chore(deps): bump changesets/action from 1 to 2

[dependabot]

Bumps changesets/action from 1 to 2.

Release notes

Sourced from changesets/action's releases.

v2.0.0

Major Changes

• #692cb3f011 Thanks @​Andarist! - Release commits and tags are now pushed using the GitHub API by default.

  Replace the commit-mode input with the boolean push-with-git-cli input. Set push-with-git-cli: true to continue using the Git CLI.

  Regardless of the push mode, custom GitHub tokens must be passed explicitly through the github-token input. The GITHUB_TOKEN environment variable and credentials configured by actions/checkout or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, github-token takes precedence over those repository credentials.

• #680ca57073 Thanks @​bluwy! - Add a new push-git-tags option that complements create-github-releases to control specifically if git tags should be created but not GitHub releases.

  If create-github-releases was previously set to false, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set push-git-tags to false explicitly.

• #6574f718b5 Thanks @​Andarist! - Removed compatibility support for old Changesets v1.

• #6817359107 Thanks @​bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.

  Inputs:

  • version -> version-script
  • publish -> publish-script
  • commit -> commit-message
  • title -> pr-title
  • branch -> pr-base-branch

  Outputs:

  • pull-request-number -> pr-number

• #674164652b Thanks @​bluwy! - Remove support for passing custom GitHub token through the GITHUB_TOKEN environment variable. It should be passed to the github-token input instead.

• #6595649ff4 Thanks @​bluwy! - Remove cwd option for changesets/action. Use the step working-directory option instead to change the directory.

• #673823cf74 Thanks @​bluwy! - Update to Changesets v3 packages

• #695469993c Thanks @​bluwy! - Removed .npmrc handling when the NPM_TOKEN environment variable is set.

  Authentication should be handled via Trusted Publishing instead. If a token is still needed, use actions/setup-node to set it up instead via the registry-url option. Check out the updated action README for more information of setting up npm authentication in GitHub Actions.

• #6680eae789 Thanks @​bluwy! - Rename the input and output names to kebab-case instead of camelCase to match the official GitHub actions pattern

Minor Changes

• #656a12d90d Thanks @​bluwy! - Add new /select-mode, /version, and /publish sub-actions to better control version and publish steps

• #678f71ae04 Thanks @​Andarist! - Published packages detection done through stdout parsing was replaced with one based on the shared output file using CHANGESETS_OUTPUT environment variable. When using custom scripts this environment variable should always be passed down to the Changesets CLI invocations.

Patch Changes

• #6995b307d3 Thanks @​Andarist! - Validate that projects use Changesets CLI v3 and direct Changesets CLI v2 users to changesets/action@v1.

... (truncated)

Changelog

Sourced from changesets/action's changelog.

@​changesets/action

2.1.0

Minor Changes

• #7183b7c71c Thanks @​bluwy! - Add a cwd input to the root action, /select-mode, /version, /pack, and /publish sub-actions to set the current working directory to execute Changesets in. This input existed in v1 but was incorrectly removed.

Patch Changes

• #7166f58ba3 Thanks @​bluwy! - Update pr-status message to link to the new faq page

2.0.0

Major Changes

• #692cb3f011 Thanks @​Andarist! - Release commits and tags are now pushed using the GitHub API by default.

  Replace the commit-mode input with the boolean push-with-git-cli input. Set push-with-git-cli: true to continue using the Git CLI.

  Regardless of the push mode, custom GitHub tokens must be passed explicitly through the github-token input. The GITHUB_TOKEN environment variable and credentials configured by actions/checkout or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, github-token takes precedence over those repository credentials.

• #680ca57073 Thanks @​bluwy! - Add a new push-git-tags option that complements create-github-releases to control specifically if git tags should be created but not GitHub releases.

  If create-github-releases was previously set to false, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set push-git-tags to false explicitly.

• #6574f718b5 Thanks @​Andarist! - Removed compatibility support for old Changesets v1.

• #6817359107 Thanks @​bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.

