https://github.com/changesets/action/commit/5a8b9b721bf683e3bf9bd72ea92a685dc024147b) Thanks [@Andarist](https://github.com/Andarist)! - Authenticate git CLI pushes with the configured GitHub token using Git extra headers instead of writing to a global `.netrc` file.
-
-- [#670](https://github.com/changesets/action/pull/670) [`5a8b9b7`](https://github.com/changesets/action/commit/5a8b9b721bf683e3bf9bd72ea92a685dc024147b) Thanks [@Andarist](https://github.com/Andarist)! - Derive the Git server URL from the GitHub Actions context when configuring git CLI authentication to support GitHub Enterprise Server setups.
-
-- [#688](https://github.com/changesets/action/pull/688) [`219ea82`](https://github.com/changesets/action/commit/219ea82e52caaff2a10a5e34d3455093cf958238) Thanks [@Andarist](https://github.com/Andarist)! - Remove the `setup-git-user` input. Complete custom Git identities are now preserved automatically, while `github-actions[bot]` is configured as a fallback before creating local release commits or tags.
-
-## 2.0.0-next.5
-
-### Patch Changes
-
-- [#711](https://github.com/changesets/action/pull/711) [`5fa6767`](https://github.com/changesets/action/commit/5fa67671df41b7a8a9d8123e8e446b1a8ad423db) Thanks [@Andarist](https://github.com/Andarist)! - Fix support for prerelease exits using the new `.changeset/pre` layout.
-
 ## 2.0.0-next.4
 
 ### Major Changes

dist/index.js

@@ -1 +0,0 @@
-import{A as e,D as t,E as n,O as r,f as i,j as a,k as o,m as s,o as c,p as l,s as u}from"./utils-CAuP846_.js";import{n as d,r as f,t as p}from"./run-NkR1hNWV.js";import{t as m}from"./readChangesetState-D-vw_tSH.js";(async()=>{let h=process.cwd();await s(h),l({publish:`publish-script`,version:`version-script`,commit:`commit-mesage`,title:`pr-title`,branch:`pr-base-branch`,prDraft:`pr-draft`,createGithubReleases:`create-github-releases`}),i();let g=u(`github-token`);if(process.env.GITHUB_TOKEN&&process.env.GITHUB_TOKEN!==g)throw Error(`The GITHUB_TOKEN environment variable is set and does not match the "github-token" input. Please pass the custom GitHub token to the "github-token" input and remove the GITHUB_TOKEN environment variable to avoid conflicts.`);let _=t(`push-with-git-cli`),v=c(`pr-draft`);if(v!==void 0&&v!==`always`&&v!==`create`){e(`Invalid pr-draft: ${v}`);return}let y=new f({cwd:h,githubToken:g,pushWithGitCli:_}),{changesets:b}=await m(h),x=r(`publish-script`),S=b.length!==0,C=b.some(e=>e.releases.length>0),w=!!x;switch(a(`published`,`false`),a(`published-packages`,`[]`),a(`has-changesets`,String(S)),!0){case!S&&!w:o(`No changesets present or were removed by merging release PR. Not publishing because no publish script found.`);return;case!S&&w:{o(`No changesets found. Attempting to publish any unpublished packages to npm`);let e=t(`create-github-releases`),r=t(`push-git-tags`);if(e&&!r)throw Error(`The input 'create-github-releases' is set to true, but 'push-git-tags' is set to false. Creating GitHub releases requires pushing git tags. Please set 'push-git-tags' to true or set 'create-github-releases' to false.`);let i=await p({script:x,github:y,createGithubReleases:e,pushGitTags:r,cwd:h});i.published&&(a(`published`,`true`),a(`published-packages`,JSON.stringify(i.publishedPackages))),i.exitCode!==0&&(n(`Publish command exited with code ${i.exitCode}${i.published?`, but some packages were published: ${i.publishedPackages.map(e=>`${e.name}@${e.version}`).join(`, `)}`:``}`),process.exit(i.exitCode));return}case S&&!C:o(`All changesets are empty; not creating PR`);return;case S:{let{pullRequestNumber:e}=await d({script:c(`version-script`),github:y,cwd:h,prTitle:c(`pr-title`),commitMessage:c(`commit-message`),hasPublishScript:w,prDraft:v,branch:c(`pr-base-branch`)});a(`pr-number`,String(e));return}}})().catch(t=>{n(t),e(t.message)});export{};

dist/pack.js

@@ -1 +0,0 @@
-import{A as e,j as t,m as n,n as r,o as i,t as a,y as o}from"./utils-CAuP846_.js";import s from"node:fs/promises";import c from"node:path";import l from"node:os";try{await u()}catch(t){e(t.message)}async function u(){let e=process.cwd();await n(e);let r=i(`publish-plan-artifact-id`),a=process.env.RUNNER_TEMP??await s.realpath(l.tmpdir()),u=c.join(a,`changeset-pack-${Date.now()}`);await d(e,{outDir:u,publishPlanPath:r?await f(a,Number(r)):void 0});let m=await o.uploadArtifact(`changeset-pack-${Date.now()}`,await p(u),u,{retentionDays:30});if(m.id===void 0)throw Error(`Packed artifact upload did not return an artifact id`);t(`pack-dir-artifact-id`,String(m.id))}async function d(e,t){let n=[`pack`,`--out-dir`,t.outDir];t.publishPlanPath&&n.push(`--from-publish-plan`,t.publishPlanPath),await r(n,{cwd:e,env:process.env})}async function f(e,t){let n=await a(e,t,`changeset-publish-plan`);return c.join(n,`publish-plan.json`)}async function p(e){let t=await s.readdir(e,{withFileTypes:!0});return(await Promise.all(t.map(async t=>{let n=c.join(e,t.name);return t.isDirectory()?p(n):[n]}))).flat()}export{};

dist/pr-comment.js

@@ -1 +0,0 @@
-import{A as e,T as t,j as n,k as r,o as i,s as a,w as o}from"./utils-CAuP846_.js";try{await s()}catch(t){e(t.message)}async function s(){let e=o.payload.pull_request;if(!e)throw Error("This action should only be run on `pull_request_target` or `pull_request` events");let s=a(`github-token`),l=a(`body`),u=i(`update-id`),d=u?c(u):null,f=d?`${d}\n\n${l}`:l,p={repo:e.base.repo.name,owner:e.base.repo.owner.login,issue_number:e.number,body:f},m=t(s),h;if(d&&(r(`Checking for existing comment...`),h=await m.rest.issues.listComments({repo:e.base.repo.name,owner:e.base.repo.owner.login,issue_number:e.number}).then(e=>e.data.find(e=>e.body?.includes(d))?.id)),h)r(`Updating existing comment (id: ${h})...`),await m.rest.issues.updateComment({...p,comment_id:h}),n(`comment-id`,h);else{r(`Creating new comment...`);let e=await m.rest.issues.createComment(p);n(`comment-id`,e.data.id)}r(`Done!`)}function c(e){let t=`changesets-action-pr-comment`;return t===e?`<!-- ${t} -->`:`<!-- ${t}:${e} -->`}export{};

dist/publish.js

@@ -1 +0,0 @@
-import{A as e,D as t,j as n,m as r,o as i,s as a,t as o}from"./utils-CAuP846_.js";import{r as s,t as c}from"./run-NkR1hNWV.js";import l from"node:fs/promises";import u from"node:os";try{await d()}catch(t){e(t.message)}async function d(){let e=process.cwd();await r(e);let d=a(`github-token`),f=i(`script`),p=i(`pack-dir-artifact-id`),m=t(`create-github-releases`),h=t(`push-git-tags`);if(m&&!h)throw Error(`The input 'create-github-releases' is set to true, but 'push-git-tags' is set to false. Creating GitHub releases requires pushing git tags. Please set 'push-git-tags' to true or set 'create-github-releases' to false.`);let g=new s({cwd:e,githubToken:d}),_=p?await o(process.env.RUNNER_TEMP??await l.realpath(u.tmpdir()),Number(p),`changeset-pack`):void 0,v=await c({script:f,github:g,createGithubReleases:m,pushGitTags:h,cwd:e,fromPackDir:_});if(v.published?(n(`published`,`true`),n(`published-packages`,JSON.stringify(v.publishedPackages))):n(`published`,`false`),v.exitCode!==0)throw Error(`Publish command exited with code ${v.exitCode}${v.published?`, but some packages were published: ${v.publishedPackages.map(e=>`${e.name}@${e.version}`).join(`, `)}`:``}`)}export{};

dist/readChangesetState-D-vw_tSH.js

@@ -1 +0,0 @@
-import{i as e,t}from"./dist-Bc2tm86q.js";async function n(n=process.cwd()){let r=await e(n),i=await t(n);return r!==void 0&&r.mode===`pre`?{preState:r,changesets:i.filter(e=>!e.id.startsWith(`pre/`))}:{preState:void 0,changesets:i}}export{n as t};

