Skip to content

chore(deps): bump changesets/action from 1.9.0 to 2.1.1 in the actions group across 1 directory - #148

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-2c80fc32b7
Closed

chore(deps): bump changesets/action from 1.9.0 to 2.1.1 in the actions group across 1 directory#148
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-2c80fc32b7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the actions group with 1 update in the / directory: changesets/action.

Updates changesets/action from 1.9.0 to 2.1.1

Release notes

Sourced from changesets/action's releases.

v2.1.1

Patch Changes

v2.1.0

Minor Changes

  • #718 3b7c71c Thanks @​bluwy! - Add a cwd input to the root action, /select-mode, /version, /pack, and /publish sub-actions to set the current working directory to execute Changesets in. This input existed in v1 but was incorrectly removed.

Patch Changes

v2.0.0

Major Changes

  • #692 cb3f011 Thanks @​Andarist! - Release commits and tags are now pushed using the GitHub API by default.

    Replace the commit-mode input with the boolean push-with-git-cli input. Set push-with-git-cli: true to continue using the Git CLI.

    Regardless of the push mode, custom GitHub tokens must be passed explicitly through the github-token input. The GITHUB_TOKEN environment variable and credentials configured by actions/checkout or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, github-token takes precedence over those repository credentials.

  • #680 ca57073 Thanks @​bluwy! - Add a new push-git-tags option that complements create-github-releases to control specifically if git tags should be created but not GitHub releases.

    If create-github-releases was previously set to false, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set push-git-tags to false explicitly.

  • #657 4f718b5 Thanks @​Andarist! - Removed compatibility support for old Changesets v1.

  • #681 7359107 Thanks @​bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.

    Inputs:

    • version -> version-script
    • publish -> publish-script
    • commit -> commit-message
    • title -> pr-title
    • branch -> pr-base-branch

    Outputs:

    • pull-request-number -> pr-number

  • #674 164652b Thanks @​bluwy! - Remove support for passing custom GitHub token through the GITHUB_TOKEN environment variable. It should be passed to the github-token input instead.

  • #659 5649ff4 Thanks @​bluwy! - Remove cwd option for changesets/action. Use the step working-directory option instead to change the directory.

  • #673 823cf74 Thanks @​bluwy! - Update to Changesets v3 packages

  • #695 469993c Thanks @​bluwy! - Removed .npmrc handling when the NPM_TOKEN environment variable is set.

... (truncated)

Changelog

Sourced from changesets/action's changelog.

@​changesets/action

2.1.1

Patch Changes

2.1.0

Minor Changes

  • #718 3b7c71c Thanks @​bluwy! - Add a cwd input to the root action, /select-mode, /version, /pack, and /publish sub-actions to set the current working directory to execute Changesets in. This input existed in v1 but was incorrectly removed.

Patch Changes

2.0.0

Major Changes

  • #692 cb3f011 Thanks @​Andarist! - Release commits and tags are now pushed using the GitHub API by default.

    Replace the commit-mode input with the boolean push-with-git-cli input. Set push-with-git-cli: true to continue using the Git CLI.

    Regardless of the push mode, custom GitHub tokens must be passed explicitly through the github-token input. The GITHUB_TOKEN environment variable and credentials configured by actions/checkout or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, github-token takes precedence over those repository credentials.

  • #680 ca57073 Thanks @​bluwy! - Add a new push-git-tags option that complements create-github-releases to control specifically if git tags should be created but not GitHub releases.

    If create-github-releases was previously set to false, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set push-git-tags to false explicitly.

  • #657 4f718b5 Thanks @​Andarist! - Removed compatibility support for old Changesets v1.

  • #681 7359107 Thanks @​bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.

    Inputs:

    • version -> version-script
    • publish -> publish-script
    • commit -> commit-message
    • title -> pr-title
    • branch -> pr-base-branch

    Outputs:

    • pull-request-number -> pr-number

  • #674 164652b Thanks @​bluwy! - Remove support for passing custom GitHub token through the GITHUB_TOKEN environment variable. It should be passed to the github-token input instead.

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 17, 2026
@dependabot
chore(deps): bump changesets/action
d600417 
Bumps the actions group with 1 update in the / directory: [changesets/action](https://github.com/changesets/action).


Updates `changesets/action` from 1.9.0 to 2.1.1
- [Release notes](https://github.com/changesets/action/releases)
- [Changelog](https://github.com/changesets/action/blob/main/CHANGELOG.md)
- [Commits](changesets/action@a45c4d5...8488615)

---
updated-dependencies:
- dependency-name: changesets/action
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump changesets/action from 1.9.0 to 2.1.0 in the actions group chore(deps): bump changesets/action from 1.9.0 to 2.1.1 in the actions group across 1 directory Aug 31, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-2c80fc32b7 branch from a676a22 to d600417 Compare August 31, 2026 09:22
@shinyaoguri shinyaoguri mentioned this pull request Sep 4, 2026
Merged
@shinyaoguri

shinyaoguri commented Sep 4, 2026

Copy link
Copy Markdown
Owner

このバンプは #156 で取り込みました（close します）。

changesets/action v2 と @changesets/cli v3 は片方だけでは成立しない組み合わせでした:

そのため #156 で action と CLI を同時に上げ、release.yml の入力を v2 名へ移行し、同じドリフトを次から CI で落とすガードを test/dependency-consistency.test.ts に追加しました。

