Bump changesets/action from 1 to 2

[dependabot]

Bumps changesets/action from 1 to 2.

Release notes

Sourced from changesets/action's releases.

v2.0.0

Major Changes

• #692 cb3f011 Thanks @​Andarist! - Release commits and tags are now pushed using the GitHub API by default.

  Replace the commit-mode input with the boolean push-with-git-cli input. Set push-with-git-cli: true to continue using the Git CLI.

  Regardless of the push mode, custom GitHub tokens must be passed explicitly through the github-token input. The GITHUB_TOKEN environment variable and credentials configured by actions/checkout or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, github-token takes precedence over those repository credentials.

• #680 ca57073 Thanks @​bluwy! - Add a new push-git-tags option that complements create-github-releases to control specifically if git tags should be created but not GitHub releases.

  If create-github-releases was previously set to false, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set push-git-tags to false explicitly.

• #657 4f718b5 Thanks @​Andarist! - Removed compatibility support for old Changesets v1.

• #681 7359107 Thanks @​bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.

  Inputs:

  • version -> version-script
  • publish -> publish-script
  • commit -> commit-message
  • title -> pr-title
  • branch -> pr-base-branch

  Outputs:

  • pull-request-number -> pr-number

• #674 164652b Thanks @​bluwy! - Remove support for passing custom GitHub token through the GITHUB_TOKEN environment variable. It should be passed to the github-token input instead.

• #659 5649ff4 Thanks @​bluwy! - Remove cwd option for changesets/action. Use the step working-directory option instead to change the directory.

• #673 823cf74 Thanks @​bluwy! - Update to Changesets v3 packages

• #695 469993c Thanks @​bluwy! - Removed .npmrc handling when the NPM_TOKEN environment variable is set.

  Authentication should be handled via Trusted Publishing instead. If a token is still needed, use actions/setup-node to set it up instead via the registry-url option. Check out the updated action README for more information of setting up npm authentication in GitHub Actions.

• #668 0eae789 Thanks @​bluwy! - Rename the input and output names to kebab-case instead of camelCase to match the official GitHub actions pattern

Minor Changes

• #656 a12d90d Thanks @​bluwy! - Add new /select-mode, /version, and /publish sub-actions to better control version and publish steps

• #678 f71ae04 Thanks @​Andarist! - Published packages detection done through stdout parsing was replaced with one based on the shared output file using CHANGESETS_OUTPUT environment variable. When using custom scripts this environment variable should always be passed down to the Changesets CLI invocations.

Patch Changes

• #699 5b307d3 Thanks @​Andarist! - Validate that projects use Changesets CLI v3 and direct Changesets CLI v2 users to changesets/action@v1.

... (truncated)

Changelog

Sourced from changesets/action's changelog.

@​changesets/action

2.1.0

Minor Changes

• #718 3b7c71c Thanks @​bluwy! - Add a cwd input to the root action, /select-mode, /version, /pack, and /publish sub-actions to set the current working directory to execute Changesets in. This input existed in v1 but was incorrectly removed.

Patch Changes

• #716 6f58ba3 Thanks @​bluwy! - Update pr-status message to link to the new faq page

2.0.0

Major Changes

• #692 cb3f011 Thanks @​Andarist! - Release commits and tags are now pushed using the GitHub API by default.

  Replace the commit-mode input with the boolean push-with-git-cli input. Set push-with-git-cli: true to continue using the Git CLI.

  Regardless of the push mode, custom GitHub tokens must be passed explicitly through the github-token input. The GITHUB_TOKEN environment variable and credentials configured by actions/checkout or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, github-token takes precedence over those repository credentials.

• #680 ca57073 Thanks @​bluwy! - Add a new push-git-tags option that complements create-github-releases to control specifically if git tags should be created but not GitHub releases.

  If create-github-releases was previously set to false, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set push-git-tags to false explicitly.

• #657 4f718b5 Thanks @​Andarist! - Removed compatibility support for old Changesets v1.

• #681 7359107 Thanks @​bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.

  Inputs:

  • version -> version-script
  • publish -> publish-script
  • commit -> commit-message
  • title -> pr-title
  • branch -> pr-base-branch

  Outputs:

  • pull-request-number -> pr-number

• #674 164652b Thanks @​bluwy! - Remove support for passing custom GitHub token through the GITHUB_TOKEN environment variable. It should be passed to the github-token input instead.

• #659 5649ff4 Thanks @​bluwy! - Remove cwd option for changesets/action. Use the step working-directory option instead to change the directory.

