ci: upgrade release workflow to Changesets v3 - #3097
Conversation
|
🚀 Deploying Preview to Cloudflare 🚀Preview URL: https://codex-changesets-v3-upgrade.try.emdashcms.com, https://codex-changesets-v3-upgrade-emdash-playground.emdash-cms.workers.dev (commit 1cd3811)This URL reflects your latest Preview deploymentPreview Deployments by commit
|
![emdashbot[bot]](https://avatars.githubusercontent.com/in/3255304?s=60&v=4){kind=small}
There was a problem hiding this comment.
This is a focused CI chore: it moves the monorepo release pipeline from Changesets Action v1 to the v2 set of sub-actions (select-mode, version, pack, publish) and upgrades the Changesets CLI to 3.0.2 / @changesets/changelog-github to 1.0.1. The approach fits EmDash's existing least-privilege workflow style (default-deny permissions: {}, scoped job permissions, GitHub App token only where writes are needed, OIDC id-token: write limited to the publish job). Removing the legacy attach-plugin-tarballs.mjs script is consistent with the PR description and with the current delegated-release-service docs, which no longer rely on GitHub release assets for plugin bytes.
I read the diff, the updated workflow and release script, the lockfile around the Changeset packages, the changeset configuration and README, AGENTS.md, and the related plugin/release docs. I also searched the tree for remaining references to the deleted script and for comparable GitHub App token patterns in other workflows.
What I checked:
package.jsonandpnpm-lock.yamlnow resolve@changesets/cli@3.0.2and@changesets/changelog-github@1.0.1; no stale v2 CLI / v0.x changelog entries remain..changeset/config.jsonschema is bumped to 4.0.0, matching the installed@changesets/config@4.0.0.- Workflow splits version and publish correctly, uses pinned action SHAs, keeps the App token for branch/PR/tag work, and restricts the npm OIDC permission to the publish job.
- The
publish-onlypath skipsselect-modeand letspack/publishrun without a saved plan, as described. - The deleted script is no longer referenced anywhere in the repo.
- Public docs (plugin CLI, delegated releases, native plugin distribution) do not claim that this repository attaches plugin tarballs to GitHub releases, so removing that script does not leave the docs inconsistent.
No logic bugs, security regressions, missing configuration, or AGENTS.md convention violations were apparent. I would sign off.
Scope checkThis PR changes 1,225 lines across 6 files. Large PRs are harder to review and more likely to be closed without review. If this scope is intentional, no action needed. A maintainer will review it. If not, please consider splitting this into smaller PRs. See CONTRIBUTING.md for contribution guidelines. |
@emdash-cms/admin
@emdash-cms/auth
@emdash-cms/auth-atproto
@emdash-cms/blocks
@emdash-cms/cloudflare
@emdash-cms/contentful-to-portable-text
emdash
create-emdash
@emdash-cms/gutenberg-to-portable-text
@emdash-cms/plugin-cli
@emdash-cms/plugin-test
@emdash-cms/plugin-types
@emdash-cms/registry-client
@emdash-cms/registry-lexicons
@emdash-cms/registry-moderation
@emdash-cms/registry-verification
@emdash-cms/sandbox-workerd
@emdash-cms/x402
@emdash-cms/plugin-ai-moderation
@emdash-cms/plugin-atproto
@emdash-cms/plugin-audit-log
@emdash-cms/plugin-color
@emdash-cms/plugin-embeds
@emdash-cms/plugin-field-kit
@emdash-cms/plugin-forms
@emdash-cms/plugin-webhook-notifier
commit: |
1 participant
What does this PR do?
Upgrades the monorepo release pipeline to Changesets CLI 3.0.2 and Changesets Action 2.1.2.
The release workflow now uses the native
select-mode,version,pack, andpublishactions. Version pull requests and release tags still use the GitHub App, while npm's OIDC permission is limited to the publish job. The manualpublish-onlyrecovery path packs the current unpublished versions without requiring a saved publish plan.Removes the legacy script that attached plugin tarballs to GitHub releases. This PR does not enable delegated EmDash plugin publishing in this repository.
No linked issue.
Type of change
Checklist
pnpm typecheckpassespnpm lintpassespnpm testpasses (or targeted tests for my change)pnpm formathas been runAI-generated code disclosure
Screenshots / test output
Not applicable: no UI changes.
Validated with:
pnpm install --frozen-lockfilepnpm buildpnpm typecheckpnpm lint:jsonpnpm changeset statuschangeset packrehearsalnode .github/scripts/check-no-major.mjszizmor --pedantic .github/workflows/release.ymlgit diff --check