🛠 Tooling: Look at migrating generation of CHANGELOG to Changesets / migrating away from release-it

[johnnyreilly]

Bug Report Checklist

• I have tried restarting my IDE and the issue persists.
• I have pulled the latest main branch of the repository.
• I have searched for related issues and found none that matched my issue.

Overview

At some point, GitHub appears to have hard blocked writing to a CHANGELOG.md on the main branch if you have branch protections or rulesets in place. This impacts the release-it workflow that azdo-npm-auth has used thus far.

Context: JoshuaKGoldberg/release-it-action#672 (comment)

Despite much struggling, this appears to be very hard to work around. As a consequence, it looks that using Changesets might be a useful alternative which allows us to move all CHANGELOG creation into the PR process instead. Useful links:

• docs: https://github.com/changesets/changesets/blob/main/docs/intro-to-using-changesets.md
• discussion with @JoshuaKGoldberg and @Andarist on Changesets: https://youtu.be/ALWTPifHPj8?si=b1ecSawM_Nu60SVv

I'm going to look into doing that.

Additional Info

No response

[Andarist]

I’d happily give u a hand if you have any questions regarding Changesets (or if u run into any problems)

[johnnyreilly]

Thanks @Andarist!

[johnnyreilly]

I do have a couple of questions @Andarist! Both related to the action usage.

Using the actions "with publishing" approach

I was looking at the with publishing docs and spotted this:

      - name: Create Release Pull Request or Publish to npm
        id: changesets
        uses: changesets/action@v1
        with:
          # This expects you to have a script called release which does a build for your packages and calls changeset publish
          publish: yarn release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

I was confused that this appears to create a pull request OR publish to npm. What drives whether it creates a PR or publishes to npm?

I don't want to accidentally publish to npm! Is it as simple as "if there are no changesets then we publish to npm"? Or does something else drive it?

Using the action with trusted publishing

The reason I started looking into this was the blog post from GitHub which talks about changes to npm security, which very much nudge the ecosystem towards using trusted publishing:

• https://github.blog/changelog/2025-09-29-strengthening-npm-security-important-changes-to-authentication-and-token-management/
• https://docs.npmjs.com/trusted-publishers

I was looking at the example publishing setup for trusted publishing:

name: Publish Package

on:
  push:
    tags:
      - 'v*'

permissions:
  id-token: write  # Required for OIDC
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          registry-url: 'https://registry.npmjs.org'

      # Ensure npm 11.5.1 or later is installed
      - name: Update npm
        run: npm install -g npm@latest
      - run: npm ci
      - run: npm run build --if-present
      - run: npm test
      - run: npm publish

I'm planning to use the changesets action (following the Recommended Automation Flow).

I'm wondering if anything special needs to be done to use that with trusted publishing? I can see that the With Publishing example expects a NPM_TOKEN. From what I understand of trusted publishing, this won't exist.

Is there built in support for trusted publishing with changesets? Or is the advice here that you should use Custom Publishing and simply call npm publish directly as in the example above?

---

You can see my work in progress here: #47

Feel free to point out any silly mistakes!

[Andarist]

I was confused that this appears to create a pull request OR publish to npm. What drives whether it creates a PR or publishes to npm?

Its the existence of changesets files on your main branch. If there are any changesets then that means there is essentially a pending release and for those we create a "release PR". When you land that PR you bump all of the packages etc and remove changesets files (that's part of the PR's content). When there are no changesets files on your main branch then the GitHub action/CLI tries to sync your local state of the repository with the npm registry (so everything that is not yet published gets published)

I'm wondering if anything special needs to be done to use that with trusted publishing? I can see that the With Publishing example expects a NPM_TOKEN. From what I understand of trusted publishing, this won't exist.

To be fair, I'm not yet familiar with the trusted publishing requirements etc. It would be great to research this and document better. I know it's straightforward to publish with provenance using the provided OIDC token. This is everything that I had to do to enable this: https://github.com/changesets/changesets/pull/1659/files .

[johnnyreilly]

Brilliant - thanks. So to paraphrase:

if (thereAreChangesetsOnMain) {
  createOrUpdateReleasePR(); 
} else {
   doTheRelease();
}

Thanks for the PR comments, I'll copy what you're doing and use that as my basis. Appreciate the time!