Refactor release flow to PR-time Dependabot changesets

.changeset/README.md

@@ -0,0 +1,8 @@
+# Changesets
+
+Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works
+with multi-package repos, or single-package repos to help you version and publish your code. You can
+find the full documentation for it [in our repository](https://github.com/changesets/changesets)
+
+We have a quick list of common questions to get you started engaging with this project in
+[our documentation](https://github.com/changesets/changesets/blob/main/docs/common-questions.md)

.changeset/config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@4.0.0/schema.json",
+  "changelog": ["@changesets/changelog-github", {"repo": "github/remote-input-element"}],
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

.github/workflows/check-for-changeset.yml

@@ -0,0 +1,38 @@
+name: Check for changeset
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - labeled
+      - unlabeled
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  check:
+    if: github.event.pull_request.user.login != 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check for changeset or skip label
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          if gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/labels" --paginate --jq '.[].name' | grep -qx 'skip changeset'; then
+            echo 'The "skip changeset" label is present.'
+            exit 0
+          fi
+
+          changesets=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/files" --paginate --jq '.[] | select(.status != "removed") | .filename' | grep -E '^\.changeset/[^/]+\.md$' | grep -Ev '^\.changeset/(README\.md|dependabot-[0-9]+\.md)$' || true)
+          if [ -n "$changesets" ]; then
+            echo 'The ".changeset/*.md" file pattern matched the changed files of the pull request.'
+            exit 0
+          fi
+
+          echo 'No changeset found. If these changes should not result in a new version, apply the "skip changeset" label to this pull request. If these changes should result in a version bump, run "npx changeset" and commit the generated file.'
+          exit 1

.github/workflows/dependabot-changeset.yml

@@ -0,0 +1,57 @@
+name: Dependabot changeset
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - synchronize
+
+concurrency:
+  group: dependabot-changeset-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  changeset:
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Create GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          app-id: ${{ vars.PRIMER_APP_ID_SHARED }}
+          private-key: ${{ secrets.PRIMER_APP_PRIVATE_KEY_SHARED }}
+          permission-contents: write
+          permission-pull-requests: read
+          permission-vulnerability-alerts: read
+
+      - name: Fetch Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@08eff52bf64351f401fb50d4972fa95b9f2c2d1b
+        with:
+          github-token: ${{ steps.app-token.outputs.token }}
+          alert-lookup: true
+
+      - name: Check out trusted base code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          persist-credentials: false
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Apply Dependabot changeset policy
+        run: node scripts/dependabot-changeset.mjs
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+          DEPENDABOT_DEPENDENCY_NAMES: ${{ steps.metadata.outputs.dependency-names }}
+          DEPENDABOT_UPDATED_DEPENDENCIES_JSON: ${{ steps.metadata.outputs.updated-dependencies-json }}
+          DEPENDABOT_ALERT_STATE: ${{ steps.metadata.outputs.alert-state }}
+          DEPENDABOT_GHSA_ID: ${{ steps.metadata.outputs.ghsa-id }}

.github/workflows/pr.yml

@@ -24,3 +24,5 @@ jobs:
         run: npm run build
       - name: Run test
         run: npm run test
+      - name: Run Dependabot changeset policy tests
+        run: npm run test:dependabot-changeset

.github/workflows/release.yml

@@ -0,0 +1,46 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch: {}
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
+permissions:
+  contents: write
+  pull-requests: write
+  id-token: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Full history and tags let Changesets generate GitHub changelogs
+          # with the correct commits.
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+
+      - name: Update npm for trusted publishing
+        run: npm install -g npm@latest
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run tests
+        run: npm test
+
+      - name: Create release pull request or publish
+        uses: changesets/action@v2
+        with:
+          pr-title: 'Release tracking'
+          publish-script: npm run release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

README.md

@@ -71,6 +71,17 @@ npm install
 npm test
 ```
 
+## Releasing
+
+This project uses [Changesets](https://github.com/changesets/changesets) to manage versioning, changelogs, and publishing to npm.
+
+- **Human-authored pull requests**: For a user-facing change, run `npx changeset`, describe the change, and choose a `patch`, `minor`, or `major` bump. Commit the generated changeset with the change. If a pull request should not produce a release, apply the `skip changeset` label instead.
+- **Dependabot pull requests**: Dependabot PRs are exempt from the human changeset check. A dedicated workflow adds one deterministic patch changeset when a Dependabot update resolves a security alert or changes the declared range of a direct production dependency in `package.json`.
+- **Dependency updates without releases**: Direct development dependency updates, indirect dependency updates, and lockfile-only updates already permitted by the existing `package.json` range do not get changesets unless they resolve a Dependabot security alert.
+- **Dependabot automation credentials**: The Dependabot changeset workflow uses the shared Primer GitHub App credentials (`PRIMER_APP_ID_SHARED` and `PRIMER_APP_PRIVATE_KEY_SHARED`). The App needs Contents write, Pull requests read, and Dependabot alerts read permissions so it can look up security-alert metadata and commit the generated changeset to the Dependabot branch without a personal access token.
+- **Release pull request**: The [`release` workflow](.github/workflows/release.yml) opens or updates a **Release tracking** pull request using `changesets/action@v2`. Changesets owns release aggregation, versioning, changelog generation, and publishing. Merging that pull request publishes the package to npm and records the new version and changelog in the repository.
+- **Manual runs**: Use the **Run workflow** button for the `Release` workflow (`workflow_dispatch`) to refresh release tracking without waiting for another push to `main`.
+
 ## License
 
 Distributed under the MIT license. See LICENSE for details.