dist/select-mode.js

@@ -1 +0,0 @@
-import{A as e,j as t,m as n,n as r,y as i}from"./utils-CAuP846_.js";import{t as a}from"./readChangesetState-D-vw_tSH.js";import o from"node:fs/promises";import s from"node:path";import c from"node:os";try{await l()}catch(t){e(t.message)}async function l(){let e=process.cwd();await n(e);let r=await u(e);if(t(`mode`,r.mode),r.mode===`publish`){let e=await i.uploadArtifact(s.basename(r.publishPlanPath,`.json`),[r.publishPlanPath],s.dirname(r.publishPlanPath),{skipArchive:!0,retentionDays:30});if(e.id===void 0)throw Error(`Publish plan artifact upload did not return an artifact id`);t(`publish-plan-artifact-id`,String(e.id))}}async function u(e){let{changesets:t}=await a(e);if(t.length>0)return t.some(e=>e.releases.length>0)?{mode:`version`}:{mode:`none`};let n=s.join(process.env.RUNNER_TEMP??await o.realpath(c.tmpdir()),`changeset-publish-plan-${Date.now()}`,`publish-plan.json`);return await r([`publish-plan`,`--output`,n],{cwd:e,env:process.env}),(await d(n)).length===0?{mode:`none`}:{mode:`publish`,publishPlanPath:n}}async function d(e){let t;try{t=await o.readFile(e,`utf8`)}catch(t){throw Error(`Failed to read publish plan at ${e}`,{cause:t})}let n;try{n=JSON.parse(t)}catch(t){throw Error(`Failed to parse publish plan at ${e}`,{cause:t})}if(typeof n!=`object`||!n||!(`version`in n)||typeof n.version!=`number`||!(`plan`in n)||!Array.isArray(n.plan))throw Error(`Invalid publish plan at ${e}: expected { version: number; plan: unknown[] }`);return n.plan}export{};

dist/version.js

@@ -1 +0,0 @@
-import{A as e,D as t,f as n,j as r,m as i,o as a,s as o}from"./utils-CAuP846_.js";import{n as s,r as c}from"./run-NkR1hNWV.js";try{await l()}catch(t){e(t.message)}async function l(){let e=process.cwd();await i(e),n();let l=o(`github-token`),u=a(`script`),d=o(`commit-message`),f=o(`pr-title`),p=a(`pr-draft`),m=a(`pr-base-branch`),h=t(`push-with-git-cli`);if(p!==void 0&&p!==`always`&&p!==`create`)throw Error(`Invalid pr-draft input: ${p}`);let g=new c({cwd:e,githubToken:l,pushWithGitCli:h}),{pullRequestNumber:_}=await s({script:u,github:g,cwd:e,prTitle:f,commitMessage:d,hasPublishScript:!0,prDraft:p,branch:m});r(`pr-number`,String(_))}export{};

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@changesets/action",
-  "version": "2.0.0",
+  "version": "2.0.0-next.4",
   "private": true,
   "license": "MIT",
   "type": "module",
@@ -23,36 +23,36 @@
     "@actions/core": "^3.0.1",
     "@actions/exec": "^3.0.0",
     "@actions/github": "^9.1.1",
-    "@changesets/get-release-plan": "^5.0.0",
+    "@changesets/get-release-plan": "^5.0.0-next.7",
     "@changesets/ghcommit": "^3.0.0",
-    "@changesets/git": "^4.0.0",
-    "@changesets/pre": "^3.0.0",
-    "@changesets/read": "^1.0.0",
+    "@changesets/git": "^4.0.0-next.6",
+    "@changesets/pre": "^3.0.0-next.6",
+    "@changesets/read": "^1.0.0-next.7",
     "@manypkg/get-packages": "^3.1.0",
-    "@octokit/core": "^7.0.7",
-    "@octokit/plugin-throttling": "^11.0.5",
-    "human-id": "^4.2.0",
+    "@octokit/core": "^7.0.6",
+    "@octokit/plugin-throttling": "^11.0.3",
+    "human-id": "^4.1.3",
     "markdown-table": "^3.0.4",
-    "semver": "^7.8.5",
-    "tinyexec": "^1.3.0"
+    "semver": "^7.8.1",
+    "tinyexec": "^1.2.4"
   },
   "devDependencies": {
-    "@changesets/changelog-github": "^1.0.0",
-    "@changesets/cli": "^3.0.0",
-    "@changesets/types": "^7.0.0",
-    "@changesets/write": "^1.0.0",
+    "@changesets/changelog-github": "^1.0.0-next.6",
+    "@changesets/cli": "^3.0.0-next.8",
+    "@changesets/types": "^7.0.0-next.6",
+    "@changesets/write": "^1.0.0-next.6",
     "@tsconfig/node24": "^24.0.4",
-    "@types/node": "^26.1.2",
-    "@types/semver": "^7.8.0",
-    "fs-fixture": "^2.14.0",
-    "oxfmt": "^0.61.0",
-    "rolldown": "^1.2.2",
+    "@types/node": "^24.12.4",
+    "@types/semver": "^7.7.1",
+    "fs-fixture": "^2.13.0",
+    "oxfmt": "^0.48.0",
+    "rolldown": "^1.0.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10",
+    "vitest": "^4.1.6",
     "yaml": "^2.9.0"
   },
   "engines": {
     "node": ">=24"
   },
-  "packageManager": "pnpm@11.20.0+sha512.9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee"
+  "packageManager": "pnpm@11.1.1+sha512.d1fdf5f73c617b64fa1a56a81c3c8dfe0e966e33a6010aa256b517ae77be21d93e05affc0de1a83b0e4f29d569f68b446ae8f068cd7247c0bb3df0fb4d7bdf9a"
 }

