chore(release): migrate to Changesets v3 and changesets/action v2

.changeset/config.json

@@ -1,10 +1,12 @@
 {
-  "$schema": "https://unpkg.com/@changesets/config@3.0.5/schema.json",
+  "$schema": "https://unpkg.com/@changesets/config@4.0.0/schema.json",
   "changelog": ["@changesets/changelog-github", { "repo": "lifinance/widget" }],
   "commit": false,
   "access": "public",
   "baseBranch": "main",
   "updateInternalDependencies": "patch",
+  "format": false,
+  "privatePackages": { "version": true, "tag": false },
   "ignore": [
     "@lifi/widget-embedded",
     "@lifi/widget-playground",

.github/actions/pnpm-install/action.yaml

@@ -12,7 +12,7 @@ runs:
   using: 'composite'
   steps:
     - name: Set up pnpm
-      uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
     - name: Set up Node.js
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:

.github/actions/preview-publish/action.yml

@@ -16,7 +16,23 @@ runs:
           pnpm changeset pre exit
         fi
 
+    # `changeset version` exits 1 when there are no changesets (Changesets v3), so
+    # gate it on a changeset actually being present. Top level only — pre-mode moves
+    # already-versioned changesets into .changeset/pre/, and those are not pending.
+    # README.md is not a changeset either.
+    - name: Check for changesets
+      id: check
+      shell: bash
+      run: |
+        if [ -n "$(find .changeset -maxdepth 1 -name '*.md' ! -name 'README.md' -print -quit)" ]; then
+          echo "present=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "::warning::No changeset in this PR — nothing to publish as a preview."
+          echo "present=false" >> "$GITHUB_OUTPUT"
+        fi
+
     - name: Version changed packages as a preview snapshot
+      if: steps.check.outputs.present == 'true'
       shell: bash
       env:
         GITHUB_TOKEN: ${{ github.token }} # changeset version hits the GitHub API (changelog-github)
@@ -27,6 +43,7 @@ runs:
 
     - name: Detect preview packages
       id: detect
+      if: steps.check.outputs.present == 'true'
       shell: bash
       run: |
         # non-private packages the snapshot bumped = exactly what gets published
@@ -36,7 +53,7 @@ runs:
           echo "publish=true" >> "$GITHUB_OUTPUT"
           echo "Preview versions to publish:"; cat "$RUNNER_TEMP/preview-pkgs.txt"
         else
-          echo "::warning::No changeset in this PR — nothing to publish as a preview."
+          echo "::warning::The changesets in this PR bumped no publishable package."
           echo "publish=false" >> "$GITHUB_OUTPUT"
         fi
 

.github/workflows/linear-release.yaml

@@ -1,7 +1,7 @@
 name: 'Release · Linear Sync'
 
 # Reusable: sync one anchor package's published release into its Linear pipeline.
-# Version + channel are derived from the changesets publishedPackages output (not a git tag).
+# Version + channel are derived from the changesets published-packages output (not a git tag).
 on:
   workflow_call:
     inputs:
@@ -14,7 +14,7 @@ on:
         required: true
         type: string
       published_packages:
-        description: 'Raw changesets publishedPackages JSON: [{name, version}, …]'
+        description: 'Raw changesets published-packages JSON: [{name, version}, …]'
         required: true
         type: string
     secrets:
@@ -54,7 +54,7 @@ jobs:
           persist-credentials: false
 
       - name: Sync issues to release
-        uses: linear/linear-release-action@3858a5d7892435dc63302ac76b0cdb587435caa9 # v0.14.6
+        uses: linear/linear-release-action@17b8c24f8ceb2b98cabaf1965ff83c55dd596fac # v0.15.1
         with:
           access_key: ${{ secrets.access_key }}
           command: sync
@@ -66,7 +66,7 @@ jobs:
       # prerelease: advance the stage; the release stays open
       - name: Advance stage (alpha/beta)
         if: steps.meta.outputs.channel != 'stable'
-        uses: linear/linear-release-action@3858a5d7892435dc63302ac76b0cdb587435caa9 # v0.14.6
+        uses: linear/linear-release-action@17b8c24f8ceb2b98cabaf1965ff83c55dd596fac # v0.15.1
         with:
           access_key: ${{ secrets.access_key }}
           command: update
@@ -76,7 +76,7 @@ jobs:
       # stable: complete the release (fires the "→ Done" automation)
       - name: Complete release (stable)
         if: steps.meta.outputs.channel == 'stable'
-        uses: linear/linear-release-action@3858a5d7892435dc63302ac76b0cdb587435caa9 # v0.14.6
+        uses: linear/linear-release-action@17b8c24f8ceb2b98cabaf1965ff83c55dd596fac # v0.15.1
         with:
           access_key: ${{ secrets.access_key }}
           command: complete

