chore: switch to changesets - #6511
Conversation
|
View your CI Pipeline Execution ↗ for commit 62d22ee
☁️ Nx Cloud last updated this comment at |
🚀 Changeset Version PreviewNo changeset entries found. Merging this PR will not cause a version bump for any packages. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe repository replaces its legacy publishing flow with Changesets. It adds release configuration, contributor guidance, pull request previews, and automated package versioning and publishing through GitHub Actions. ChangesChangesets release workflow
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr.yml:
- Around line 74-88: Update the “Changeset Preview” step in the version-preview
job to reference an action revision of TanStack/config/.github/changeset-preview
that includes a committed lockfile and uses npm ci, then pin the workflow to
that immutable revision while preserving the existing permissions and step
behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d1400b69-02a1-4c81-a008-483a9f82eeb1
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (9)
.changeset/config.json.github/pull_request_template.md.github/workflows/pr.yml.github/workflows/release.ymlCONTRIBUTING.mdpackage.jsonscripts/config.jsscripts/publish.jsscripts/types.d.ts
💤 Files with no reviewable changes (3)
- scripts/types.d.ts
- scripts/publish.js
- scripts/config.js
| version-preview: | ||
| name: Version Preview | ||
| permissions: | ||
| contents: read | ||
| pull-requests: write | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | ||
| with: | ||
| persist-credentials: false | ||
| - name: Setup Tools | ||
| uses: tanstack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main | ||
| - name: Changeset Preview | ||
| uses: TanStack/config/.github/changeset-preview@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ref='e4b48f16568324f76f467aa4c2aac2f05db632c3'
base="https://raw.githubusercontent.com/TanStack/config/${ref}/.github/changeset-preview"
curl -fsSL "${base}/action.yml" | sed -n '8,16p'
curl -fsSL "${base}/package.json" | jq '.dependencies'Repository: TanStack/table
Length of output: 411
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ref='e4b48f16568324f76f467aa4c2aac2f05db68f16568324f76f467aa4c2aac2f05db632c3'
# Avoid URL collisions with malformed ref; show only results for the actual pinned ref.
for r in e4b48f16568324f76f467aa4c2aac2f05db632c3; do
base="https://raw.githubusercontent.com/TanStack/config/${r}/.github/changeset-preview"
echo "== ref: ${r} =="
echo "--- action.yml ---"
curl -fsSL "${base}/action.yml" | nl -ba | sed -n '1,80p'
echo "--- package files ---"
for f in package.json package-lock.json npm-shrinkwrap.json yarn.lock pnpm-lock.yaml; do
if curl -fsSL "${base}/${f}" | head -c 1 > /dev/null 2>&1; then
echo "### ${f}"
if [ "$f" = "package.json" ]; then
curl -fsSL "${base}/${f}" | jq '{scripts, dependencies, devDependencies}'
elif [ "$f" = "package-lock.json" ]; then
curl -fsSL "${base}/${f}" | jq '{lockfileVersion, requiresRootLockfile, packages[""].version, packages[""].dependencies, packages[""].devDependencies, has lockfileVersion}'
else
curl -fsSL "${base}/${f}" | head -n 80
fi
else
echo "### ${f} missing"
fi
done
done
echo "== workflow snippet =="
sed -n '70,90p' .github/workflows/pr.yml | nl -baRepository: TanStack/table
Length of output: 290
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ref='e4b48f16568324f76f467aa4c2aac2f05db632c3'
echo "== action.yml first 80 lines =="
for line in $(seq 1 80); do
printf '%d: ' "$line"
curl -fsSL "https://raw.githubusercontent.com/TanStack/config/${ref}/.github/changeset-preview/action.yml" 2>/dev/null | sed -n "${line},${line}p"
done
echo
echo "== package metadata and lockfiles =="
for f in package.json package-lock.json npm-shrinkwrap.json yarn.lock pnpm-lock.yaml; do
url="https://raw.githubusercontent.com/TanStack/config/${ref}/.github/changeset-preview/${f}"
if curl -fsSLI "$url" >/dev/null 2>&1; then
echo "### ${f} exists"
if [ "$f" = "package.json" ]; then
curl -fsSL "$url" | sed -n '1,220p'
else
curl -fsSL "$url" | sed -n '1,40p'
fi
else
echo "### ${f} missing"
fi
done
echo
echo "== workflow preview job =="
awk 'NR>=70 && NR<=90 {printf "%d: %s\n", NR, $0}' .github/workflows/pr.ymlRepository: TanStack/table
Length of output: 1318
Pin the preview action runtime dependencies.
TanStack/config/.github/changeset-preview runs npm install and declares @changesets/get-release-plan@^4.0.16 without a lockfile. This lets npm resolve a mutable dependency for each PR, while the job has pull-requests: write. Use an action revision with a committed lockfile and npm ci, then pin the workflow to that revision.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr.yml around lines 74 - 88, Update the “Changeset
Preview” step in the version-preview job to reference an action revision of
TanStack/config/.github/changeset-preview that includes a committed lockfile and
uses npm ci, then pin the workflow to that immutable revision while preserving
the existing permissions and step behavior.
1 participant
🎯 Changes
✅ Checklist
pnpm test:pr.Summary by CodeRabbit
Release Process
Documentation
Developer Workflow