pnpm-workspace.yaml

@@ -3,24 +3,22 @@ dedupePeers: true
 dedupePeerDependents: true
 minimumReleaseAge: 10080
 minimumReleaseAgeExclude:
-  - "@changesets/apply-release-plan@8.0.0"
-  - "@changesets/assemble-release-plan@7.0.0"
-  - "@changesets/changelog-git@1.0.0"
-  - "@changesets/changelog-github@1.0.0"
-  - "@changesets/cli@3.0.0"
-  - "@changesets/config@4.0.0"
-  - "@changesets/errors@1.0.0"
-  - "@changesets/get-dependents-graph@3.0.0"
-  - "@changesets/get-github-info@1.0.0"
-  - "@changesets/get-release-plan@5.0.0"
-  - "@changesets/git@4.0.0"
-  - "@changesets/parse@1.0.0"
-  - "@changesets/pre@3.0.0"
-  - "@changesets/read@1.0.0"
-  - "@changesets/should-skip-package@1.0.0"
-  - "@changesets/types@7.0.0"
-  - "@changesets/write@1.0.0"
-  - "vite@8.2.0"
+  - "@changesets/apply-release-plan@8.0.0-next.7"
+  - "@changesets/assemble-release-plan@7.0.0-next.7"
+  - "@changesets/changelog-git@1.0.0-next.6"
+  - "@changesets/changelog-github@1.0.0-next.6"
+  - "@changesets/cli@3.0.0-next.8"
+  - "@changesets/config@4.0.0-next.6"
+  - "@changesets/get-dependents-graph@3.0.0-next.6"
+  - "@changesets/get-github-info@1.0.0-next.3"
+  - "@changesets/get-release-plan@5.0.0-next.7"
+  - "@changesets/git@4.0.0-next.6"
+  - "@changesets/parse@1.0.0-next.7"
+  - "@changesets/pre@3.0.0-next.6"
+  - "@changesets/read@1.0.0-next.7"
+  - "@changesets/should-skip-package@1.0.0-next.6"
+  - "@changesets/types@7.0.0-next.6"
+  - "@changesets/write@1.0.0-next.6"
 
 overrides:
   lightningcss: "-" # we do not bundle any css

scripts/release.ts

@@ -1,11 +1,15 @@
 import { Buffer } from "node:buffer";
 import path from "node:path";
-import { exec } from "@actions/exec";
+import { exec, getExecOutput } from "@actions/exec";
+import major from "semver/functions/major.js";
+import prerelease from "semver/functions/prerelease.js";
 import pkgJson from "../package.json" with { type: "json" };
 
 const tag = `v${pkgJson.version}`;
-const releaseLine = `v${pkgJson.version.split(".")[0]}`;
-const isPrerelease = pkgJson.version.includes("-");
+const prereleaseTag = prerelease(pkgJson.version)?.[0];
+const releaseLine = `v${major(pkgJson.version)}${
+  prereleaseTag === undefined ? "" : `-${prereleaseTag}`
+}`;
 const githubToken = process.env.GITHUB_TOKEN;
 if (!githubToken) {
   throw new Error("GITHUB_TOKEN is required");
@@ -21,27 +25,36 @@ const gitEnv = {
 process.chdir(path.join(import.meta.dirname, ".."));
 