.github/workflows/publish.yaml

@@ -45,7 +45,7 @@ jobs:
       contents: write # to create the version PR / push tags
       pull-requests: write # to create the version PR
     outputs:
-      hasChangesets: ${{ steps.changesets.outputs.hasChangesets }}
+      has-changesets: ${{ steps.changesets.outputs.has-changesets }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -57,26 +57,28 @@ jobs:
           cache: 'false' # privileged job — don't restore a potentially poisoned cache
       - name: Create version pull request
         id: changesets
-        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
+        uses: changesets/action@8488615a623b1b9c987934bb89eae8af6a946ac1 # v2.1.1
         with:
-          version: pnpm changeset:version
-          title: 'chore: version packages'
-          commit: 'chore: version packages'
+          version-script: pnpm changeset:version
+          pr-title: 'chore: version packages'
+          commit-message: 'chore: version packages'
+        # No `env: GITHUB_TOKEN` — v2 throws when it is set and differs from the
+        # `github-token` input. The action injects its own token into the version
+        # script's environment, which is what changelog-github needs.
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           HUSKY: '0'
 
   release:
     name: Release
     needs: changesets
     # Only publish once the version PR has been merged (no changesets left).
-    if: needs.changesets.outputs.hasChangesets == 'false'
+    if: needs.changesets.outputs.has-changesets == 'false'
     runs-on: ubuntu-latest
     permissions:
       contents: write # to create GitHub Releases
       id-token: write # OIDC token for npm provenance / trusted publishing
     outputs:
-      publishedPackages: ${{ steps.changesets.outputs.publishedPackages }}
+      published-packages: ${{ steps.changesets.outputs.published-packages }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -87,27 +89,29 @@ jobs:
           cache: 'false' # privileged job — don't restore a potentially poisoned cache
       - name: Publish to npm
         id: changesets
-        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
+        uses: changesets/action@8488615a623b1b9c987934bb89eae8af6a946ac1 # v2.1.1
         with:
-          publish: pnpm changeset:publish
-          createGithubReleases: true
+          publish-script: pnpm changeset:publish
+          create-github-releases: true
+        # No `env: GITHUB_TOKEN` — see the Changesets job. v2 reads the published
+        # packages from the CHANGESETS_OUTPUT file it injects into the publish
+        # script's environment, not from stdout.
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_CONFIG_PROVENANCE: true
 
   # Linear sync — one static call per anchor (two anchors use two secrets, so no matrix).
   linear-widget:
     name: Linear Sync (Widget)
     needs: release
     # Fires only when @lifi/widget was actually published this run.
-    if: contains(needs.release.outputs.publishedPackages, '"@lifi/widget"')
+    if: contains(needs.release.outputs.published-packages, '"@lifi/widget"')
     permissions:
       contents: read
     uses: ./.github/workflows/linear-release.yaml
     with:
       release_name: Widget
       package_name: '@lifi/widget'
-      published_packages: ${{ needs.release.outputs.publishedPackages }}
+      published_packages: ${{ needs.release.outputs.published-packages }}
     secrets:
       access_key: ${{ secrets.WIDGET_LINEAR_RELEASE_ACCESS_KEY }}
 
@@ -116,14 +120,14 @@ jobs:
   linear-checkout:
     name: Linear Sync (Checkout)
     needs: release
-    if: contains(needs.release.outputs.publishedPackages, '"@lifi/widget-checkout"')
+    if: contains(needs.release.outputs.published-packages, '"@lifi/widget-checkout"')
     permissions:
       contents: read
     uses: ./.github/workflows/linear-release.yaml
     with:
       release_name: Checkout
       package_name: '@lifi/widget-checkout'
-      published_packages: ${{ needs.release.outputs.publishedPackages }}
+      published_packages: ${{ needs.release.outputs.published-packages }}
     secrets:
       access_key: ${{ secrets.CHECKOUT_LINEAR_RELEASE_ACCESS_KEY }}
 

examples/nuxt/package.json

@@ -1,5 +1,6 @@
 {
   "name": "nuxt-app",
+  "version": "0.0.0",
   "private": true,
   "type": "module",
   "scripts": {

examples/react-router/package.json

@@ -1,5 +1,6 @@
 {
   "name": "react-router",
+  "version": "0.0.0",
   "private": true,
   "sideEffects": false,
   "type": "module",

examples/remix/package.json

@@ -1,5 +1,6 @@
 {
   "name": "remix",
+  "version": "0.0.0",
   "private": true,
   "sideEffects": false,
   "type": "module",

package.json

@@ -51,8 +51,8 @@
   },
   "devDependencies": {
     "@biomejs/biome": "^2.5.9",
-    "@changesets/changelog-github": "^0.7.0",
-    "@changesets/cli": "^2.31.0",
+    "@changesets/changelog-github": "^1.0.0",
+    "@changesets/cli": "^3.0.1",
     "@commitlint/cli": "^21.2.2",
     "@commitlint/config-conventional": "^21.2.2",
     "@types/node": "^26.2.0",