catalog/.github/workflows/changeset.yml at main · existential-engineering/catalog · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
name: Changeset

on:
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  changeset:
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
          # No authenticated git ops run after checkout (only local diff and
          # `changeset status --since=origin/main`), so don't leave the token
          # in .git/config while `pnpm install` runs PR-authored build scripts.
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: "24"

      - name: Setup pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # Catalog data PRs must ship a valid changeset. `changeset status
      # --since=origin/main` scopes the check to the changeset(s) THIS PR adds
      # and fails (non-zero exit) when either:
      #   * the changeset names a package that isn't in the workspace
      #     (e.g. "@existential/catalog") — the same error that aborts the
      #     Release workflow's `changeset version` and silently blocks every
      #     release; or
      #   * data changed but no changeset was added at all.
      # Chore/dependency PRs (no data/*.yaml change) are skipped, so this never
      # burdens renovate or docs-only PRs. `origin/main` is available because
      # the checkout above uses fetch-depth: 0.
      - name: Verify changeset for data changes
        run: |
          if git diff --name-only origin/main...HEAD | grep -qE '^data/.*\.yaml$'; then
            echo "Data files changed — validating this PR's changeset."
            pnpm changeset status --since=origin/main
          else
            echo "No data/*.yaml changes in this PR — changeset check skipped."
          fi

      # Dependency PRs (e.g. renovate) skip the data changeset check above, so a
      # dependency bump that breaks the *release* tooling passes CI green and only
      # explodes later in the Release workflow's `changeset version` — silently
      # blocking every release. This step closes that gap: `changeset status`
      # runs @manypkg/get-packages, which reads pnpm-workspace.yaml via
      # read-yaml-file — the exact path that crashes when read-yaml-file is
      # upgraded to an ESM-only major while @changesets/cli still pins the CJS
      # @manypkg/get-packages@1.x (see the read-yaml-file override note in
      # pnpm-workspace.yaml). `--since=HEAD` means "no packages changed", so the
      # check only exercises the load path and never demands a changeset here.
      #   * Healthy → exit 0.
      #   * Release-breaking dep combo → non-zero, blocking the merge instead of
      #     the release. When a future @changesets/cli (3.x, ESM manypkg) makes
      #     read-yaml-file v3 loadable, this goes green on its own — so the
      #     override can stay un-ignored by renovate and this is the oracle.
      - name: Verify release tooling can load the workspace
        run: pnpm changeset status --since=HEAD