 await exec("git", ["checkout", "--detach"]);
+// Stable timestamps make retries produce the same commit when dist is unchanged.
+const { stdout } = await getExecOutput("git", [
+  "show",
+  "--no-patch",
+  "--format=%cI",
+  "HEAD",
+]);
+const commitDate = stdout.trim();
 await exec("git", ["add", "--force", "dist"]);
-await exec("git", ["commit", "-m", tag]);
+await exec("git", ["commit", "-m", tag], {
+  env: {
+    ...process.env,
+    GIT_AUTHOR_DATE: commitDate,
+    GIT_COMMITTER_DATE: commitDate,
+  },
+});
 
 await exec("changeset", ["git-tag"]);
 
-if (isPrerelease) {
-  await exec("git", ["push", "origin", `refs/tags/${tag}`], {
+await exec(
+  "git",
+  [
+    "push",
+    "--force",
+    // The action pushes tags through the API; override any push.followTags config.
+    "--no-follow-tags",
+    "origin",
+    `HEAD:refs/heads/${releaseLine}`,
+  ],
+  {
     env: gitEnv,
-  });
-} else {
-  await exec(
-    "git",
-    [
-      "push",
-      "--force",
-      "--follow-tags",
-      "origin",
-      `HEAD:refs/heads/${releaseLine}`,
-    ],
-    {
-      env: gitEnv,
-    },
-  );
-}
+  },
+);

src/github.ts

@@ -1,3 +1,4 @@
+import assert from "node:assert/strict";
 import { Buffer } from "node:buffer";
 import * as core from "@actions/core";
 import { exec, getExecOutput } from "@actions/exec";
@@ -67,6 +68,19 @@ function getHttpUrl(remoteUrl: string): string | undefined {
   }
 }
 
+function isAlreadyExistingRefError(error: unknown) {
+  return (
+    typeof error === "object" &&
+    error !== null &&
+    "status" in error &&
+    "message" in error &&
+    typeof error.status === "number" &&
+    typeof error.message === "string" &&
+    error.status === 422 &&
+    error.message.includes("Reference already exists")
+  );
+}
+
 export class GitHub {
   readonly #githubToken: string;
   readonly octokit: Octokit;
@@ -212,18 +226,57 @@ export class GitHub {
     );
   }
 
-  async pushTag(tag: string) {
+  async #getRemoteTagCommit(tag: string) {
+    const { data: ref } = await this.octokit.rest.git.getRef({
+      ...context.repo,
+      ref: `tags/${tag}`,
+    });
+    let target: { type: string; sha: string } = ref.object;
+    while (target.type === "tag") {
+      const { data: tagObject } = await this.octokit.rest.git.getTag({
+        ...context.repo,
+        tag_sha: target.sha,
+      });
+      target = tagObject.object;
+    }
+    assert.equal(
+      target.type,
+      "commit",
+      `Tag ${tag} points to a ${target.type}, not a commit`,
+    );
+    return target.sha;
+  }
+
+  async pushTag(tag: string, commit = context.sha) {
     if (!this.pushWithGitCli) {
-      return this.octokit.rest.git
-        .createRef({
+      try {
+        const { data: tagObject } = await this.octokit.rest.git.createTag({
+          ...context.repo,
+          tag,
+          message: tag,
+          object: commit,
+          type: "commit",
+        });
+        await this.octokit.rest.git.createRef({
           ...context.repo,
           ref: `refs/tags/${tag}`,
-          sha: context.sha,
-        })
-        .catch((err) => {
-          // Assuming tag was manually pushed in custom publish script
-          core.warning(`Failed to create tag ${tag}: ${err.message}`);
+          sha: tagObject.sha,
         });
+      } catch (err) {
+        if (isAlreadyExistingRefError(err)) {
+          const remoteCommit = await this.#getRemoteTagCommit(tag);
+          assert.equal(
+            remoteCommit,
+            commit,
+            `Tag ${tag} points to commit ${remoteCommit}, expected ${commit}`,
+          );
+          // The tag was likely pushed by a custom publish script.
+          core.info(`Tag ${tag} already exists`);
+          return;
+        }
+        throw err;
+      }
+      return;
     }
     await exec("git", ["push", "origin", tag], {
       cwd: this.cwd,