  Inputs:

  • version -> version-script
  • publish -> publish-script
  • commit -> commit-message
  • title -> pr-title
  • branch -> pr-base-branch

  Outputs:

  • pull-request-number -> pr-number

• #674164652b Thanks @​bluwy! - Remove support for passing custom GitHub token through the GITHUB_TOKEN environment variable. It should be passed to the github-token input instead.

• #6595649ff4 Thanks @​bluwy! - Remove cwd option for changesets/action. Use the step working-directory option instead to change the directory.

• #673823cf74 Thanks @​bluwy! - Update to Changesets v3 packages

• #695469993c Thanks @​bluwy! - Removed .npmrc handling when the NPM_TOKEN environment variable is set.

... (truncated)

Commits

• 198f833 v2.1.0
• 7545547 Version Packages (#719)
• 3043070 Prevent test warning annotations (#720)
• 3b7c71c Add back cwd input (#718)
• 6f58ba3 Update pr-status message links to new faq (#716)
• e52ce9e Version Packages (#715)
• 78fdc6b Exit pre mode (#714)
• 187a104 Update deps for stable (#709)
• d11394a Version Packages (next) (#712)
• 5fa6767 Fix support for prerelease exits using the new .changeset/pre layout (#711)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

⚠️ This is a major version update. Please review carefully before merging.

[os-support-ai]

⛔ Blocking: this bump silently disables the release lane as written

Measured against changesets/action's action.yml on both tags, and this repo's .github/workflows/changeset-release.yml on main. v2 renamed every input this workflow passes, and none of the old names exist in v2:

workflow passes (v1 name)	exists in v2?	v2's name
version: pnpm changeset:version	no	version-script:
publish: pnpm changeset:publish	no	publish-script:
title: 'chore: release packages'	no	pr-title:
commit: 'chore: release packages'	no	commit-message:

GitHub does not fail a workflow for unknown with: keys — at most an "Unexpected input(s)" warning annotation. So merging this bump unchanged does not go red; it goes inert.

Concretely, with publish-script unset, hasPublishScript is false, and src/index.ts's switch resolves differently:

case !hasChangesets && !hasPublishScript: → "no changesets found and no publish script" → nothing
case hasChangesets: → runVersion, with no version script

The lane keeps reporting success while publishing nothing and versioning nothing. Given #5442 (16 of 90 versioned releases already never reached npm), a silently inert release lane is the last thing this repo can afford.

To land this bump, the with: block must be renamed in the same PR:

- uses: changesets/action@v2with:
version-script: pnpm changeset:versionpublish-script: pnpm changeset:publishpr-title: 'chore: release packages'commit-message: 'chore: release packages'

Two other axes checked, both clear

• npm auth is not affected. v2 deletes v1's ~/.npmrc-from-NPM_TOKEN block entirely (counter-probed: the same npmrc|NPM_TOKEN|_authToken|OIDC grep returns 10 hits on v1/src/index.ts and 0 across every v2 source file that exists — so the removal is a real reading, not a broken probe). It does not matter here: this workflow's actions/setup-node@v7 already sets registry-url: 'https://registry.npmjs.org' and the job passes NODE_AUTH_TOKEN, so setup-node writes the npmrc itself. v1's block was redundant for this repo, not load-bearing.
• Renamed outputs are unread. v2 also renames publishedPackages → published-packages, hasChangesets → has-changesets, pullRequestNumber → pr-number. This workflow reads none of them (grepped for outputs. — no hits), so nothing downstream breaks.

What this bump does not do

It does not fix #5442. The publish trigger is unchanged between v1 and v2 — the same four-case switch, still gated on .changeset/ being completely empty:

!hasChangesets && !hasPublishScript → nothing
!hasChangesets && hasPublishScript → publish
hasChangesets && !hasNonEmptyChangesets → "All changesets are empty; not creating PR"
hasChangesets → runVersion

So #5442 needs its own fix on its own merits, whichever way this PR goes.

Scope of this check: I compared the two action.yml input sets, the src/index.ts branch logic, and npmrc/auth handling across v2's source files. I did not audit run.ts for other behavioural differences, so treat this as "these three axes are settled", not "v2 is otherwise identical".

---

Generated by Claude Code