Update Changesets

.changeset/config.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://unpkg.com/@changesets/config@3.0.2/schema.json",
+  "$schema": "https://unpkg.com/@changesets/config@4.0.0/schema.json",
   "changelog": [
     "@changesets/changelog-github",
     { "repo": "changesets/ghcommit" }

.github/actions/ci-setup/action.yml

@@ -10,10 +10,20 @@ inputs:
     description: "Whether to skip the cache"
     required: false
     default: "false"
+  checkout-fetch-depth:
+    description: "Number of commits to fetch"
+    required: false
+    default: "1"
 
 runs:
   using: composite
   steps:
+    - name: Check out repo
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        fetch-depth: ${{ inputs.checkout-fetch-depth }}
+        persist-credentials: false
+
     - name: Set up pnpm
       uses: pnpm/action-setup@91ab88e2619ed1f46221f0ba42d1492c02baf788 # v6.0.6
 

.github/workflows/ci.yml

@@ -32,8 +32,9 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
         with:
+          version: "1.29.0"
           persona: pedantic
           annotations: true
           advanced-security: false
@@ -43,12 +44,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - name: Check out repo
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - uses: ./.github/actions/ci-setup
+      - uses: $/.github/actions/ci-setup
 
       - name: Build
         run: pnpm build
@@ -69,14 +65,9 @@ jobs:
     permissions:
       contents: write # integration tests create and push temporary branches
     steps:
-      - name: Check out repo
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 2 # integration tests read the two most recent local commits
-          persist-credentials: false
-
-      - uses: ./.github/actions/ci-setup
+      - uses: $/.github/actions/ci-setup
         with:
+          checkout-fetch-depth: 2 # integration tests read the two most recent local commits
           skip-cache: true # avoid cache poisoning from this only job with write access, just in case
 
       - name: Build
@@ -92,11 +83,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - uses: ./.github/actions/ci-setup
+      - uses: $/.github/actions/ci-setup
 
       - name: Codegen
         run: pnpm codegen:github
@@ -109,11 +96,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - uses: ./.github/actions/ci-setup
+      - uses: $/.github/actions/ci-setup
 
       - name: Codegen
         run: pnpm codegen:github

.github/workflows/publish.yml

@@ -15,22 +15,36 @@ concurrency:
 permissions: {} # each job should define its own permission explicitly
 
 jobs:
-  version:
-    name: Version
+  select-mode:
+    name: Select Mode
     runs-on: ubuntu-latest
     environment: version
     timeout-minutes: 10
     outputs:
-      hasChangesets: ${{ steps.changesets.outputs.hasChangesets }}
+      mode: ${{ steps.select-mode.outputs.mode }}
+      publish-plan-artifact-id: ${{ steps.select-mode.outputs.publish-plan-artifact-id }}
     permissions:
       contents: read # to check out repo (actions/checkout)
     steps:
-      - name: Check out repo
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: $/.github/actions/ci-setup
         with:
-          persist-credentials: false
+          skip-cache: true # avoid cache poisoning attacks
+
+      - name: Select mode
+        id: select-mode
+        uses: changesets/action/select-mode@22ccf9aa43179fe9e27dc62e575971d28cce197c # v2.0.0
 
-      - uses: ./.github/actions/ci-setup
+  version:
+    name: Version
+    needs: select-mode
+    if: needs.select-mode.outputs.mode == 'version'
+    runs-on: ubuntu-latest
+    environment: version
+    timeout-minutes: 10
+    permissions:
+      contents: read # to check out repo (actions/checkout)
+    steps:
+      - uses: $/.github/actions/ci-setup
         with:
           skip-cache: true # avoid cache poisoning attacks
 
@@ -44,33 +58,50 @@ jobs:
 
       - name: Create or update release pull request
         id: changesets
-        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
+        uses: changesets/action/version@22ccf9aa43179fe9e27dc62e575971d28cce197c # v2.0.0
         with:
           github-token: ${{ steps.app-token.outputs.token }}
-          version: pnpm version-packages
+          script: pnpm version-packages
+
+  pack:
+    name: Pack
+    needs: select-mode
+    if: needs.select-mode.outputs.mode == 'publish'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    outputs:
+      pack-dir-artifact-id: ${{ steps.pack.outputs.pack-dir-artifact-id }}
+    permissions:
+      contents: read # to check out repo (actions/checkout)
+    steps:
+      - uses: $/.github/actions/ci-setup
+        with:
+          skip-cache: true # avoid cache poisoning attacks
+
+      - name: Build
+        run: pnpm build
+
+      - name: Pack
+        id: pack
+        uses: changesets/action/pack@22ccf9aa43179fe9e27dc62e575971d28cce197c # v2.0.0
+        with:
+          publish-plan-artifact-id: ${{ needs.select-mode.outputs.publish-plan-artifact-id }}
 
   publish:
     name: Publish
-    if: needs.version.outputs.hasChangesets == 'false'
-    needs: version
+    needs: pack
     runs-on: ubuntu-latest
     environment: npm
     timeout-minutes: 10
     permissions:
       contents: write # to create release (changesets/action)
       id-token: write # to use OpenID Connect token for trusted publishing (changesets/action)
     steps:
-      - name: Check out repo
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - uses: ./.github/actions/ci-setup
+      - uses: $/.github/actions/ci-setup
         with:
           skip-cache: true # avoid cache poisoning attacks
 
       - name: Publish to npm
-        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
+        uses: changesets/action/publish@22ccf9aa43179fe9e27dc62e575971d28cce197c # v2.0.0
         with:
-          publish: pnpm release
-          commitMode: github-api
+          pack-dir-artifact-id: ${{ needs.pack.outputs.pack-dir-artifact-id }}

package.json

@@ -42,16 +42,15 @@
     "lint": "oxlint",
     "test:unit": "vitest",
     "test:integration": "vitest -c vitest.integration.config.ts",
-    "version-packages": "changeset version && pnpm format:fix",
-    "release": "pnpm build && changeset publish"
+    "version-packages": "changeset version && pnpm format:fix"
   },
   "dependencies": {
     "tinyexec": "^1.2.4"
   },
   "devDependencies": {
     "@actions/github": "^9.1.1",
-    "@changesets/changelog-github": "^0.7.0",
-    "@changesets/cli": "^2.31.1",
+    "@changesets/changelog-github": "^1.0.0",
+    "@changesets/cli": "^3.0.0",
     "@graphql-codegen/cli": "^7.2.0",
     "@tsconfig/node22": "^22.0.5",
     "@types/node": "^26.1.1",