Pin repobuddy/.github shared workflows to @v1 (needs @changesets/cli v3 first)

[unional]

Pin the shared repobuddy/.github workflows to @v1 instead of @main, once that tag is cut.

Why

repobuddy/.github is being tagged for the first time. Today this repo pins those shared workflows at @main, which means it takes every change to them the moment it merges — including breaking ones nobody reviewed.

That is not theoretical. changesets/action was upgraded v1 → v2 in repobuddy/.github by an auto-merged Renovate PR, and it silently broke the changesets release path in every repo consuming it (repobuddy/.github#43). Pinning a tag means a change like that waits for a release someone deliberately cuts.

Consumers pin @v1 — a moving alias re-pointed on each backward-compatible release, so you still get fixes automatically, but never a breaking change. See the "Versioning" section of the repobuddy/.github README (added in repobuddy/.github#44).

Exact changes

.github/workflows/github-page.yml

 jobs:
   docgen:
     permissions:
       contents: write
-    uses: repobuddy/.github/.github/workflows/pnpm-docs.yml@main
+    uses: repobuddy/.github/.github/workflows/pnpm-docs.yml@v1
     with:
       publish-dir: ./libs/storybook/storybook-static

.github/workflows/pull-request.yml

 jobs:
   code:
-    uses: repobuddy/.github/.github/workflows/pnpm-verify.yml@main
+    uses: repobuddy/.github/.github/workflows/pnpm-verify.yml@v1
     with:
       os: '["ubuntu-latest"]'

.github/workflows/release.yml

 jobs:
   code:
-    uses: repobuddy/.github/.github/workflows/pnpm-verify.yml@main
+    uses: repobuddy/.github/.github/workflows/pnpm-verify.yml@v1
     with:
       os: '["ubuntu-latest"]'
 
   release:
-    uses: repobuddy/.github/.github/workflows/pnpm-release-changeset.yml@main
+    uses: repobuddy/.github/.github/workflows/pnpm-release-changeset.yml@v1
     needs: code
     secrets: inherit
 
   docgen:
     permissions:
       contents: write
-    uses: repobuddy/.github/.github/workflows/pnpm-docs.yml@main
+    uses: repobuddy/.github/.github/workflows/pnpm-docs.yml@v1
     needs: release
     if: github.ref == 'refs/heads/main'
     with:
       publish-dir: ./libs/storybook/storybook-static

Precondition — do not skip

pnpm-release-changeset.yml uses changesets/action@v2.0.0, which validates that your repo is on @changesets/cli v3 and fails outright for v2 users (changesets/action#699).
This repo is on "@changesets/cli": "^2.29.7", so the release.yml changesets line must not be pinned until this repo upgrades to @changesets/cli v3. There is no upgrade in flight here that I could find — unlike repobuddy/repobuddy, which has one open (repobuddy/repobuddy#581).

Suggested order:

1. Upgrade @changesets/cli to ^3.0.0 and confirm a release works.
2. Wait for repobuddy/.github to cut v1.0.0 (blocked on fix(pnpm-release-changeset): use changesets/action v2 input names, and put the shared workflows on tags .github#44).
3. Apply all three files above.

github-page.yml, pull-request.yml, and the two pnpm-verify/pnpm-docs lines in release.yml have no CLI dependency and can move as soon as the tag exists. Only the pnpm-release-changeset.yml line is gated on the v3 upgrade, so this can be split into two PRs if you want the safe part sooner.

Two unrelated things found while checking

• @changesets/cli is in dependencies, not devDependencies in the root package.json. Almost certainly unintended.
• This repo has two Renovate configs: a root renovate.json (config:recommended) and .github/renovate.json (github>unional/renovate-preset). Root wins by Renovate's precedence rules, so the org preset is being ignored here. Tag bumping works either way, but the duplicate should be removed.

Note

Until then this repo stays on @main, which already carries changesets/action@v2 — so the release path is already mismatched with CLI v2 today. Pinning does not cause that; the v3 upgrade fixes it.