[stipsan]

Renovate PRs now get a changeset automatically, generated with pnpm 12's built-in pnpm change, so dependency updates show up in the changelog and release without anyone writing a changeset by hand.

How it works

• The new Renovate changeset workflow runs on pull_request pushes made by renovate[bot] to renovate/* branches.
• It only creates a changeset when dependencies, peerDependencies or optionalDependencies changed compared to main. Dev-dependency updates are skipped because they don't need a release.
• It runs pnpm change <pkg> --bump patch --summary "<PR title without the conventional-commit prefix>", renames the file after the branch (for example .changeset/renovate-foo-2.x.md) so re-runs never add duplicates, then commits and pushes it.
• When Renovate rebases, its force-push drops that commit and the workflow adds it back.

Renovate keeps rebasing

The commit is always authored as github-actions[bot], and renovate.json now lists that email in gitIgnoredAuthors. Renovate therefore doesn't treat the branch as edited by a person, and keeps rebasing and updating the PR.

Optional: GitHub App so CI runs on the changeset commit

Pushes made with the default GITHUB_TOKEN don't trigger other workflows. CI then never runs on the changeset commit, so the PR's head has no checks and Renovate won't automerge it. To fix that, set the repo or org variable CHANGESET_APP_ID and the secret CHANGESET_APP_PRIVATE_KEY for a GitHub App with contents: write. The workflow then pushes with an App token instead. Until those are set, it falls back to GITHUB_TOKEN.

Changesets setup for the site

This repo didn't use Changesets before, so this PR also adds:

• name and version (0.0.0) in package.json, which pnpm change and Changesets need
• @changesets/cli and @changesets/changelog-github, plus .changeset/config.json with privatePackages: { version: true, tag: false }
• a Release workflow that runs changesets/action without a publish step. It only opens "Version Packages" PRs that bump the version and update CHANGELOG.md, because the site isn't published to npm.
• a first changeset, so the first "Version Packages" PR checks that the setup works

Want tembo to make any changes? Add a comment with @tembo and i'll get back to work!

    

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
scroll-into-view-dev	Ready	Preview	Nov 11, 2026 4:57pm UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​changesets/​cli@​3.0.3
	@​changesets/​changelog-github@​1.0.1

View full report