🤖 Assisted by Claude Code

@shinyaoguri shinyaoguri closed this Sep 4, 2026
@shinyaoguri
shinyaoguri deleted the dependabot/github_actions/actions-2c80fc32b7 branch September 4, 2026 06:36
@dependabot @github

dependabot Bot commented on behalf of github Sep 4, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

shinyaoguri added a commit that referenced this pull request Sep 4, 2026
@shinyaoguri
chore(deps): changesets ツールチェインを action v2 + CLI v3 へ移行する (#156)
22aeaf1 
## 目的

dependabot が出していた 2 件は**片方だけマージするとリリースが壊れる**組み合わせだったので、1 PR にまとめて移行する。

- #148 `changesets/action` v1.9.0 → v2.1.1
- #150 `@changesets/cli` 2.31.1 → 3.0.0

理由:

1. **相互依存**。action v2 はプロジェクトが Changesets CLI v3 であることを検証し、v2 なら
`changesets/action@v1` を使えと言って落ちる（action v2.0.0 /
changesets/action#699）。逆に CLI v3 だけ上げても action v1 は v2 系パッケージ前提。
2. **入力名が全面改名 + `GITHUB_TOKEN` env
廃止**（changesets/action#681・#674）。`version`→`version-script`、`publish`→`publish-script`、`commit`→`commit-message`、`title`→`pr-title`。GitHub
Actions は**未知入力を警告のみで無視する**ので、SHA だけの bump はリリースを黙って無効化する。
3. **CI では検知できない**。`ci.yml` は `release.yml` を実行しないため、#148 単独でも `check` は
green。#136 で整理した「dependabot はマニフェストしか書き換えず、手で追随すべき箇所は黙ってドリフトする」パターンそのもの。

## 変更点

- **`.github/workflows/release.yml`**: pin を v2.1.1 の SHA へ、入力を v2
名へ移行し、`github-token` を明示（v2 は env を見ない）。`commit-message` / `pr-title` は
v2 の既定値 `Version Packages` ではなく Conventional Commits を保つため明示継続（squash
merge のコミット要約になる）。npm 認証は従来どおり OIDC trusted publishing でトークンは持たない。
- **`package.json`**: `@changesets/cli` を `^3.0.0`、`engines.node` を
`>=22.11`（CLI v3 の engines は `^22.11 || ^24 || >=26`）。
- **`.changeset/config.json`**: `$schema` を `@changesets/config@4.0.0`
へ（CLI v3 が引くのは config v4）。削除された `prettier` は未使用、`privatePackages`
の既定変更で影響を受ける private パッケージ（`site/`）に changeset は無いので他の移行は不要。
- **`test/dependency-consistency.test.ts`**: 再発防止のガードを 2 本追加。
- action の pin（`# vX.Y.Z` コメント）の major と `@changesets/cli` の major
が対応表（1↔2, 2↔3）どおりであること。表に無い major が pin されたら落として手で判断させる。
  - pin した major の入力名だけが使われていること（v1 名の残留と `GITHUB_TOKEN:` env 依存を落とす）。
- `.changeset/config.json` の `$schema` の major が `package-lock.json`
の解決済み `@changesets/config` と一致すること。**major のみ**の比較にしたのは、こちらが transitive
で minor が `npm install` のたびに動きうるため（#145 の「無関係な PR が赤くなる」の回避）。
- **ADR 0004**: action と CLI の major
を同時にしか動かせない制約と、その整合をテストで担保していることを追記。

changeset は無し（`packages/*` を触らないので公開物に変化なし）。

## 確認方法

- `npm run build` / `npm test`（36 files・367 tests green）/ `npm run
typecheck`（0 errors）
- 新ガードが**赤くなるのを見てから**仕上げた: 入力名を v1 に戻す・CLI を `^2` に戻す・`$schema` を
`3.0.0` に戻す・pin のバージョンコメントを外す、の 4 ケースで期待どおり該当テストだけが落ちる
- **CLI v3 の疎通**: 捨て changeset で `npx changeset
status`（`@cosense-site-kit/core -> 0.4.4` を提示）→ `npx changeset
version`（bump + CHANGELOG + changeset 消費）まで確認し、変更は戻した。依存パッケージまで連鎖しない挙動は
v2 のときと同じ（cf. b80edbc）
- pin した SHA `8488615a…` が v2.1.1 タグの実体と一致することと、入力名がその SHA の
`action.yml` と一致することを確認
- **マージ後**: main の `Release` 実行ログで action v2 が CLI v3
検証を通り、未知入力の警告が出ていないことを確認する（changeset ゼロなので publish モードで no-op
が正しい）。壊れていても `release.yml` の 1 ステップの revert で v1 系に戻せる

## 補足

`npm run lint` はこの worktree（`.claude/worktrees/*` 配下）からは 0 files
で落ちる。`biome.json` の `!**/.claude` が biome へ渡す `.`（= 絶対パス）にマッチするためで、この PR
とは無関係な既存の papercut（別途 Issue にする）。CI は `.claude`
を含まないパスで走るので影響なし。変更ファイルは明示パスで biome を通して green を確認済み。

---
<sub>🤖 Assisted by [Claude Code](https://claude.com/claude-code)</sub>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@shinyaoguri