Refactor release flow to PR-time Dependabot changesets

[Copilot]

This PR automatically adds patch changesets to qualifying Dependabot updates, allowing our usual @changesets release flow to follow our other repositories, such as primer/react.

• Dependabot changeset automation

  • Added a pull_request_target workflow scoped to dependabot[bot].

  • Uses pinned dependabot/fetch-metadata with alert-lookup: true.

  • Compares base/head package.json files without executing PR code.

  • Creates, updates, or removes one deterministic changeset:

    .changeset/dependabot-<pr-number>.md

  • Adds a patch changeset when a Dependabot PR resolves a security alert or changes a direct production dependency range.

• Human PR changeset policy

  • Added a PR check requiring .changeset/*.md for non-Dependabot PRs.
  • Allows the skip changeset label when no release is required.
  • Exempts Dependabot PRs so the dedicated workflow owns dependency release decisions.

[Copilot]

Pull request overview

Refactors releases around Changesets and automates changeset policy for human and Dependabot PRs.

Changes:

• Adds Changesets release configuration and automation.
• Generates patch changesets for qualifying Dependabot updates.
• Enforces changesets or a skip label on human PRs.

Show a summary per file

File	Description
.changeset/README.md	Documents Changesets.
.changeset/config.json	Configures package releases.
.github/workflows/check-for-changeset.yml	Enforces human PR policy.
.github/workflows/dependabot-changeset.yml	Automates Dependabot changesets.
.github/workflows/pr.yml	Runs policy tests.
.github/workflows/publish.yml	Removes legacy publishing.
.github/workflows/release.yml	Adds Changesets releases.
README.md	Documents release procedures.
package-lock.json	Locks Changesets dependencies.
package.json	Adds release tooling and metadata.
scripts/dependabot-changeset.mjs	Implements Dependabot policy.
scripts/dependabot-changeset.test.mjs	Tests policy evaluation.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 11/12 changed files
• Comments generated: 7
• Review effort level: Balanced

[francinelucca]

seeing some high level callouts from copilot, please re-request review when those have been addressed

[Copilot]

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

scripts/dependabot-changeset.mjs:103

• The 404 shortcut also applies to PUT and DELETE, so a failed write (for example, a missing branch or inaccessible resource) is treated as success and applyDependabotChangeset reports created/removed even though no commit was made. Only a GET uses 404 to mean “no existing changeset”; mutation responses should flow through the error path.

  if (response.status === 404) return undefined

• Files reviewed: 11/12 changed files
• Comments generated: 2
• Review effort level: Balanced