• #673 823cf74 Thanks @​bluwy! - Update to Changesets v3 packages

• #695 469993c Thanks @​bluwy! - Removed .npmrc handling when the NPM_TOKEN environment variable is set.

... (truncated)

Commits

• 198f833 v2.1.0
• 7545547 Version Packages (#719)
• 3043070 Prevent test warning annotations (#720)
• 3b7c71c Add back cwd input (#718)
• 6f58ba3 Update pr-status message links to new faq (#716)
• e52ce9e Version Packages (#715)
• 78fdc6b Exit pre mode (#714)
• 187a104 Update deps for stable (#709)
• d11394a Version Packages (next) (#712)
• 5fa6767 Fix support for prerelease exits using the new .changeset/pre layout (#711)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[changeset-bot]

⚠️ No Changeset found

Latest commit: 8976818

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[ev-vaultkeeper]

Do not merge as-is — changesets/action@v2 will break the Release workflow

I traced the only usage of this action (the Create Release Pull Request step in .github/workflows/release.yml) and read the v2 action.yml, README, CHANGELOG and source (src/index.ts, src/utils.ts). v2 is a major release with breaking changes that this workflow does not satisfy. There are two hard-failure blockers, one silent break, and one token concern.

🚫 Blocker 1 — v2 requires Changesets CLI v3, repo is on v2

The first thing src/index.ts does is await validateChangesetsCliVersion(cwd). It throws if the root @changesets/cli is >=2.0.0-0 <3.0.0-0 (or if the installed CLI major is 2). This repo declares "@changesets/cli": "^2.26.2" in package.json and pnpm-lock.yaml resolves @changesets/cli@2.31.0 — both v2. The action will immediately fail with:

This version of the Changesets action is designed to work with Changesets CLI v3. Changesets CLI v2 is not supported; use Changesets action v1 instead, which is compatible with CLI v2.

The maintainers' explicit guidance is to stay on changesets/action@v1 while you're on Changesets CLI v2.

🚫 Blocker 2 — renamed inputs (the workflow still uses the old names)

v2 renamed the root inputs and throwOnRenamedInputs hard-errors when the old ones are present. This step still passes title, commit, and version, all of which now throw. Required renames:

• version: npm run version → version-script: npm run version (without this, the custom script that bumps lib/evervault/version.rb never runs)
• commit: 'Release new version' → commit-message: 'Release new version'
• title: 'New Release' → pr-title: 'New Release'

⚠️ Silent break 3 — renamed output

The next step is gated on steps.changesets.outputs.hasChangesets == 'false'. v2 emits has-changesets (kebab-case); the old hasChangesets resolves to empty, so '' == 'false' is always false and the Create new release step (the actual gem publish to RubyGems) would silently stop running. Update to steps.changesets.outputs.has-changesets.

⚠️ Concern 4 — GITHUB_TOKEN env no longer configures the action

v2 ignores the GITHUB_TOKEN env var (token must come from the github-token input, default ${{ github.token }}), and it throws if a GITHUB_TOKEN env var is set and differs from the input. Recommend removing the env: GITHUB_TOKEN block and passing github-token: ${{ secrets.GITHUB_TOKEN }} under with:.

---

Why I pushed no commits

Renaming the inputs/outputs alone would not make this pass — the action still hard-fails on the CLI-v2 check (Blocker 1). A complete fix requires also upgrading @changesets/cli from v2 → v3 (a separate major bump touching package.json, .changeset/config.json schema, and pnpm-lock.yaml, with its own breaking changes), which is out of scope for this PR and can't be validated here since the release pipeline pushes to master and RubyGems.

Options

• Recommended (safe): keep changesets/action@v1 — close/hold this PR until you're ready to move to Changesets CLI v3.
• If you want v2: do a coordinated change — bump @changesets/cli to ^3.0.0 (+ config schema + lockfile), rename the three inputs, update the output to has-changesets, and switch GITHUB_TOKEN env → github-token input — then verify a full release run.

[ev-vaultkeeper]

changesets/action@v2 requires Changesets CLI v3. src/index.ts calls validateChangesetsCliVersion() before anything else and throws because this repo declares @changesets/cli: ^2.26.2 (lockfile resolves 2.31.0 — v2). It will fail with: "...Changesets CLI v2 is not supported; use Changesets action v1 instead...".

Even after fixing that, this same step still passes the removed inputs title/commit/version (v2 throws on these — use pr-title/commit-message/version-script), the env.GITHUB_TOKEN no longer configures the action (use the github-token input), and the downstream gate on line 36 uses the old output hasChangesets (now has-changesets), which would silently disable the gem publish step.