ci: move to changesets 3, changesets/action v2 and checkout v7

[rqbazan]

Summary

Moves the release stack to Changesets 3 and bumps the two actions that still ran on old majors. Job ids, job names and workflow names stay the same, so the required checks (Test, Audit workflows) do not move. jdx/mise-action is already v4.3.0 since #16 and is not touched here.

 package.json (devDependencies)
-  @changesets/cli               ^2.31.0
-  @changesets/changelog-github  ^0.7.0
+  @changesets/cli               ^3.0.3
+  @changesets/changelog-github  ^1.0.1

 .changeset/config.json
-  $schema  @changesets/config@3.1.1
+  $schema  @changesets/config@4.0.1
+  format   false

 release.yml > Release > "Release or version PR"
-  changesets/action v1.9.0
-    commit, title, publish, setupGitUser: false, commitMode: github-api
-    env.GITHUB_TOKEN = app token
+  changesets/action v2.1.2
+    commit-message, pr-title, publish-script   (same values)
+    github-token = app token                   (unchanged)
     env.LEFTHOOK = 0                           (kept)

 ci.yml (Test), release.yml (Release, Preview), workflow-audit.yml (Audit workflows)
-  actions/checkout v4.4.0
+  actions/checkout v7.0.1

Every third-party action stays pinned by full commit SHA with a matching # vX.Y.Z comment, and the withvariablelab/* refs stay at @main. The Mint vland-bot token and Configure git user steps are unchanged. The lockfile diff is what pnpm add -D @changesets/cli@^3.0.3 @changesets/changelog-github@^1.0.1 --lockfile-only produces on main: it swaps the changesets v2 tree (prettier 2.8.8, fs-extra, enquirer, @manypkg v1, ...) for the v3 tree, and no vite or vitest version changes. This PR adds no changeset: it changes CI only and ships nothing in the package.

What changes in the next release

The first Release run after merge is not a release. main has no pending changesets and no "chore: update versions" PR is open, so the action finds no changesets and runs pnpm changeset publish. That is now v3, and on this branch v3 already says "No projects to publish or tag": 2.0.1 is on npm and tag v2.0.1 exists. So nothing is published, nothing is tagged and no PR is opened. This PR carries no changeset, so it does not cause a release by itself.

From the next real changeset on:

• Version PR: changesets/action v2.1.2 opens or updates it with the vland-bot token, with title and commit message "chore: update versions". It pushes through the GitHub API, which is now the default (push-with-git-cli: false) and the same as the removed commitMode: github-api, so bot commits are GitHub-signed. The action injects GITHUB_TOKEN itself from github-token, and the "Configure git user" step stays. The action also checks that the root package.json declares @changesets/cli v3.
• Version step (changesets 3.0.3): edits package.json in place, changing only the version field, instead of reformatting the biome-formatted file. It adds a CHANGELOG entry in the same [#N](pull) [`sha`](commit) Thanks [@user]! - summary shape (checked with changelog-github 1.0.1 against real commit 6cc642d). Because of "format": false, the entry is written as changelog-github generates it: it is no longer run through the bundled prettier 2.8.8, nor through biome or oxfmt.
• Publish: pnpm changeset publish publishes @variablelab/theme-toggle over npm OIDC trusted publishing as before. It runs pnpm publish --json --access public --tag latest --no-git-checks, the same command as CLI 2.x; v3 only strips the OTP env vars, so OIDC still works, and prepublishOnly (rr pack) still runs inside pnpm publish. The tag stays v<version> (e.g. v2.0.2), because manypkg v3 still detects this repo as a single-package 'root' tool; existing tags are v1.0.0, v2.0.0 and v2.0.1. The tag and the GitHub release come from the CHANGESETS_OUTPUT file the action sets (create-github-releases defaults to true).

The same single-package stack already shipped in brand: brand#12 then brand#10 released @variablelab/brand@0.3.1 with OIDC trusted publishing, provenance, tag v0.3.1 and a GitHub release. The registry took about 6 minutes to show it.

The Preview job is unaffected by changesets (it uses withvariablelab/gh-actions preview-release); it only gets checkout v7. This branch uses the chore/ prefix, so Preview does not run on this PR.

checkout v4.4.0 -> v7.0.1 moves the action runtime from Node 20 to Node 24. Its main behaviour change blocks checking out fork PRs on pull_request_target / workflow_run; none of these workflows use those triggers, and persist-credentials is already false everywhere.

Not exercised locally: the action's own API push of the version commit when the config has commit: true (changeset version commits locally first). v1 did the same in github-api mode and PR #15 worked that way. I am only noting it as unverified.

The real test is the next "chore: update versions" PR, and only the user merges that one.

Evidence

Local checks on this branch:

pnpm install --frozen-lockfile    exit 0
pnpm rr check                     check passed (biome, oxlint type-aware)
pnpm test                         25 passed (2 files)
actionlint                        exit 0
zizmor 1.30.1 (online audits)     No findings to report (1 suppressed)   same as origin/main
pnpm changeset publish-plan       No projects to publish or tag.

pnpm changeset status exits 1 with "Some packages have been changed but no changesets were found". The only cause is this branch's own devDependency change, which by design has no changeset; CI does not run changeset status, and earlier CI PRs (#10, #11, #12, #16) carried none either.

Release simulation in a throwaway worktree, with a test patch changeset on @variablelab/theme-toggle committed first:

• Before (v2 stack, PR chore: update versions #15): 3 files changed: the changeset deleted, CHANGELOG.md +6 (## 2.0.1 / ### Patch Changes / one bullet), package.json one line (2.0.0 -> 2.0.1).
• After (v3 stack): GITHUB_TOKEN=... pnpm changeset version made RELEASING: Releasing 1 package(s) / @variablelab/theme-toggle@2.0.2 / [skip ci] with the same 3 files: the changeset deleted, CHANGELOG.md +6 (## 2.0.2 / ### Patch Changes / - test, normal spacing) and package.json with only the version line changed (2.0.1 -> 2.0.2, formatting preserved). publish-plan then listed @variablelab/theme-toggle@2.0.2 (latest), and manypkg reported tool root, so the tag would be v2.0.2.

Nothing was published or pushed from the simulation.

Merge Danger

Door: two-way

Reverting this PR puts back changesets 2, changesets/action v1.9.0 and checkout v4. The one step that cannot be undone is an npm publish, and that only happens when the user merges the next "chore: update versions" PR.

Blast Radius: release

If the new action or CLI misbehaves, the risk is a broken or wrong "chore: update versions" PR, or a publish that fails to create the tag or release. Package consumers are not affected until a release is merged. CI (Test, Audit workflows) runs on the same job names, so the rulesets keep matching.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BR6x3TNrgMhtDABYaH6hx8

[changeset-bot]

⚠️ No Changeset found

Latest commit: 6a32d5f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR