chore: Cherry-picked changes from upstream

.github/actions/ci-setup/action.yml

@@ -1,13 +1,20 @@
 name: Setup CI
+description: Setup CI
+
+inputs:
+  skip-cache:
+    description: "Whether to skip the cache"
+    required: false
+    default: "false"
 
 runs:
   using: composite
   steps:
     - name: Setup Node.js
-      uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version-file: ".node-version"
-        cache: yarn
+        cache: ${{ inputs.skip-cache != 'true' && 'yarn' || '' }}
 
     - name: Install dependencies
       shell: bash

.github/workflows/auto_cherry_pick.yml

@@ -1,4 +1,3 @@
-
 name: Auto Cherry-Pick from Upstream
 
 on:

.github/workflows/ci.yml

@@ -1,27 +1,37 @@
 name: CI
 
 on:
-  push:
+  pull_request:
+  # merge queue is required so all commits on target branches trigger this workflow
+  # despite lack of the push event trigger here
+  merge_group:
     branches:
       - main
-  pull_request:
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.sha }}
+  cancel-in-progress: true
+
 jobs:
   test:
     name: Test
-    runs-on: ubuntu-latest
     timeout-minutes: 20
+    runs-on: ubuntu-latest
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Check out repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
       - uses: ./.github/actions/ci-setup
 
       - name: Test
@@ -38,17 +48,42 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Check out repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
       - uses: ./.github/actions/ci-setup
 
       - name: Typecheck
         run: yarn typecheck
 
+  lint:
+    name: Lint
+    timeout-minutes: 20
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        with:
+          egress-policy: audit
+
+      - name: Check out repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/ci-setup
+
+      - name: Format
+        run: yarn format
+
   ci-ok:
     name: CI OK
     runs-on: ubuntu-latest
     if: always()
-    needs: [ test, typecheck ]
+    needs: [test, typecheck, lint]
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
@@ -57,4 +92,4 @@ jobs:
 
       - name: Exit with error if some jobs are not successful
         run: exit 1
-        if: ${{ always() && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'skipped') || contains(needs.*.result, 'cancelled')) }}
+        if: ${{ always() && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) }}

.github/workflows/scorecards.yml

@@ -10,7 +10,7 @@ on:
   # To guarantee Maintained check is occasionally updated. See
   # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
   schedule:
-    - cron: '20 7 * * 2'
+    - cron: "20 7 * * 2"
   push:
     branches: ["main"]
 

.oxfmtrc.json

@@ -0,0 +1,8 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "printWidth": 80,
+  "ignorePatterns": ["dist/**", ".github/workflows/**"],
+  "sortImports": {
+    "newlinesBetween": false
+  }
+}

.pre-commit-config.yaml

@@ -1,14 +1,14 @@
 repos:
-- repo: https://github.com/gitleaks/gitleaks
-  rev: v8.16.3
-  hooks:
-  - id: gitleaks
-- repo: https://github.com/pre-commit/mirrors-eslint
-  rev: v8.38.0
-  hooks:
-  - id: eslint
-- repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v4.4.0
-  hooks:
-  - id: end-of-file-fixer
-  - id: trailing-whitespace
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.16.3
+    hooks:
+      - id: gitleaks
+  - repo: https://github.com/pre-commit/mirrors-eslint
+    rev: v8.38.0
+    hooks:
+      - id: eslint
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.4.0
+    hooks:
+      - id: end-of-file-fixer
+      - id: trailing-whitespace

README.md

@@ -4,6 +4,11 @@
 
 This action for [Changesets](https://github.com/changesets/changesets) creates a pull request with all of the package versions updated and changelogs updated and when there are new changesets on [your configured `baseBranch`](https://github.com/changesets/changesets/blob/main/docs/config-file-options.md#basebranch-git-branch-name), the PR will be updated. When you're ready, you can merge the pull request and you can either publish the packages to npm manually or setup the action to do it for you.
 
+There are also sub-actions hosted in this repository. Check out their respective READMEs for more details:
+
+- [pr-status](./pr-status/README.md): Generate changeset status in PRs.
+- [pr-comment](./pr-comment/README.md): Comment on PRs.
+
 ## Usage
 
 ### Inputs
@@ -23,7 +28,7 @@ This action for [Changesets](https://github.com/changesets/changesets) creates a
 - published - A boolean value to indicate whether a publishing has happened or not
 - publishedPackages - A JSON array to present the published packages. The format is `[{"name": "@xx/xx", "version": "1.2.0"}, {"name": "@xx/xy", "version": "0.8.9"}]`
 
-### Example workflow:
+### Example workflow
 
 #### Without Publishing
 
@@ -45,18 +50,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
 
-      - name: Setup Node.js 20
-        uses: actions/setup-node@v3
+      - name: Setup Node.js 26
+        uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 26
 