src/readChangesetState.test.ts

@@ -1,40 +0,0 @@
-import { createFixture } from "fs-fixture";
-import { describe, expect, it } from "vitest";
-import readChangesetState from "./readChangesetState.ts";
-
-const changeset = `---
-"pkg-a": patch
----
-
-Fix a bug.
-`;
-
-describe("readChangesetState", () => {
-  it("filters versioned changesets in prerelease mode", async () => {
-    await using fixture = await createFixture({
-      ".changeset/pre.json": JSON.stringify({ mode: "pre", tag: "next" }),
-      ".changeset/pre/versioned.md": changeset,
-      ".changeset/pending.md": changeset,
-    });
-
-    const state = await readChangesetState(fixture.path);
-
-    expect(state.changesets.map((changeset) => changeset.id)).toEqual([
-      "pending",
-    ]);
-  });
-
-  it("includes versioned changesets when exiting prerelease mode", async () => {
-    await using fixture = await createFixture({
-      ".changeset/pre.json": JSON.stringify({ mode: "exit", tag: "next" }),
-      ".changeset/pre/versioned.md": changeset,
-    });
-
-    const state = await readChangesetState(fixture.path);
-
-    expect(state.preState).toBeUndefined();
-    expect(state.changesets.map((changeset) => changeset.id)).toEqual([
-      "pre/versioned",
-    ]);
-  });
-});

src/readChangesetState.ts

@@ -14,11 +14,11 @@ export default async function readChangesetState(
   let changesets = await readChangesets(cwd);
 
   if (preState !== undefined && preState.mode === "pre") {
+    let changesetsToFilter = new Set(preState.changesets);
+
     return {
       preState,
-      changesets: changesets.filter(
-        (changeset) => !changeset.id.startsWith("pre/"),
-      ),
+      changesets: changesets.filter((x) => !changesetsToFilter.has(x.id)),
     };
   }
 

src/run.ts

@@ -1,3 +1,5 @@
+import assert from "node:assert/strict";
+import { Buffer } from "node:buffer";
 import { randomUUID } from "node:crypto";
 import fs from "node:fs/promises";
 import os from "node:os";
@@ -155,6 +157,45 @@ async function readChangesetsOutput(outputPath: string) {
   return events;
 }
 
+type Release = {
+  pkg: Package;
+  tag: string;
+  commit?: string;
+};
+
+async function getTagCommits(cwd: string, tags: string[]) {
+  if (tags.length === 0) {
+    return [];
+  }
+  const refs = tags.map((tag) => `refs/tags/${tag}^{}`);
+  const { stdout } = await getExecOutput(
+    "git",
+    ["cat-file", "--batch-check=%(objectname) %(objecttype)"],
+    {
+      cwd,
+      input: Buffer.from(`${refs.join("\n")}\n`),
+    },
+  );
+  const lines = stdout.trim().split(/\r?\n/);
+  assert.equal(
+    lines.length,
+    tags.length,
+    "Git returned an unexpected number of tag targets",
+  );
+  return lines.map((line, index) => {
+    if (line === `${refs[index]} missing`) {
+      return undefined;
+    }
+    const [commit, type] = line.split(" ");
+    assert.equal(
+      type,
+      "commit",
+      `Tag ${tags[index]} does not point to a commit`,
+    );
+    return commit;
+  });
+}
+
 export async function runPublish({
   script,
   fromPackDir,
@@ -214,7 +255,7 @@ export async function runPublish({
     );
     output = [];
   }
-  let releases = output.map((event) => {
+  let releases: Release[] = output.map((event) => {
     let pkg = packagesByName.get(event.packageName);
     if (pkg === undefined) {
       throw new Error(
@@ -232,11 +273,22 @@ export async function runPublish({
     );
   }
 
+  if (pushGitTags) {
+    const commits = await getTagCommits(
+      cwd,
+      releases.map(({ tag }) => tag),
+    );
+    releases = releases.map((release, index) => ({
+      ...release,
+      commit: commits[index],
+    }));
+  }
+
   if (createGithubReleases || pushGitTags) {
     await Promise.all(
-      releases.map(async ({ pkg, tag }) => {
+      releases.map(async ({ pkg, tag, commit }) => {
         if (pushGitTags) {
-          await github.pushTag(tag);
+          await github.pushTag(tag, commit);
         }
         if (createGithubReleases) {
           await createRelease(octokit, { pkg, tagName: tag });