chore(ci): bump changeset to v2 - #62
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
There was a problem hiding this comment.
🟡 Changes recommended
The workflow sets permissions: {} but the new Changesets v2 artifact-based steps need actions permissions to upload/download artifacts, which can cause releases to fail.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR updates the GitHub Actions release workflow to use Changesets Action v2’s split sub-actions (select-mode, version, pack, publish) and adds workflow-level hardening (permissions: {}) plus concurrency control.
Changes:
- Replace
changesets/action@v1.4.1with v2 sub-actions (select-mode,version,pack,publish) pinned tov2.1.1. - Add workflow-level
permissions: {}and set job-scoped permissions. - Add
concurrencygrouping for release runs.
File summaries
| File | Description |
|---|---|
| .github/workflows/release.yml | Migrates the release pipeline to Changesets Action v2 sub-actions and updates permissions/concurrency. |
Review details
Suppressed comments (2)
.github/workflows/release.yml:66
changesets/action/packdownloads the publish-plan artifact and uploads the packed output artifact, but this job token currently has noactionspermission (workflow setspermissions: {}), so artifact download/upload can fail.
permissions:
contents: read
.github/workflows/release.yml:92
changesets/action/publishdownloads the pack-dir artifact via the Actions artifacts API, but this job token currently lacksactions: read(workflow setspermissions: {}), so the artifact download can fail.
permissions:
contents: write
id-token: write
steps:
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
No description provided.