fix(pnpm-release-changeset): restore action v1, add the OIDC variant, and split into v1/v2 lines

.github/workflows/pnpm-release-changeset-oidc.yml

@@ -0,0 +1,100 @@
+name: pnpm-release-changeset-oidc
+# Secretless variant of pnpm-release-changeset.yml.
+#
+# Differences from that workflow:
+#   - No CI_GITHUB_TOKEN. Uses the built-in GITHUB_TOKEN with elevated `permissions`.
+#     Trade-off: a PR opened with GITHUB_TOKEN does not trigger `on: pull_request`
+#     workflows, so the "version packages" PR gets no status checks. That is already the
+#     case across this org — every consumer's pull-request.yml carries
+#     `branches-ignore: ['changeset-release/*']` — so adopting this costs nothing that
+#     was not already given up deliberately.
+#   - No NPM_TOKEN. Publishes via npm trusted publishing (OIDC), which also emits
+#     provenance attestations. Each package must have a trusted publisher registered at
+#     npmjs.com/package/<name>/access naming the repo and the *caller* workflow's
+#     filename (release.yml), not this file. Publishing fails with a 404-style auth
+#     error until that registration exists.
+#
+# Why bother, given this org does have a secret scope: CI_GITHUB_TOKEN and NPM_TOKEN are
+# long-lived credentials that expire silently and are worth stealing. An expired
+# NPM_TOKEN is the kind of failure nobody notices until a release has been missing from
+# the registry for months. OIDC credentials are minted per run and last minutes.
+#
+# This is the v1 line, so it pairs changesets/action@v1 with @changesets/cli v2. The
+# pairing is strict and enforced by the action itself: action v2 refuses to run against
+# CLI v2, and directs you here. Consumers on @changesets/cli v3 want the v2 tag of this
+# repo instead. See README "What counts as breaking".
+#
+# Added alongside pnpm-release-changeset.yml rather than replacing it, so repos that have
+# not registered trusted publishers keep working.
+on:
+  workflow_call:
+    inputs:
+      pnpm-version:
+        type: string
+        required: false
+      node-version:
+        type: string
+        required: false
+        default: '24'
+    outputs:
+      published:
+        description: 'Whether the release was published'
+        value: ${{ jobs.release.outputs.published }}
+
+permissions:
+  # Mints the OIDC token npm exchanges for short-lived publish credentials.
+  id-token: write
+  # Lets changesets/action push the version branch and tags.
+  contents: write
+  # Lets changesets/action open the "version packages" PR.
+  pull-requests: write
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    env:
+      PLAYWRIGHT_PATH: ~/.cache/ms-playwright
+    outputs:
+      published: ${{ steps.changesets.outputs.published }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - uses: pnpm/action-setup@v6
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: ${{ inputs.node-version }}
+          cache: pnpm
+          registry-url: https://registry.npmjs.org
+
+      # Trusted publishing requires npm 11.5.1+. Node LTS may ship an older npm.
+      - name: Ensure npm supports trusted publishing
+        run: |
+          npm install -g npm@latest
+          npm --version
+
+      - name: Install Dependencies
+        run: pnpm install
+
+      - name: Install playwright browsers
+        uses: repobuddy/.github/.github/actions/setup-playwright@main
+
+      - name: Install vsce
+        run: pnpm install -g vsce
+
+      - run: pnpm build
+
+      # No .npmrc token step: the OIDC exchange supplies credentials at publish time.
+      - name: Create Release Pull Request or Publish to npm
+        id: changesets
+        uses: changesets/action@v1
+        with:
+          commit: 'chore: version packages'
+          version: pnpm run version
+          publish: pnpm run release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pnpm-release-changeset.yml

@@ -53,7 +53,7 @@ jobs:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
       - name: Create Release Pull Request or Publish to npm
         id: changesets
-        uses: changesets/action@v2.0.0
+        uses: changesets/action@v1
         with:
           commit: 'chore: version packages'
           version: pnpm run version