       - name: Install Dependencies
-        run: yarn
+        run: yarn install --frozen-lockfile
 
       - name: Create Release Pull Request
-        uses: step-security/action@v1
+        uses: step-security/changeset-action@v1
 ```
 
 #### With Publishing
@@ -79,22 +84,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
 
-      - name: Setup Node.js 20.x
-        uses: actions/setup-node@v3
+      - name: Setup Node.js 26
+        uses: actions/setup-node@v6
         with:
-          node-version: 20.x
+          node-version: 26
 
       - name: Install Dependencies
-        run: yarn
+        run: yarn install --frozen-lockfile
 
       - name: Create Release Pull Request or Publish to npm
         id: changesets
-        uses: step-security/action@v1
+        uses: step-security/changeset-action@v1
         with:
           # This expects you to have a script called release which does a build for your packages and calls changeset publish
-          publish: yarn release
+          publish: pnpm release
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 
@@ -106,7 +111,7 @@ jobs:
 
 By default the GitHub Action creates a `.npmrc` file with the following content:
 
-```
+```txt
 //registry.npmjs.org/:_authToken=${process.env.NPM_TOKEN}
 ```
 
@@ -143,24 +148,24 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
 
-      - name: Setup Node.js 20.x
-        uses: actions/setup-node@v3
+      - name: Setup Node.js 26
+        uses: actions/setup-node@v6
         with:
-          node-version: 20.x
+          node-version: 26
 
       - name: Install Dependencies
-        run: yarn
+        run: yarn install --frozen-lockfile
 
       - name: Create Release Pull Request or Publish to npm
         id: changesets
-        uses: step-security/action@v1
+        uses: step-security/changeset-action@v1
 
       - name: Publish
         if: steps.changesets.outputs.hasChangesets == 'false'
         # You can do something when a publish should happen.
-        run: yarn publish
+        run: pnpm publish
 ```
 
 #### With version script
@@ -185,30 +190,30 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
 
-      - name: Setup Node.js 20.x
-        uses: actions/setup-node@v3
+      - name: Setup Node.js 26
+        uses: actions/setup-node@v6
         with:
-          node-version: 20.x
+          node-version: 26
 
       - name: Install Dependencies
-        run: yarn
+        run: yarn install --frozen-lockfile
 
       - name: Create Release Pull Request
-        uses: step-security/action@v1
+        uses: step-security/changeset-action@v1
         with:
           # this expects you to have a npm script called version that runs some logic and then calls `changeset version`.
-          version: yarn version
+          version: pnpm version
 ```
 
 #### With Yarn 2 / Plug'n'Play
 
 If you are using [Yarn Plug'n'Play](https://yarnpkg.com/features/pnp), you should use a custom `version` command so that the action can resolve the `changeset` CLI:
 
 ```yaml
-- uses: step-security/action@v1
+- uses: step-security/changeset-action@v1
   with:
     version: yarn changeset version
-    ...
+    # ...
 ```

__fixtures__/ignored-package/.changeset/config.json

@@ -1,4 +0,0 @@
-{
-  "$schema": "https://unpkg.com/@changesets/config@1.3.0/schema.json",
-  "ignore": ["ignored-package-pkg-a"]
-}

__fixtures__/ignored-package/package.json

@@ -1,8 +0,0 @@
-{
-  "private": true,
-  "name": "ignored-package",
-  "version": "1.0.0",
-  "workspaces": [
-    "packages/*"
-  ]
-}

__fixtures__/ignored-package/packages/pkg-a/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "ignored-package-pkg-a",
-  "version": "1.0.0",
-  "dependencies": {
-    "ignored-package-pkg-b": "1.0.0"
-  }
-}

__fixtures__/ignored-package/packages/pkg-b/package.json

@@ -1,4 +0,0 @@
-{
-  "name": "ignored-package-pkg-b",
-  "version": "1.0.0"
-}

__fixtures__/simple-project/.changeset/config.json

@@ -1,3 +0,0 @@
-{
-  "$schema": "https://unpkg.com/@changesets/config@1.3.0/schema.json"
-}

__fixtures__/simple-project/package.json

@@ -1,8 +0,0 @@
-{
-  "private": true,
-  "name": "simple-project",
-  "version": "1.0.0",
-  "workspaces": [
-    "packages/*"
-  ]
-}

__fixtures__/simple-project/packages/pkg-a/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "simple-project-pkg-a",
-  "version": "1.0.0",
-  "dependencies": {
-    "simple-project-pkg-b": "1.0.0"
-  }
-}

__fixtures__/simple-project/packages/pkg-b/package.json

@@ -1,4 +0,0 @@
-{
-  "name": "simple-project-pkg-b",
-  "version": "1.0.0"
-}