From afc5a630fbdb6ae927b0bf644ef20ce6e2b93955 Mon Sep 17 00:00:00 2001
From: Scott Vandehey <scott@cloudfour.com>
Date: Tue, 25 Aug 2026 17:01:52 -0700
Subject: [PATCH] Pin changesets/action and migrate to v2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

changesets/action@master is worse than unpinned. That repo's default
branch is `main`; `master` was last touched in November 2021, while the
action has since shipped through v2.1.1 this month. The ref wasn't
drifting, it was frozen on a four-year-old build with nothing to signal
that development had moved elsewhere.

v2 renames every input this workflow used, so the pin can't be done
alone:

  publish -> publish-script    title  -> pr-title
  version -> version-script    commit -> commit-message

Two further breaking changes needed handling. v2 no longer reads a token
from the GITHUB_TOKEN environment variable; the `github-token` input
defaults to the GitHub-provided token, which is what this used, so it is
dropped. And v2 no longer writes an .npmrc from NPM_TOKEN —
authentication moves to setup-node's registry-url plus NODE_AUTH_TOKEN.
Without that, publishing would fail on credentials.

v2 requires Changesets v3; this repo is on @changesets/cli 3.0.1.

Also lifts the pinned Node version into an env var, matching ci.yml.
---
 .github/workflows/changesets.yml | 33 +++++++++++++++++++++++---------
 1 file changed, 24 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/changesets.yml b/.github/workflows/changesets.yml
index 10c7e3bf1..0849a3b7e 100644
--- a/.github/workflows/changesets.yml
+++ b/.github/workflows/changesets.yml
@@ -5,21 +5,34 @@ on:
     branches:
       - main
 
+env:
+  NODE_VERSION: 24.19.0
+
 jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
+    # Required by changesets/action v2 to commit version changes and open the
+    # release PR. Declaring them explicitly also drops every other permission
+    # the default token would otherwise carry.
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v7.0.1
         with:
           # Fetch all git history for correct changelog commits
           fetch-depth: 0
-      - name: Use Node.js 24
+      - name: Use Node.js ${{ env.NODE_VERSION }}
         uses: actions/setup-node@v7.0.0
         with:
-          node-version: 24.19.0
+          node-version: ${{ env.NODE_VERSION }}
           cache: 'npm'
+          # Writes an .npmrc that reads NODE_AUTH_TOKEN. changesets/action v2
+          # no longer writes one from NPM_TOKEN itself, so without this the
+          # publish step has no credentials.
+          registry-url: 'https://registry.npmjs.org'
       - name: Install Dependencies
         run: npm ci
       - name: Run Preprocess
@@ -27,12 +40,14 @@ jobs:
       - name: Run Build
         run: npm run build
       - name: Create Release Pull Request or Publish to npm
-        uses: changesets/action@master
+        uses: changesets/action@v2.1.1
         with:
-          publish: npm run release
-          version: npm run version
-          title: 'Publish Next Version'
-          commit: 'Publish Next Version'
+          publish-script: npm run release
+          version-script: npm run version
+          pr-title: 'Publish Next Version'
+          commit-message: 'Publish Next Version'
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          # v2 removed support for passing a token via GITHUB_TOKEN. The
+          # `github-token` input defaults to the GitHub-provided token, which
+          # is what this workflow used before, so it is left unset.
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}